[chenlc03]

@Elvandil,

I thought it's the machine's registry since I could see my installed software settings. So if it's UBCD's registry, is there a way to access the registry on the hard drive?

[Elvandil]

I think the UBCD4Win (if that is what you are using) had RegeditPE on it. When you start it up, it asks about loading the host registry, and what hives, as subkeys to the UBCD registry. After that, you can see the host registry as a subkey of the UBCD registry.

[chenlc03]

I am thinking to add an answer file to my XP CD. Will that work?

[Elvandil]

The trouble is that at this point, nothing remains of the old registry. It has probably been replaced by a new system registry by setup. So changes made at this point are pretty meaningless, I suspect.

Did you start setup from the beginning wirth a USB kb?

[chenlc03]

Yes, I used a USB board but it did not work either. If everything is wiped clean in the registry, then Windows should be able to recognize the keyboard. Apparently, there are something still there. Doesn't repair install suppose to keep most of my registry settings?

[chenlc03]

@Elvandil,

I just realized that UBCD4Win's Regedit is to edit its own registry. Only Regedit remote does access local machine's registry. So you are absolutely right, I was not looking at the right registry. When I looked at the registry from the local system, I did find there was an additional value "TfKbMon" in the "UpperFilters" item, under the ControlSet1\Class key. I deleted "TfKbMon"and restarted setup, but the problem was still the same. Then I rebooted with UBCD4Win and I found that the "TfKbMon"came back. What else should I do?

[chenlc03]

I think I now know what went wrong but I don't know how to fix it. When ThreatFire was uninstalled, somehow its registry values were not removed. Specifically, the program left a TfkbMon value in the "UpperFilters" item. The value was loaded into Windows setup and since the TFkbmon was gone, the keyboard stopped responding.

[Elvandil]

Where was that entry? Was it under Services?

[chenlc03]

It was under \Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}:UpperFilters It has a "TFkbmon" value before "kbdclass."

[Elvandil]

OK. But I'm not sure that removing that prevents the system from trying to load the driver. Did you also try deleting the driver and any entry that may exist under HKLM\System\Control\CurrentControlSet?

(There won't be a current control set in a non-running system, so it would be under ControlSet1, 2, and maybe 3 in the UBCD registry import.)

[chenlc03]

Yes, I found "TFkbmon" value under ControlSet001 and additional TFservice, TFKbmon, TFFsmon, TFNetmon under HKLM\Control\ControlSet001(002)\Services. Do I need to delete all of them or just TFKbMon?

[Elvandil]

If that is uninstalled, they should all be gone. If not, better just remove the kb one, but export, as a good habit, just in case you ever need to restore it.

[chenlc03]

I finally got that fixed. I copied TFkbmon.sys from another machine into the Driver folder and everything was back to normal. Thank you very much for your help!