Does anyone know the answer?

Hi,

This is my second post about the same problem (First post «Why did MS visual
keyboard stop working?» dated Oct 31, 2008, 10:19)

I have an administrator account on a Windows Vista computer on which I am
the only user.
The User Account Control is active.
No change has been made to my account.

I have installed and removed some programs recently and since about that
time I can't open the Microsoft Visual Keyboard.
I get this message:
C:\Windows\System 32\osk.exe
A referral was returned from the server.

Does anyone know the way to fix that problem?

Thanks,
André

"A.BORD" <> wrote in message
news:12ABB905-39BE-4B9A-89E5-...
> Hi,
>
> This is my second post about the same problem (First post «Why did MS
> visual keyboard stop working?» dated Oct 31, 2008, 10:19)
>
> I have an administrator account on a Windows Vista computer on which I am
> the only user.
> The User Account Control is active.
> No change has been made to my account.
>
> I have installed and removed some programs recently and since about that
> time I can't open the Microsoft Visual Keyboard.
> I get this message:
> C:\Windows\System 32\osk.exe
> A referral was returned from the server.
>
> Does anyone know the way to fix that problem?
>
> Thanks,
> André


It sounds like the osk.exe file has been overwritten by one of those
programs you've installed, since that message doesn't seem to make much
sense in the context of an on-screen keyboard.

So to reverse back you could perhaps

(1) copy over an 'osk.exe' from a working version,
or
(2) uninstall the suspect programs / run a system restore etc


--
Jon

Hi Jon,

I don't quite understand what you mean by : «copy over an 'osk.exe' from a
working version». Could you explain?

As far as a suspect program, the only one I can think of is the installation
of Trusteer Rapport, which is supposed to be a financial malware prevention
tool. After the installation of that program, my Kaspersky reported in its
journal some actions similar to a keylogger [C:\PROGRAM
FILES\TRUSTEER\RAPPORT\BIN\RAPPORTKE.SYS]. Some french accents ( grave,
circumflex, cedilla and umlauts) of my PS/2 keyboard became inoperable.
Trusteer Support suggested to remove the installed version and to replace it
with a new version. I followed the instructions given by Trusteer to
completely remove the program. My Kaspersky kept reporting actions similar
to a keylogger, but from a different source: \DRIVER\RAPPORTKE. I could
not locate that file or that source, so I decided to do a system restore
prior to the original installation date of Trusteer Rapport. The french
accents of my keyboard came back normal and Kaspersky stopped reporting the
keylogger. Needless to say that I wasn't inclined to install the suggested
new version of Trusteer Rapport.

It was about those days of troubleshooting my PS/2 keyboard problems that I
noticed the Microsoft Visual Keyboard would not start, giving the message:
« A referral was returned from the server.»

Any relation between those two incidents?
If so, why did the Microsoft Visual Keyboard not come back after that system
restore?

Thanks for your help,
André



"Jon" <> a écrit dans le message de groupe
de discussion : uzXW#...
> "A.BORD" <> wrote in message
> news:12ABB905-39BE-4B9A-89E5-...
>> Hi,
>>
>> This is my second post about the same problem (First post «Why did MS
>> visual keyboard stop working?» dated Oct 31, 2008, 10:19)
>>
>> I have an administrator account on a Windows Vista computer on which I am
>> the only user.
>> The User Account Control is active.
>> No change has been made to my account.
>>
>> I have installed and removed some programs recently and since about that
>> time I can't open the Microsoft Visual Keyboard.
>> I get this message:
>> C:\Windows\System 32\osk.exe
>> A referral was returned from the server.
>>
>> Does anyone know the way to fix that problem?
>>
>> Thanks,
>> André
>
>
> It sounds like the osk.exe file has been overwritten by one of those
> programs you've installed, since that message doesn't seem to make much
> sense in the context of an on-screen keyboard.
>
> So to reverse back you could perhaps
>
> (1) copy over an 'osk.exe' from a working version,
> or
> (2) uninstall the suspect programs / run a system restore etc
>
>
> --
> Jon
>
>
>

"A.BORD" <> wrote in message
news:78F6774E-B200-47AF-99B6-...
> Hi Jon,
>
> I don't quite understand what you mean by : «copy over an 'osk.exe' from
> a working version». Could you explain?
>

Hi André

Sure. The idea there being that if you have a parallel installation of Vista
eg either another machine or a dual-boot system on the same machine, then
you could use that other installation to replace any suspect files by
copying over them etc. Osk.exe for example should be at

C:\Windows\System32\osk.exe

If you don't then it isn't an option.



In the olden days of XP, this command was helpful in ensuring that operating
system files were legit, which would be run from an 'elevated' (Run as
administrator) cmd.exe prompt in Vista

sfc /scannow

Not sure how effective it is now as a repair tool in Vista, but may be
worth a try eg for flagging up suspect files.


> As far as a suspect program, the only one I can think of is the
> installation of Trusteer Rapport, which is supposed to be a financial
> malware prevention tool. After the installation of that program, my
> Kaspersky reported in its journal some actions similar to a keylogger
> [C:\PROGRAM FILES\TRUSTEER\RAPPORT\BIN\RAPPORTKE.SYS]. Some french
> accents ( grave, circumflex, cedilla and umlauts) of my PS/2 keyboard
> became inoperable. Trusteer Support suggested to remove the installed
> version and to replace it with a new version. I followed the instructions
> given by Trusteer to completely remove the program. My Kaspersky kept
> reporting actions similar to a keylogger, but from a different source:
> \DRIVER\RAPPORTKE. I could not locate that file or that source, so I
> decided to do a system restore prior to the original installation date of
> Trusteer Rapport. The french accents of my keyboard came back normal and
> Kaspersky stopped reporting the keylogger. Needless to say that I wasn't
> inclined to install the suggested new version of Trusteer Rapport.
>
> It was about those days of troubleshooting my PS/2 keyboard problems that
> I noticed the Microsoft Visual Keyboard would not start, giving the
> message: « A referral was returned from the server.»
>
> Any relation between those two incidents?
> If so, why did the Microsoft Visual Keyboard not come back after that
> system restore?
>
> Thanks for your help,
> André
>
>


It would sound like this Trusteer Rapport installed a keyboard driver
itself, which isn't a particularly healthy sign. Kaspersky is an established
reputable brand, so I would trust their judgement over and above Trusteer
Rapport, although I suppose (being generous here) it could just be a case of
2 anti-malware systems not sitting well with each other.

Anyhow, System Restore should normally fix things, especially with operating
system files in the system32 directory, so to me that suggests that this
on-screen keyboard issue preceded even that first installation of Trusteer
Rapport. If you have an even further back Restore point you could perhaps
try that.

If not then the installation sounds fairly compromised, so I would be
tempted to backup your important files, scrap it and then start again ie
reinstall.

[Alternatively get hold of a good hex editor, a decent disassembler, a
resource editor, and explore the mystery further....... ]

--
Jon

Hi Jon,

I don't have a parrallel installation of Vista to copy over an "osk.exe".

sfc /scannow found no problems.

But I found one thing I don't understand (!):
When I use the Command Prompt - Run as administrator - type: osk.exe -
enter, the Microsoft Visual Keyboard opens normally. Then during the same
session, I can open the Visual Keyboard via Start/All
programs/Accessories... or via a shortcut on the desktop, just like it is
supposed to be.
After a normal shutdown and restart of my computer, I can't open it, getting
the same error problem. I have to repeat the Command Prompt actions to get
the Visual Keyboard and subsequently restart it normally if I want with the
shortcut or via Start/All programs, as long as it is done during the same
session.

Any ideas why?

André

----------

"Jon" <> a écrit dans le message de groupe
de discussion : ...
> "A.BORD" <> wrote in message
> news:78F6774E-B200-47AF-99B6-...
>> Hi Jon,
>>
>> I don't quite understand what you mean by : «copy over an 'osk.exe' from
>> a working version». Could you explain?
>>
>
> Hi André
>
> Sure. The idea there being that if you have a parallel installation of
> Vista eg either another machine or a dual-boot system on the same machine,
> then you could use that other installation to replace any suspect files by
> copying over them etc. Osk.exe for example should be at
>
> C:\Windows\System32\osk.exe
>
> If you don't then it isn't an option.
>
>
>
> In the olden days of XP, this command was helpful in ensuring that
> operating system files were legit, which would be run from an 'elevated'
> (Run as administrator) cmd.exe prompt in Vista
>
> sfc /scannow
>
> Not sure how effective it is now as a repair tool in Vista, but may be
> worth a try eg for flagging up suspect files.
>
>
>> As far as a suspect program, the only one I can think of is the
>> installation of Trusteer Rapport, which is supposed to be a financial
>> malware prevention tool. After the installation of that program, my
>> Kaspersky reported in its journal some actions similar to a keylogger
>> [C:\PROGRAM FILES\TRUSTEER\RAPPORT\BIN\RAPPORTKE.SYS]. Some french
>> accents ( grave, circumflex, cedilla and umlauts) of my PS/2 keyboard
>> became inoperable. Trusteer Support suggested to remove the installed
>> version and to replace it with a new version. I followed the
>> instructions given by Trusteer to completely remove the program. My
>> Kaspersky kept reporting actions similar to a keylogger, but from a
>> different source: \DRIVER\RAPPORTKE. I could not locate that file or
>> that source, so I decided to do a system restore prior to the original
>> installation date of Trusteer Rapport. The french accents of my keyboard
>> came back normal and Kaspersky stopped reporting the keylogger. Needless
>> to say that I wasn't inclined to install the suggested new version of
>> Trusteer Rapport.
>>
>> It was about those days of troubleshooting my PS/2 keyboard problems that
>> I noticed the Microsoft Visual Keyboard would not start, giving the
>> message: « A referral was returned from the server.»
>>
>> Any relation between those two incidents?
>> If so, why did the Microsoft Visual Keyboard not come back after that
>> system restore?
>>
>> Thanks for your help,
>> André
>>
>>
>
>
> It would sound like this Trusteer Rapport installed a keyboard driver
> itself, which isn't a particularly healthy sign. Kaspersky is an
> established reputable brand, so I would trust their judgement over and
> above Trusteer Rapport, although I suppose (being generous here) it could
> just be a case of 2 anti-malware systems not sitting well with each other.
>
> Anyhow, System Restore should normally fix things, especially with
> operating system files in the system32 directory, so to me that suggests
> that this on-screen keyboard issue preceded even that first installation
> of Trusteer Rapport. If you have an even further back Restore point you
> could perhaps try that.
>
> If not then the installation sounds fairly compromised, so I would be
> tempted to backup your important files, scrap it and then start again ie
> reinstall.
>
> [Alternatively get hold of a good hex editor, a decent disassembler, a
> resource editor, and explore the mystery further....... ]
>
> --
> Jon
>
>
>
>

"A.BORD" <> wrote in message
news06AB0B7-6495-413B-9492-...

> But I found one thing I don't understand (!):
> When I use the Command Prompt - Run as administrator - type: osk.exe -
> enter, the Microsoft Visual Keyboard opens normally. Then during the same
> session, I can open the Visual Keyboard via Start/All
> programs/Accessories... or via a shortcut on the desktop, just like it is
> supposed to be.
> After a normal shutdown and restart of my computer, I can't open it,
> getting the same error problem. I have to repeat the Command Prompt
> actions to get the Visual Keyboard and subsequently restart it normally if
> I want with the shortcut or via Start/All programs, as long as it is done
> during the same session.
>
> Any ideas why?
>
> André
>

Hi André

I'll confess I don't know why it should require to be run elevated
initially, but if that's the only program you're experiencing issues with,
then there's something odd happening there.

I can't really think of anything else to suggest, other than a hands-on
painstaking exploration of what actually happens when you first click on the
file eg using such tools as Process Monitor (free)

Process Monitor v2.02
http://technet.microsoft.com/en-us/s.../bb896645.aspx

which in fact illustrates one of the limitations of newsgroup /. forum help.
Some things are easier done than said.

But if you do ever discover the cause, I'd be interested to know.

--
Jon