USB drive problem
Solved
toufik
-
Nyctaclope Posted messages 5295 Registration date Status Member Last intervention -
Nyctaclope Posted messages 5295 Registration date Status Member Last intervention -
Hello,
1- What does the letter F on the USB key mean?
2- When I plug in my USB key, a green symbol appears at the bottom of the screen, auto-start does not occur, and when I try to open it through My Computer, I can't find any trace of it.
I tried to find any issues through the Device Manager, but it reports that the device in question (USB mass storage device) is working properly.
Obs1: my USB key works normally on any PC other than mine, and no USB key works on my PC.
Obs2: all USB ports are functioning normally.
Thank you in advance for your help.
1- What does the letter F on the USB key mean?
2- When I plug in my USB key, a green symbol appears at the bottom of the screen, auto-start does not occur, and when I try to open it through My Computer, I can't find any trace of it.
I tried to find any issues through the Device Manager, but it reports that the device in question (USB mass storage device) is working properly.
Obs1: my USB key works normally on any PC other than mine, and no USB key works on my PC.
Obs2: all USB ports are functioning normally.
Thank you in advance for your help.
Configuration: Windows XP Internet Explorer 7.0
55 answers
- 1
- 2
- 3
Next
Re
Very good comments above, I think you’re doing pretty well ... :)
Your drive is not read in terms of its content, but it is readable and in good condition, and that’s already good news.
No question of formatting it! ...
I think your drive cannot be fully assigned the letter F: which is probably also taken by another drive:
Your drive has a main partition (with MBR) that would allow it to be bootable, giving it a certain priority over other removable devices when letters are assigned. But if another drive has been assigned the same letter with a similar priority (for example, a network drive), and that’s what we’re going to see, sometimes Windows loses track in such situations ...
It’s possible that the Bluetooth device connection has something to do with it, as it should be similar to a network drive connection, probably (like in previous versions of Windows) automatically at logon. The connection must have been made in the absence of the drive, and it took its place. I do have a Bluetooth connection, but no device, so I can’t test it.
You mentioned in your post 1 a letter F:, did you see it on another PC, or on your PC in disk management as follows?
If on another PC, was letter F: chosen (imposed) by the user? (see below ...)
Please do the following tests in order:
1// Right-click on My Computer on your desktop, select manage,
In the resulting window, select “disk management” from “storage”
At the bottom right, do you see, among all your disk windows, a window related to your drive? It should be assigned the letter F: (or maybe without a letter?).
Right-click on it, select “change drive letter” and try (temporarily) letter G:
Right-click on it again, select “explore” and see if the content displays.
I’m not sure, but maybe it would be necessary to “log out” of your session and come back ...
2// Connect to your Bluetooth, and check if the connection is effective.
In Windows Explorer, in the TOOLS menu, request to disconnect a network drive.
See if it tells you there are no drives to disconnect, or if it instead offers you letter F:, but don’t disconnect for the moment ...
3// Go to Start/run, type cmd /k then OK (put a space between cmd and /k)
In the DOS window that appears, do a series of DIR as indicated, and see if you display the contents of your drives:
DIR C: (your hard drive, it is indeed readable ...) (put a space between DIR and C:)
DIR F:
Dir G:
Do F: and G: return their contents??
Thank you for giving me all the details on this ..
If it is indeed your Bluetooth connection that is faulty, we will set things back in order with a few simple manipulations ...
The main thing is already to pinpoint the exact problem!
A+
Nyctaclope
Very good comments above, I think you’re doing pretty well ... :)
Your drive is not read in terms of its content, but it is readable and in good condition, and that’s already good news.
No question of formatting it! ...
I think your drive cannot be fully assigned the letter F: which is probably also taken by another drive:
Your drive has a main partition (with MBR) that would allow it to be bootable, giving it a certain priority over other removable devices when letters are assigned. But if another drive has been assigned the same letter with a similar priority (for example, a network drive), and that’s what we’re going to see, sometimes Windows loses track in such situations ...
It’s possible that the Bluetooth device connection has something to do with it, as it should be similar to a network drive connection, probably (like in previous versions of Windows) automatically at logon. The connection must have been made in the absence of the drive, and it took its place. I do have a Bluetooth connection, but no device, so I can’t test it.
You mentioned in your post 1 a letter F:, did you see it on another PC, or on your PC in disk management as follows?
If on another PC, was letter F: chosen (imposed) by the user? (see below ...)
Please do the following tests in order:
1// Right-click on My Computer on your desktop, select manage,
In the resulting window, select “disk management” from “storage”
At the bottom right, do you see, among all your disk windows, a window related to your drive? It should be assigned the letter F: (or maybe without a letter?).
Right-click on it, select “change drive letter” and try (temporarily) letter G:
Right-click on it again, select “explore” and see if the content displays.
I’m not sure, but maybe it would be necessary to “log out” of your session and come back ...
2// Connect to your Bluetooth, and check if the connection is effective.
In Windows Explorer, in the TOOLS menu, request to disconnect a network drive.
See if it tells you there are no drives to disconnect, or if it instead offers you letter F:, but don’t disconnect for the moment ...
3// Go to Start/run, type cmd /k then OK (put a space between cmd and /k)
In the DOS window that appears, do a series of DIR as indicated, and see if you display the contents of your drives:
DIR C: (your hard drive, it is indeed readable ...) (put a space between DIR and C:)
DIR F:
Dir G:
Do F: and G: return their contents??
Thank you for giving me all the details on this ..
If it is indeed your Bluetooth connection that is faulty, we will set things back in order with a few simple manipulations ...
The main thing is already to pinpoint the exact problem!
A+
Nyctaclope
Hi
I followed all the steps, here are some details:
1- When I opened the disk windows, I did find the one assigned to my flash drive, but the letter F was not listed there.
2- After changing the drive letter (G: temporarily as requested), the flash drive appeared in the Hard Disk Drives section, next to the local disk (C:) and not as usual in the Devices using removable media section. I opened it, and the content was displayed as well.
3- At step 2// the response to my request to disconnect a network drive was "there are no drives to disconnect"
4- At step 3// I proceeded exactly as asked, but I admit I didn't quite understand what you meant by (see if you display the content of your drives :) . Is it about seeing the content of the drives immediately after typing DIR C: - DIR F: - DIR G: or seeing it later? In any case, the content of the drives did not display right after typing DIR C: - DIR F: - DIR G:
5- Upon reconnecting the flash drive, the problem resurfaces and the content is once again inaccessible. Instead of the USB drive, I find small icons symbolizing the drive with the local disk written to the right (E:) local disk (G:) ...etc (depending on the letter I chose to access the content of the flash drive). So if I want to access the content of the flash drive, I have to restart all the previous steps and, of course, with a new letter each time.
Could it be some sort of device conflict?????
Once again, well done and thank you.
I followed all the steps, here are some details:
1- When I opened the disk windows, I did find the one assigned to my flash drive, but the letter F was not listed there.
2- After changing the drive letter (G: temporarily as requested), the flash drive appeared in the Hard Disk Drives section, next to the local disk (C:) and not as usual in the Devices using removable media section. I opened it, and the content was displayed as well.
3- At step 2// the response to my request to disconnect a network drive was "there are no drives to disconnect"
4- At step 3// I proceeded exactly as asked, but I admit I didn't quite understand what you meant by (see if you display the content of your drives :) . Is it about seeing the content of the drives immediately after typing DIR C: - DIR F: - DIR G: or seeing it later? In any case, the content of the drives did not display right after typing DIR C: - DIR F: - DIR G:
5- Upon reconnecting the flash drive, the problem resurfaces and the content is once again inaccessible. Instead of the USB drive, I find small icons symbolizing the drive with the local disk written to the right (E:) local disk (G:) ...etc (depending on the letter I chose to access the content of the flash drive). So if I want to access the content of the flash drive, I have to restart all the previous steps and, of course, with a new letter each time.
Could it be some sort of device conflict?????
Once again, well done and thank you.
Re
1// For step 3// (DIR series ..) you should have seen the (abbreviated) content of the disks. Did you indeed validate the DIR X: command by hitting Enter?
2// Your key is a "flash disk" equivalent to a hard drive, and it is probably normal that it appears listed among the disks, as it is not a "standard" USB key. But that does not explain the problem.
What version of XP do you have?? Home or Pro? Have you done all your updates, especially SP3??
You already have a way (temporary!) to explore your key, and we will try to resolve the problem properly.
I see two avenues for investigation (for now):
a// It may be that your "flash" key requires a specific driver, different from Usbstor.sys
- Can you go to the manufacturer's website of your key and do a little investigation, or give me the very exact specifications of your key? Also give me its size (that's for later).
- Plug your key in as G:, and go to www.ma-config.com. Have your complete configuration analyzed, and see if a more recent driver is offered for your USB device.
- In Device Manager, under the "disk drives" section, request the properties of your key, and try to update the driver to a "better" driver if Windows allows it.
b// It may be that the letter F: is "forbidden" by Windows. This has happened before.
You will need to tinker in the registry, but I need the exact version of your XP. That will be for later ...
A+
Nyctaclope
1// For step 3// (DIR series ..) you should have seen the (abbreviated) content of the disks. Did you indeed validate the DIR X: command by hitting Enter?
2// Your key is a "flash disk" equivalent to a hard drive, and it is probably normal that it appears listed among the disks, as it is not a "standard" USB key. But that does not explain the problem.
What version of XP do you have?? Home or Pro? Have you done all your updates, especially SP3??
You already have a way (temporary!) to explore your key, and we will try to resolve the problem properly.
I see two avenues for investigation (for now):
a// It may be that your "flash" key requires a specific driver, different from Usbstor.sys
- Can you go to the manufacturer's website of your key and do a little investigation, or give me the very exact specifications of your key? Also give me its size (that's for later).
- Plug your key in as G:, and go to www.ma-config.com. Have your complete configuration analyzed, and see if a more recent driver is offered for your USB device.
- In Device Manager, under the "disk drives" section, request the properties of your key, and try to update the driver to a "better" driver if Windows allows it.
b// It may be that the letter F: is "forbidden" by Windows. This has happened before.
You will need to tinker in the registry, but I need the exact version of your XP. That will be for later ...
A+
Nyctaclope
Re
Yes, I validated the command DIR X: by pressing Enter without seeing the (abbreviated) content of the drives.
How is it that my key is a "flash disk" equivalent to a hard drive when previously it worked perfectly normally as a "standard" USB key on my PC, and it still works as such on my friend's PC who has exactly the same hardware as mine?
I have XP Pro SP2.
I haven't updated to SP3 yet.
I can't connect my key as G, nor as E.
As for the driver update, the assistant indicated that there was no more than the current driver.
A real puzzle, isn't it?
Yes, I validated the command DIR X: by pressing Enter without seeing the (abbreviated) content of the drives.
How is it that my key is a "flash disk" equivalent to a hard drive when previously it worked perfectly normally as a "standard" USB key on my PC, and it still works as such on my friend's PC who has exactly the same hardware as mine?
I have XP Pro SP2.
I haven't updated to SP3 yet.
I can't connect my key as G, nor as E.
As for the driver update, the assistant indicated that there was no more than the current driver.
A real puzzle, isn't it?
Re
------------ section A --------------------
First regarding your posts 12, 14, and 15:
The DIR command had no consequence on the operations and was simply
a quick way, without going through the explorer, to see if the drive letters
were recognized.
If you correctly validated the command dir x: in the DOS window obtained
after the cmd command, it is not normal that you do not see any content
from the disk.
a// Regarding c:, since the command is executed from the folder
c:\documents and settings\toto (toto being your username), it is
normal that you do not see the usual part of c:, but you should see
something (the content of the subfolder toto).
b// Regarding f:, it was to see if there was a phantom f: drive
that could have blocked the assignment of this letter to your USB stick.
If it doesn't exist, you should have received an error message, such as
drive not found or unrecognized, or "path not found."
c// Regarding g:, after assigning this letter to your USB stick in
the disk management, you should have seen the content of your stick, as
you mentioned in your post 12: "I opened it, the content displayed
as well."
d// Given the current state of the problem, it is normal that removing and reinserting
the USB stick makes it lose its drive letter. However, I do not understand
this part of your post 12:
If I want to access the content of the stick, I must redo all
the previous steps and each time, a new letter for sure.
==> all the operations, no, just assign a letter to your stick in
the disk management.
==> you can't reuse the same letter g? (see e below).
e// your post 14:
"I can't connect my stick as G, nor as E."
E: might be taken by a CD drive, in which case it's normal,
but G: that worked (post 12), and now it doesn't work anymore??
"A real headache, isn't it?"
It seems to be, but I love it!
For now (but I still have time to rethink ..), I see
two hypotheses:
=> a mismanagement of drive letters by Windows. It is still
too early to be sure. This should be fixable in the registry.
=> it's your USB stick, or rather its internal management mode that is causing the chaos.
This after reviewing its technical documentation. See a following post.
There again I have questions for you.
And in particular, I will need you to send me images of the contents of
your USB stick. (see details in a next post).
------------ section B --------------------
Regarding the operation of your USB stick:
I understood that it works correctly on another PC at your friend's (same version of XP ??).
a// However, on your machine, I thought according to your initial post that the
problem occurred on YOUR machine for the first time.
Your post 14:
"while previously it worked perfectly as a 'standard' USB stick on my PC."
It worked normally before this problem??
Do you remember if since then you have fiddled with something in the Setup or
the registry?
b// Did you "install" this stick the first time with a CD, or a driver?
And first on YOUR machine, or was it retrieved after being installed elsewhere?
Indeed, if I have (not very well) understood the technical documentation in bad
English, it provides features (flash disk) superior to those of a simple stick,
notably regarding the "security" of the data. Its hidden files might enlighten me ..
c// If you can access your hidden "administrator" account (ALT CTRL
DELETE, 1 to 2 times, when entering your session screen) and if it has no
password, can you check if you have the same problem in this account??
Dinner time is approaching ...
I haven't finished (I'm counting on your patience! ..) and I think I will complete my questions
tonight..
Can you already shed some light on the above?? ..
Thank you in advance...
Talk to you soon
Nyctaclope
------------ section A --------------------
First regarding your posts 12, 14, and 15:
The DIR command had no consequence on the operations and was simply
a quick way, without going through the explorer, to see if the drive letters
were recognized.
If you correctly validated the command dir x: in the DOS window obtained
after the cmd command, it is not normal that you do not see any content
from the disk.
a// Regarding c:, since the command is executed from the folder
c:\documents and settings\toto (toto being your username), it is
normal that you do not see the usual part of c:, but you should see
something (the content of the subfolder toto).
b// Regarding f:, it was to see if there was a phantom f: drive
that could have blocked the assignment of this letter to your USB stick.
If it doesn't exist, you should have received an error message, such as
drive not found or unrecognized, or "path not found."
c// Regarding g:, after assigning this letter to your USB stick in
the disk management, you should have seen the content of your stick, as
you mentioned in your post 12: "I opened it, the content displayed
as well."
d// Given the current state of the problem, it is normal that removing and reinserting
the USB stick makes it lose its drive letter. However, I do not understand
this part of your post 12:
If I want to access the content of the stick, I must redo all
the previous steps and each time, a new letter for sure.
==> all the operations, no, just assign a letter to your stick in
the disk management.
==> you can't reuse the same letter g? (see e below).
e// your post 14:
"I can't connect my stick as G, nor as E."
E: might be taken by a CD drive, in which case it's normal,
but G: that worked (post 12), and now it doesn't work anymore??
"A real headache, isn't it?"
It seems to be, but I love it!
For now (but I still have time to rethink ..), I see
two hypotheses:
=> a mismanagement of drive letters by Windows. It is still
too early to be sure. This should be fixable in the registry.
=> it's your USB stick, or rather its internal management mode that is causing the chaos.
This after reviewing its technical documentation. See a following post.
There again I have questions for you.
And in particular, I will need you to send me images of the contents of
your USB stick. (see details in a next post).
------------ section B --------------------
Regarding the operation of your USB stick:
I understood that it works correctly on another PC at your friend's (same version of XP ??).
a// However, on your machine, I thought according to your initial post that the
problem occurred on YOUR machine for the first time.
Your post 14:
"while previously it worked perfectly as a 'standard' USB stick on my PC."
It worked normally before this problem??
Do you remember if since then you have fiddled with something in the Setup or
the registry?
b// Did you "install" this stick the first time with a CD, or a driver?
And first on YOUR machine, or was it retrieved after being installed elsewhere?
Indeed, if I have (not very well) understood the technical documentation in bad
English, it provides features (flash disk) superior to those of a simple stick,
notably regarding the "security" of the data. Its hidden files might enlighten me ..
c// If you can access your hidden "administrator" account (ALT CTRL
DELETE, 1 to 2 times, when entering your session screen) and if it has no
password, can you check if you have the same problem in this account??
Dinner time is approaching ...
I haven't finished (I'm counting on your patience! ..) and I think I will complete my questions
tonight..
Can you already shed some light on the above?? ..
Thank you in advance...
Talk to you soon
Nyctaclope
Re
the continuation:
------------ section C --------------------------------------------------------
Your post 15 detecting your config:
Broadcom Corp. Bluetooth 2.0+eDR USB dongle (BCM2045A)
Do you have a Bluetooth dongle??
Can you in device management disable (not remove!) your Bluetooth card,
restart and see if your USB dongle works better??
It's easier than trying to find a possible Bluetooth reader associated with it.
Or, if you have a removable Bluetooth dongle, disconnect it for the same test??
------------ section D --------------------------------------------------------
Info on your Alcor AU6982 USB dongle:
1// on the manufacturer's site:
http://www.alcormicro.com/products_list.php?main_id=16&second_id=9
No trace of AU6982, even though it was released in 12/2006
For AU6981, there is mention of a protection software.
2// on one site (reseller?):
http://datacent.com/datarecovery/hdd/usb_flash_key/AU6982
there are issues mentioned with this device, particularly recognition.
3// complete technical file in .pdf format:
http://www.sechangsemicon.com/data_files/goods/GS_17307.pdf
I haven't had time to read everything, and it's fairly dense English.
What intrigues me is that it mentions (?) data protection.
I have a dongle that has software (which I haven't used) allowing files to be hidden from prying eyes.
Hence my previous question about possibly installing software for your dongle.
------------ section E --------------------------------------------------------
I need you to send me two screenshots via the website:
http://www.imagilive.com/
Prepare your two images, host them one by one through this site, and send me back by copy/pasting in your post the two "image" addresses.
Prerequisite:
start/control panel/folder options/view:
Uncheck:
=>Hide file extensions
=>Hide protected operating system files
Folder "Hidden files and folders":
Check:
=>Show hidden files and folders
Desired screenshots:
1// the "disk management" window showing all your disks AND your dongle (with or without letter)
window wide enough to see the right, left, top and bottom panels, and all comments on partitions.
2// the display of your dongle's files (thus assigned a letter to be displayed)
It's mainly the files (hidden and others) in the root that interest me, not the folders.
Take screenshots of the active window using ALT Print Screen, paste into PAINT, and save as .jpeg
You will have to do a "browse" in the site.
I don't think you can host both images at the same time. Do it one by one.
If you have difficulties, I am available for details...
I didn't have time to explain this evening, and I think you won't have difficulties.
You have work to do!...
Thank you in advance...
A+
Nyctaclope
the continuation:
------------ section C --------------------------------------------------------
Your post 15 detecting your config:
Broadcom Corp. Bluetooth 2.0+eDR USB dongle (BCM2045A)
Do you have a Bluetooth dongle??
Can you in device management disable (not remove!) your Bluetooth card,
restart and see if your USB dongle works better??
It's easier than trying to find a possible Bluetooth reader associated with it.
Or, if you have a removable Bluetooth dongle, disconnect it for the same test??
------------ section D --------------------------------------------------------
Info on your Alcor AU6982 USB dongle:
1// on the manufacturer's site:
http://www.alcormicro.com/products_list.php?main_id=16&second_id=9
No trace of AU6982, even though it was released in 12/2006
For AU6981, there is mention of a protection software.
2// on one site (reseller?):
http://datacent.com/datarecovery/hdd/usb_flash_key/AU6982
there are issues mentioned with this device, particularly recognition.
3// complete technical file in .pdf format:
http://www.sechangsemicon.com/data_files/goods/GS_17307.pdf
I haven't had time to read everything, and it's fairly dense English.
What intrigues me is that it mentions (?) data protection.
I have a dongle that has software (which I haven't used) allowing files to be hidden from prying eyes.
Hence my previous question about possibly installing software for your dongle.
------------ section E --------------------------------------------------------
I need you to send me two screenshots via the website:
http://www.imagilive.com/
Prepare your two images, host them one by one through this site, and send me back by copy/pasting in your post the two "image" addresses.
Prerequisite:
start/control panel/folder options/view:
Uncheck:
=>Hide file extensions
=>Hide protected operating system files
Folder "Hidden files and folders":
Check:
=>Show hidden files and folders
Desired screenshots:
1// the "disk management" window showing all your disks AND your dongle (with or without letter)
window wide enough to see the right, left, top and bottom panels, and all comments on partitions.
2// the display of your dongle's files (thus assigned a letter to be displayed)
It's mainly the files (hidden and others) in the root that interest me, not the folders.
Take screenshots of the active window using ALT Print Screen, paste into PAINT, and save as .jpeg
You will have to do a "browse" in the site.
I don't think you can host both images at the same time. Do it one by one.
If you have difficulties, I am available for details...
I didn't have time to explain this evening, and I think you won't have difficulties.
You have work to do!...
Thank you in advance...
A+
Nyctaclope
Re
No, you didn't make any mistakes, and you did quite well..
Thank you for your screenshots, they provided me with useful information
1// for the DIR X series: you made a small mistake by forgetting the ":" after the letter, and that changes all the information, but it already removes a nightmare from my night :).
Dir F: displays the contents of the disk F:
But DIR F (without the ":") displays the files (implied from disk C:!) that are named F or start with F
So there is no confusion between the various disks, as that seemed to be the strange case...
2// the recognized disks are:
C: which is the normal hard drive
D: which is the CD drive
USB-FD, your USB key, which does not have a letter
E: is not recognized and should have been the letter for your key
Can you redo the following DIR series:
DIR E: (don't forget the ":"!)
DIR X: where X is the letter you will have first assigned to your key, as you did previously.
Please confirm what you mentioned in your post 12:
5- Upon reconnecting the key, the problem resurfaces and the content is once again undetectable. Instead of the USB key, I find small icons symbolizing the drive with local disk (E:) local disk (G:) ...etc (depending on the letter I chose to access the content of the key). So if I want to access the content of the key, I have to start all the previous steps again, each time with a new letter, of course.
Are you indeed seeing SEVERAL drives (letters displayed at the same time) for your key??
If that's the case, please send me a screenshot at that specific moment of the disk management window, like in the example you sent me:
[URL=http://img1.imagilive.com/affiche/0109/Sans_titre6e5.JPG.htm][IMG]
3// finally, your key seems to have a very old file system: FAT and not FAT32 or NTFS which I was expecting.
It's not very readable in the image.
It's probably designed for your key to be "bootable" but under an old Windows.
I will ask you tomorrow for screenshots to clarify this.
Have you noted the manipulation to display hidden files (post 19 section E), we will need it.
In conclusion, are you sure you don't have any viruses? Have you done a scan??
I would like you to perform a disinfection (free) on the Bitdefender site:
I'll give you the link again tomorrow, I don't have it on hand anymore..
A+
Nyctaclope
No, you didn't make any mistakes, and you did quite well..
Thank you for your screenshots, they provided me with useful information
1// for the DIR X series: you made a small mistake by forgetting the ":" after the letter, and that changes all the information, but it already removes a nightmare from my night :).
Dir F: displays the contents of the disk F:
But DIR F (without the ":") displays the files (implied from disk C:!) that are named F or start with F
So there is no confusion between the various disks, as that seemed to be the strange case...
2// the recognized disks are:
C: which is the normal hard drive
D: which is the CD drive
USB-FD, your USB key, which does not have a letter
E: is not recognized and should have been the letter for your key
Can you redo the following DIR series:
DIR E: (don't forget the ":"!)
DIR X: where X is the letter you will have first assigned to your key, as you did previously.
Please confirm what you mentioned in your post 12:
5- Upon reconnecting the key, the problem resurfaces and the content is once again undetectable. Instead of the USB key, I find small icons symbolizing the drive with local disk (E:) local disk (G:) ...etc (depending on the letter I chose to access the content of the key). So if I want to access the content of the key, I have to start all the previous steps again, each time with a new letter, of course.
Are you indeed seeing SEVERAL drives (letters displayed at the same time) for your key??
If that's the case, please send me a screenshot at that specific moment of the disk management window, like in the example you sent me:
[URL=http://img1.imagilive.com/affiche/0109/Sans_titre6e5.JPG.htm][IMG]
3// finally, your key seems to have a very old file system: FAT and not FAT32 or NTFS which I was expecting.
It's not very readable in the image.
It's probably designed for your key to be "bootable" but under an old Windows.
I will ask you tomorrow for screenshots to clarify this.
Have you noted the manipulation to display hidden files (post 19 section E), we will need it.
In conclusion, are you sure you don't have any viruses? Have you done a scan??
I would like you to perform a disinfection (free) on the Bitdefender site:
I'll give you the link again tomorrow, I don't have it on hand anymore..
A+
Nyctaclope
Re
1// antivirus
I don't trust AVG too much, not very effective.
I'd like you to run Bitdefender, if you have the time, to be more sure.
Please disable AVG while you do this.
2// Your screenshots:
I received them this time. I saved them on my disk as a precaution.
However, they are barely readable, even with zooming in.
I can't read the texts, which are important.
They look informative, but I can only guess what they are about.
If you still have the originals, please send me the last three for trial, as attachments, to the following address:
toutoufik@orange.fr
( yes yes it will reach me! .. )
If that works, I'll ask you for the rest.
For the next ones, choose a larger resolution in imagilive.com,
like 800x600, because they are not very large in .jpeg format.
3// I now need the next 2 screenshots:
3a// I'm interested in the file system of your USB drive's partition:
I think it's just "FAT".
Plug in your USB drive, assign it a letter (any letter)
In disk management, right window, at the bottom, right-click on the
small rectangle representing your USB drive (where you clicked to assign the
letter)
Request properties, general tab, and take the screenshot.
Example of what to obtain:
http://img1.imagilive.com/0109/Proprietes_clSB.JPG
3b// Meanwhile, without removing your USB drive:
I'm interested in the files on your USB drive, especially the hidden files.
I suppose you haven't canceled the display request for hidden files in the folder options.
Open Windows Explorer in classic mode (two panes), select
your "USB drive" on the left,
In the right window, sufficiently enlarged, scroll down the list
of folders and files on your USB drive to make ALL the
simple files visible at the end of the list, typically below the folders (
which are not of interest). Some are probably displayed in
light filigree.
Take the screenshot (I don't have time to give you an example this time).
In the meantime, see if you can take the opportunity to back up
all your files from your USB drive to a folder on your hard drive. You should have enough space.
Verify the backup by simply comparing the size of the space taken
on your disk and on your USB drive (in "properties"), there might be a
slight difference, which is normal.
It's quite possible that I'll soon ask you to format your
USB drive, it will depend on the screenshots.
Please do not format it alone, there are precautions to take during this process.
Last question: do you know how to go into the registry?
I think I will ask you for guided information ...
I'm crossing my fingers, I hope we're nearing the end of this ...
See you soon, and thank you for your good work ...
Nyctaclope
PS : I insist on the antivirus check.
You didn't answer me regarding the Windows reinstallation: full reinstallation or simple "repair" (option "R"), because the latter doesn't clean viruses well or at all!
1// antivirus
I don't trust AVG too much, not very effective.
I'd like you to run Bitdefender, if you have the time, to be more sure.
Please disable AVG while you do this.
2// Your screenshots:
I received them this time. I saved them on my disk as a precaution.
However, they are barely readable, even with zooming in.
I can't read the texts, which are important.
They look informative, but I can only guess what they are about.
If you still have the originals, please send me the last three for trial, as attachments, to the following address:
toutoufik@orange.fr
( yes yes it will reach me! .. )
If that works, I'll ask you for the rest.
For the next ones, choose a larger resolution in imagilive.com,
like 800x600, because they are not very large in .jpeg format.
3// I now need the next 2 screenshots:
3a// I'm interested in the file system of your USB drive's partition:
I think it's just "FAT".
Plug in your USB drive, assign it a letter (any letter)
In disk management, right window, at the bottom, right-click on the
small rectangle representing your USB drive (where you clicked to assign the
letter)
Request properties, general tab, and take the screenshot.
Example of what to obtain:
http://img1.imagilive.com/0109/Proprietes_clSB.JPG
3b// Meanwhile, without removing your USB drive:
I'm interested in the files on your USB drive, especially the hidden files.
I suppose you haven't canceled the display request for hidden files in the folder options.
Open Windows Explorer in classic mode (two panes), select
your "USB drive" on the left,
In the right window, sufficiently enlarged, scroll down the list
of folders and files on your USB drive to make ALL the
simple files visible at the end of the list, typically below the folders (
which are not of interest). Some are probably displayed in
light filigree.
Take the screenshot (I don't have time to give you an example this time).
In the meantime, see if you can take the opportunity to back up
all your files from your USB drive to a folder on your hard drive. You should have enough space.
Verify the backup by simply comparing the size of the space taken
on your disk and on your USB drive (in "properties"), there might be a
slight difference, which is normal.
It's quite possible that I'll soon ask you to format your
USB drive, it will depend on the screenshots.
Please do not format it alone, there are precautions to take during this process.
Last question: do you know how to go into the registry?
I think I will ask you for guided information ...
I'm crossing my fingers, I hope we're nearing the end of this ...
See you soon, and thank you for your good work ...
Nyctaclope
PS : I insist on the antivirus check.
You didn't answer me regarding the Windows reinstallation: full reinstallation or simple "repair" (option "R"), because the latter doesn't clean viruses well or at all!
Re
1// Bitdefender scan:
I don't understand why the scan failed...
You did accept the license and downloaded the proposed ActiveX, right??
Maybe AVG was still running?
As for the Windows repair option "R", it's the preferred option to use to limit the reinstallation damage.
However, it only repairs potentially damaged system files when Windows is malfunctioning.
If viruses are in "standard" files, even in the disk's header sector, they remain active and reappear.
So it's to be avoided in case of a probable virus (but we're never sure, unless we have a perfect antivirus, and even then, as there are stubborn viruses in the new generations).
2// sending screenshots:
a// for sending by email, you shouldn't have done it through the .NET Messenger service, because toutoufik@orange.fr is an email address on Orange (usual email service, not via MSN, I don't know what the designation to enter in the "service" box is).
However, it would have worked through Outlook Express if you have a mailing account with your basic ISP.
Forget it because:
b// sending copies via Imagilive, in 800x600 works very well now
The image:
[URL=http://img1.imagilive.com/affiche/0109/Sans_titre_19.JPG.htm[IMG]
was perfectly readable this time!
==>> Can you resend me all your screens from your post 29 (800x600, standard duration 6 months)??
From untitled 1 to 15 plus the two 16 to 17 from the private message (it's a trivial public risk).
Thanks!
3// for the registry, it's for a bit later, but it's not difficult...
4// screenshot for the list of files on your drive:
I'll make a new post in a few minutes...
I'm afraid of losing this current post during the actions, as that has already happened to me...
A+
Nyctaclope
1// Bitdefender scan:
I don't understand why the scan failed...
You did accept the license and downloaded the proposed ActiveX, right??
Maybe AVG was still running?
As for the Windows repair option "R", it's the preferred option to use to limit the reinstallation damage.
However, it only repairs potentially damaged system files when Windows is malfunctioning.
If viruses are in "standard" files, even in the disk's header sector, they remain active and reappear.
So it's to be avoided in case of a probable virus (but we're never sure, unless we have a perfect antivirus, and even then, as there are stubborn viruses in the new generations).
2// sending screenshots:
a// for sending by email, you shouldn't have done it through the .NET Messenger service, because toutoufik@orange.fr is an email address on Orange (usual email service, not via MSN, I don't know what the designation to enter in the "service" box is).
However, it would have worked through Outlook Express if you have a mailing account with your basic ISP.
Forget it because:
b// sending copies via Imagilive, in 800x600 works very well now
The image:
[URL=http://img1.imagilive.com/affiche/0109/Sans_titre_19.JPG.htm[IMG]
was perfectly readable this time!
==>> Can you resend me all your screens from your post 29 (800x600, standard duration 6 months)??
From untitled 1 to 15 plus the two 16 to 17 from the private message (it's a trivial public risk).
Thanks!
3// for the registry, it's for a bit later, but it's not difficult...
4// screenshot for the list of files on your drive:
I'll make a new post in a few minutes...
I'm afraid of losing this current post during the actions, as that has already happened to me...
A+
Nyctaclope
Re
Screenshot listing the hidden files on your USB drive:
Here's the example:
http://img1.imagilive.com/0109/Liste_ClSB.JPG
Assign a letter to your USB drive
Launch Windows Explorer
Click on the "folders" icon at the top to have the two panes: on the left the drives, on the right the contents
Click on the arrow of the icon next to ("view") and select "details" to get the appearance of the example
Expand "My Computer" on the left
Select the USB drive on the left (in my example it's KINGSTON (F:))
Scroll right to view the files rather than the folders on your USB drive.
Take the screenshot with ALT PRINT SCREEN (in your case the key may be called PRTSCR) to capture only the active window.
See you +
Nyctaclope
Screenshot listing the hidden files on your USB drive:
Here's the example:
http://img1.imagilive.com/0109/Liste_ClSB.JPG
Assign a letter to your USB drive
Launch Windows Explorer
Click on the "folders" icon at the top to have the two panes: on the left the drives, on the right the contents
Click on the arrow of the icon next to ("view") and select "details" to get the appearance of the example
Expand "My Computer" on the left
Select the USB drive on the left (in my example it's KINGSTON (F:))
Scroll right to view the files rather than the folders on your USB drive.
Take the screenshot with ALT PRINT SCREEN (in your case the key may be called PRTSCR) to capture only the active window.
See you +
Nyctaclope
Re
Wow! It's a party...
Thank you for your screenshots, which I have received, but that is not the priority right now.
Unfortunately, I was right to suspect a virus, and I was right to insist on it :)).
For now, remove your key and set it aside; it may be infected, but the antivirus might not be able to address it if it isn't already recognized.
We will deal with the virus first, which will likely simplify the issue with the key.
Bitdefender has removed 2 Trojans that apparently escaped AVG.
There's at least one left in the form of a file that it couldn't quarantine, probably because it was active.
1// Try to delete the file c:\windows\installer\13e640.msi identified by Bitdefender.
This probably won't work...
Try to do it in Safe Mode (press F8 at boot).
It might work...
2// In any case, we'll initiate a more thorough disinfection:
Download HiJackThis:
http://www.infos-du-net.com/telecharger/HijackThis,0301-454.html
Unzip the HiJackThis.ZIP file with Winrar.
Install the .exe program.
You should have a HiJackThis icon on your desktop.
Wait for me, let me know when you're ready, as it's quite complex.
See you later
Nyctaclope
Wow! It's a party...
Thank you for your screenshots, which I have received, but that is not the priority right now.
Unfortunately, I was right to suspect a virus, and I was right to insist on it :)).
For now, remove your key and set it aside; it may be infected, but the antivirus might not be able to address it if it isn't already recognized.
We will deal with the virus first, which will likely simplify the issue with the key.
Bitdefender has removed 2 Trojans that apparently escaped AVG.
There's at least one left in the form of a file that it couldn't quarantine, probably because it was active.
1// Try to delete the file c:\windows\installer\13e640.msi identified by Bitdefender.
This probably won't work...
Try to do it in Safe Mode (press F8 at boot).
It might work...
2// In any case, we'll initiate a more thorough disinfection:
Download HiJackThis:
http://www.infos-du-net.com/telecharger/HijackThis,0301-454.html
Unzip the HiJackThis.ZIP file with Winrar.
Install the .exe program.
You should have a HiJackThis icon on your desktop.
Wait for me, let me know when you're ready, as it's quite complex.
See you later
Nyctaclope
Re
Thank you for your patience.. It was quite painful...
I'm almost done, I'll give you an update normally this evening.
Everything is more or less fine, but there are two questionable points left..
In the meantime, I need three pieces of information:
1// Regarding that infamous file c:\windows\installer\13e640.msi detected by Bitdefender, which could be dangerous as it allows for the covert installation of who knows what.
I need to know what has become of it, as the Bitdefender message was truncated in the report window.
Can you do another Bitdefender online scan like at the beginning of your post 36, but widening the report window sufficiently so that the right column allows the full comment on the action taken on this file to be read.
Thanks in advance.
2// Important, even if the question seems dumb to you:
To use your DVD player, do you have a remote control, probably in the form of a USB key or USB device (I don’t know), allowing you to control your player without the mouse?
If so, have you installed it?
Or have you installed a software like PowerDVD, along with all its add-ons, from a CD that came with your equipment??
Indeed, it could be this program that is causing the mess...
It will be easy to fix.
3// You said somewhere that no USB key worked on your PC:
Have you tried other keys than that famous one that is causing issues??
See you soon
Nyctaclope
Thank you for your patience.. It was quite painful...
I'm almost done, I'll give you an update normally this evening.
Everything is more or less fine, but there are two questionable points left..
In the meantime, I need three pieces of information:
1// Regarding that infamous file c:\windows\installer\13e640.msi detected by Bitdefender, which could be dangerous as it allows for the covert installation of who knows what.
I need to know what has become of it, as the Bitdefender message was truncated in the report window.
Can you do another Bitdefender online scan like at the beginning of your post 36, but widening the report window sufficiently so that the right column allows the full comment on the action taken on this file to be read.
Thanks in advance.
2// Important, even if the question seems dumb to you:
To use your DVD player, do you have a remote control, probably in the form of a USB key or USB device (I don’t know), allowing you to control your player without the mouse?
If so, have you installed it?
Or have you installed a software like PowerDVD, along with all its add-ons, from a CD that came with your equipment??
Indeed, it could be this program that is causing the mess...
It will be easy to fix.
3// You said somewhere that no USB key worked on your PC:
Have you tried other keys than that famous one that is causing issues??
See you soon
Nyctaclope
Re
Infected file:
Too bad, because where it was, in the installer, and even in the recycle bin, it was still accessible..
Now it is in a "super fortress," where it is grouped with other files that are hard to separate without messing up the system.
I only see the following solution, which is likely to work:
Start/control panel/system/"System Restore" tab
Check "Turn off system restore on all drives," then "apply"
Turn off your machine, then restart.
Come back to uncheck the same option this time, then "apply," and restart again.
Run a Bitdefender scan again, your virus should be gone.
This comes at the cost of losing system restore points, but that's not a big deal, as you didn't need them.
They will recreate at a rate of about one every two days.
The virus file will then be in the magma of available sectors for file management.
It would be wise to completely erase it by doing a defrag of your disk, it's safer and healthier! :
In My Computer, select your hard drive, right-click, properties, TOOLS, defrag. It's harmless and useful! ...
It will take you a little while.
Thanks for keeping me updated, and when you have a chance, explain to me how this file managed to end up in the recycle bin??
See you soon for the rest for Hijackthis.
Nyctaclope
Infected file:
Too bad, because where it was, in the installer, and even in the recycle bin, it was still accessible..
Now it is in a "super fortress," where it is grouped with other files that are hard to separate without messing up the system.
I only see the following solution, which is likely to work:
Start/control panel/system/"System Restore" tab
Check "Turn off system restore on all drives," then "apply"
Turn off your machine, then restart.
Come back to uncheck the same option this time, then "apply," and restart again.
Run a Bitdefender scan again, your virus should be gone.
This comes at the cost of losing system restore points, but that's not a big deal, as you didn't need them.
They will recreate at a rate of about one every two days.
The virus file will then be in the magma of available sectors for file management.
It would be wise to completely erase it by doing a defrag of your disk, it's safer and healthier! :
In My Computer, select your hard drive, right-click, properties, TOOLS, defrag. It's harmless and useful! ...
It will take you a little while.
Thanks for keeping me updated, and when you have a chance, explain to me how this file managed to end up in the recycle bin??
See you soon for the rest for Hijackthis.
Nyctaclope
Re
Glad that my antivirus trick worked...
If you're interested, I could explain it to you...
but I’m already quite chatty!
Let’s get back to your key issue:
1// In the Hijackthis report, there is a dubious item:
It’s a legitimate program (so it’s not a virus!), related to your DVD drive, but it should normally not be active.
I hope it might be the one blocking your USBs.
It’s looking for a remote control that doesn’t exist.
The following manipulation doesn’t delete the program but prevents it from launching at startup, so it’s harmless. We could proceed differently...
Restart HiJackThis,
=> Click on "Do a system scan only", and wait for the list to stabilize (the "log" is no longer in the notepad, unnecessary),
=> Scroll down to the "O4" section, towards the middle of the report,
=> check the box in front of the following line (it should be the 2nd "O4"):
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
=> then click on the "Fix Checked" button, and confirm the request.
After the action, you can request the "scan" again to check if you want the disappearance.
Exit via "main menu" and close the window.
Don’t remove HiJackThis yet, so you can go back if necessary.
Restart your machine, cross your fingers, and test your key in case it changed its mind...
2// Also in HijackThis, in the first section (processes), the
program BTSTAC~1.EXE raises two questions:
7th line before the "R0" section (only readable in the old log, which is more complete than the current one):
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
2-a // It is legitimate (and necessary for the BTTRAY.EXE and BTWDINS.EXE
managing Bluetooth), but its installation folder has a strange, poorly readable expression,
and may not be the normal directory. It could be a clone, hence a
Trojan, but I think BitDefender would have at least seen it.
==> Can you launch a search via Start/search with the following syntax:
BTSTAC*.EXE (an asterisk before the dot), meaning
a .EXE program starting with BTSTAC...
We should find it in c:\program Files\Widcomm\Bluetooth Software or something like that.
In case of a double reference found, please send me an image...
2-b // According to the gathered information, older versions of the key could
be the cause of frequent PC crashes and reboots (the reason for your reinstallation).
Are these problems resolved??
==> Can you provide me with the exact reference of your Bluetooth key for further
research? It should look something like "1200-BTE" or another similar kind.
What do you use your Bluetooth key for? Communication with a printer, camera, music player...?
Thank you for keeping me updated.
A+
Nyctaclope
Glad that my antivirus trick worked...
If you're interested, I could explain it to you...
but I’m already quite chatty!
Let’s get back to your key issue:
1// In the Hijackthis report, there is a dubious item:
It’s a legitimate program (so it’s not a virus!), related to your DVD drive, but it should normally not be active.
I hope it might be the one blocking your USBs.
It’s looking for a remote control that doesn’t exist.
The following manipulation doesn’t delete the program but prevents it from launching at startup, so it’s harmless. We could proceed differently...
Restart HiJackThis,
=> Click on "Do a system scan only", and wait for the list to stabilize (the "log" is no longer in the notepad, unnecessary),
=> Scroll down to the "O4" section, towards the middle of the report,
=> check the box in front of the following line (it should be the 2nd "O4"):
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
=> then click on the "Fix Checked" button, and confirm the request.
After the action, you can request the "scan" again to check if you want the disappearance.
Exit via "main menu" and close the window.
Don’t remove HiJackThis yet, so you can go back if necessary.
Restart your machine, cross your fingers, and test your key in case it changed its mind...
2// Also in HijackThis, in the first section (processes), the
program BTSTAC~1.EXE raises two questions:
7th line before the "R0" section (only readable in the old log, which is more complete than the current one):
C:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
2-a // It is legitimate (and necessary for the BTTRAY.EXE and BTWDINS.EXE
managing Bluetooth), but its installation folder has a strange, poorly readable expression,
and may not be the normal directory. It could be a clone, hence a
Trojan, but I think BitDefender would have at least seen it.
==> Can you launch a search via Start/search with the following syntax:
BTSTAC*.EXE (an asterisk before the dot), meaning
a .EXE program starting with BTSTAC...
We should find it in c:\program Files\Widcomm\Bluetooth Software or something like that.
In case of a double reference found, please send me an image...
2-b // According to the gathered information, older versions of the key could
be the cause of frequent PC crashes and reboots (the reason for your reinstallation).
Are these problems resolved??
==> Can you provide me with the exact reference of your Bluetooth key for further
research? It should look something like "1200-BTE" or another similar kind.
What do you use your Bluetooth key for? Communication with a printer, camera, music player...?
Thank you for keeping me updated.
A+
Nyctaclope
Re
It seems OK on the HijackThis and virus side..
As for the registry controller, I don’t know much and I'm not sure how to interpret the test. But I’m a bit wary of tools that only target the registry, it seems risky for now.
If you don’t mind, let’s move on to the logical continuation of your post 36, postponed due to a detected virus.
I’ll quickly summarize the situation:
Your key, recognized, has no assigned letter. When you assign one, it is unstable, and using "explorer" leads to an error message like "folder F:\" does not exist, but you can still display the content. The first available letter E: is almost never accepted. A forcibly assigned letter is no longer available afterwards.
For me:
The letter of your key seems to be conflicting with the reserved letter "E:", the significance of which is still unknown.
E: seems to take priority, but your key is also prioritized because of its "weird" partition (which we will probably change later, without the risk of not being recognized on your or other PCs) which gives it a bootable disk status. So, two priorities of equal rank clash.
We haven’t found an "E:" on the network drive side.
I think we should look at your Bluetooth key, without affecting its functionality.
I’d like you to perform the following tests:
1// Remove your USB key.
Activate your Bluetooth connection to your mobile phone, without necessarily starting a file transfer.
Check in disk management if a new device appears, and if it has an assigned letter, for example E:. (if the letter is different, modify the DIR E: accordingly below).
Then take a screenshot (if it’s too confidential, send it to me in a private message).
Next, do a DIR E: (don’t forget the ":") in the DOS console (Start/run, cmd /K, then DIR E:) and take a screenshot.
Close the Bluetooth session.
2// Restart your PC with the USB key in place before startup.
Check in disk management how your key is recognized and see if it has a letter.
And take a screenshot.
Because I think it could be recognized before your Bluetooth key.
3// Repeat exactly the same test, but having previously disabled your Bluetooth connection (probably from the icon in the taskbar on the right) and also removed your Bluetooth key.
Thanks in advance ...
Additional question: are the files on your USB key important, or do you already have a copy?
If not, do you have a PC at a friend's place where you could copy it?
I think it may need to be reformatted later to a more standard format than the current one.
A+
Nyctaclope
It seems OK on the HijackThis and virus side..
As for the registry controller, I don’t know much and I'm not sure how to interpret the test. But I’m a bit wary of tools that only target the registry, it seems risky for now.
If you don’t mind, let’s move on to the logical continuation of your post 36, postponed due to a detected virus.
I’ll quickly summarize the situation:
Your key, recognized, has no assigned letter. When you assign one, it is unstable, and using "explorer" leads to an error message like "folder F:\" does not exist, but you can still display the content. The first available letter E: is almost never accepted. A forcibly assigned letter is no longer available afterwards.
For me:
The letter of your key seems to be conflicting with the reserved letter "E:", the significance of which is still unknown.
E: seems to take priority, but your key is also prioritized because of its "weird" partition (which we will probably change later, without the risk of not being recognized on your or other PCs) which gives it a bootable disk status. So, two priorities of equal rank clash.
We haven’t found an "E:" on the network drive side.
I think we should look at your Bluetooth key, without affecting its functionality.
I’d like you to perform the following tests:
1// Remove your USB key.
Activate your Bluetooth connection to your mobile phone, without necessarily starting a file transfer.
Check in disk management if a new device appears, and if it has an assigned letter, for example E:. (if the letter is different, modify the DIR E: accordingly below).
Then take a screenshot (if it’s too confidential, send it to me in a private message).
Next, do a DIR E: (don’t forget the ":") in the DOS console (Start/run, cmd /K, then DIR E:) and take a screenshot.
Close the Bluetooth session.
2// Restart your PC with the USB key in place before startup.
Check in disk management how your key is recognized and see if it has a letter.
And take a screenshot.
Because I think it could be recognized before your Bluetooth key.
3// Repeat exactly the same test, but having previously disabled your Bluetooth connection (probably from the icon in the taskbar on the right) and also removed your Bluetooth key.
Thanks in advance ...
Additional question: are the files on your USB key important, or do you already have a copy?
If not, do you have a PC at a friend's place where you could copy it?
I think it may need to be reformatted later to a more standard format than the current one.
A+
Nyctaclope
Re
Sorry for the delay in getting back to you...
Don't worry about the assistance, I just hope you're not finding the time too long...
1// I sacrificed a USB key (it will be recoverable!) to format it to FAT (just that) like your key. Unfortunately, I did not notice any functional anomalies. But your key does have something special (its status as a disk, apparently "Floppy disk" as indicated by its name "-FD") which is questionable, and moreover there are several file formats corresponding to "FAT," some of which are very old, and may be poorly managed by XP.
I think it would be necessary to "normalize" it anyway.
Everyone seems to agree (and also on CCM) that a USB key should be formatted to FAT32 and not NTFS (Microsoft's preferred format). Personally, I've noticed that an external USB disk works much better in FAT32 than in NTFS. Your key is not affected, given its size, by the partition and file size limit issues.
So I propose to reformat it. It's harmless and reversible just in case. Furthermore, it will still be readable on another PC, including MAC. But this probably won't solve your problem, but it's worth trying.
In disk management: all the following manipulations by right-clicking on your key window:
a// delete the current partition
b// create a new primary partition for the entire available space.
c// format the partition: full formatting and not quick, file format FAT32, "cluster" size (block of sectors) default.
d// during formatting, also give it a name ("label"), but you can do it later by renaming, to identify it better in Explorer.
e// optionally assign a drive letter.
With or without a letter, see if it becomes visible in Explorer and usable for copying files.
2// I am also preparing a list of "services" to check (whether started or not), related to the management of removable disks, using my machine (XP SP3) as an example.
Also check your USBSTOR.SYS driver, and possibly try a forced update.
3// finally, in the Microsoft help center, the issue of drive letters or management of USB keys seems to be acknowledged in the case of XP.
Although the solutions are vague (one: request a patch, unspecified, from Microsoft, but the best is to wait for the next updates...) one, presented as "possibly fixing" the problem, requires intervention in the registry. Since the Microsoft tutorial contains an error or at least a risk of error, I will prepare a clearer overview for the process.
Honestly, I'm starting to fear that the final solution will be a complete reinstall (and not repair) of Windows from the CD. It's a big deal (check all the drivers afterward, reinstall all the updates...) that we need to delay for now.
Indeed, it's possible that your virus has caused damage everywhere, especially in the registry.
Lost for lost, you could always try to repair the registry with your utility, before "reformatting" your hard drive by reinstalling Windows. Remember to prepare your backups...
But maybe first, try updating to SP3.
Initially, can you perform the manipulation of 1//?
Then we will do the service check and the Microsoft registry modification (in my next post).
Afterward, we will see together.
Good luck...
A+
Nyctaclope
Sorry for the delay in getting back to you...
Don't worry about the assistance, I just hope you're not finding the time too long...
1// I sacrificed a USB key (it will be recoverable!) to format it to FAT (just that) like your key. Unfortunately, I did not notice any functional anomalies. But your key does have something special (its status as a disk, apparently "Floppy disk" as indicated by its name "-FD") which is questionable, and moreover there are several file formats corresponding to "FAT," some of which are very old, and may be poorly managed by XP.
I think it would be necessary to "normalize" it anyway.
Everyone seems to agree (and also on CCM) that a USB key should be formatted to FAT32 and not NTFS (Microsoft's preferred format). Personally, I've noticed that an external USB disk works much better in FAT32 than in NTFS. Your key is not affected, given its size, by the partition and file size limit issues.
So I propose to reformat it. It's harmless and reversible just in case. Furthermore, it will still be readable on another PC, including MAC. But this probably won't solve your problem, but it's worth trying.
In disk management: all the following manipulations by right-clicking on your key window:
a// delete the current partition
b// create a new primary partition for the entire available space.
c// format the partition: full formatting and not quick, file format FAT32, "cluster" size (block of sectors) default.
d// during formatting, also give it a name ("label"), but you can do it later by renaming, to identify it better in Explorer.
e// optionally assign a drive letter.
With or without a letter, see if it becomes visible in Explorer and usable for copying files.
2// I am also preparing a list of "services" to check (whether started or not), related to the management of removable disks, using my machine (XP SP3) as an example.
Also check your USBSTOR.SYS driver, and possibly try a forced update.
3// finally, in the Microsoft help center, the issue of drive letters or management of USB keys seems to be acknowledged in the case of XP.
Although the solutions are vague (one: request a patch, unspecified, from Microsoft, but the best is to wait for the next updates...) one, presented as "possibly fixing" the problem, requires intervention in the registry. Since the Microsoft tutorial contains an error or at least a risk of error, I will prepare a clearer overview for the process.
Honestly, I'm starting to fear that the final solution will be a complete reinstall (and not repair) of Windows from the CD. It's a big deal (check all the drivers afterward, reinstall all the updates...) that we need to delay for now.
Indeed, it's possible that your virus has caused damage everywhere, especially in the registry.
Lost for lost, you could always try to repair the registry with your utility, before "reformatting" your hard drive by reinstalling Windows. Remember to prepare your backups...
But maybe first, try updating to SP3.
Initially, can you perform the manipulation of 1//?
Then we will do the service check and the Microsoft registry modification (in my next post).
Afterward, we will see together.
Good luck...
A+
Nyctaclope
Re
Transition to FAT32:
My mistake, I rushed it, there is no partition in FAT system!..
You start again at 1// c// from my post 64 and launch the formatting after right-clicking on your USB stick as shown below:
http://img1.imagilive.com/0109/Formatage_de_ClAT16_vers_FAT32.JPG
For the volume label, choose whatever you like..
Then test your USB stick.
Services involved in the management of removable disks:
In the disk management, click on "Services" in "Services and Applications"
Click on the "Extended" tab at the bottom right (you'll find additional information)
In the right window:
=> click on the "Name" title to sort in ascending alphabetical order
=> widen the title columns if necessary to better see the labels (move the title separator lines) and expand the entire window if necessary.
For each service listed below, check: the startup type (automatic or manual) and the current state (stopped or started) indicated in the corresponding columns of the table.
To possibly change the service status, double-click on the service line, and modify in the window that appears like this: (temporary problem with imagilive, to be reviewed)
.....
For some services, you may not have the right to do so (this is the case for the first one in the list)
List of services to check, and status consulted as an example on my machine:
=> Remote Procedure Call (RPC) Started - Automatic
=> Logical Disk Manager Started - Automatic
=> Plug and Play Started - Automatic
=> Removable Storage Manual
A+
Nyctaclope
Transition to FAT32:
My mistake, I rushed it, there is no partition in FAT system!..
You start again at 1// c// from my post 64 and launch the formatting after right-clicking on your USB stick as shown below:
http://img1.imagilive.com/0109/Formatage_de_ClAT16_vers_FAT32.JPG
For the volume label, choose whatever you like..
Then test your USB stick.
Services involved in the management of removable disks:
In the disk management, click on "Services" in "Services and Applications"
Click on the "Extended" tab at the bottom right (you'll find additional information)
In the right window:
=> click on the "Name" title to sort in ascending alphabetical order
=> widen the title columns if necessary to better see the labels (move the title separator lines) and expand the entire window if necessary.
For each service listed below, check: the startup type (automatic or manual) and the current state (stopped or started) indicated in the corresponding columns of the table.
To possibly change the service status, double-click on the service line, and modify in the window that appears like this: (temporary problem with imagilive, to be reviewed)
.....
For some services, you may not have the right to do so (this is the case for the first one in the list)
List of services to check, and status consulted as an example on my machine:
=> Remote Procedure Call (RPC) Started - Automatic
=> Logical Disk Manager Started - Automatic
=> Plug and Play Started - Automatic
=> Removable Storage Manual
A+
Nyctaclope
Re
Additional information:
Microsoft method for solving USB key recognition issue:
For information only (do not follow the method as is!):
http://support.microsoft.com/kb/925196/en
Modification of the proposed method:
Do not search by "Edit/search" in the registry, as the UpperFilters and LowerFilters keys exist in several places, other than the indicated location!
1// Instead of a prior backup of the registry, create a system restore point, it will be easier to recover than a registry backup:
Start/all programs/accessories/system tools/system restore
Select "create a restore point" then next...
Enter a label such as "before registry modification, UpperFilters and LowerFilters keys"
Then next...
2// Prepare a partial backup of the registry:
Create a folder named "RegistryBackup" in "My Documents"
3// Access the registry:
Start/run/type regedit then OK
The registry, in the form of "keys" and subkeys, is explored exactly like folders (on the left) and files (on the right) in Windows Explorer. A key is expanded into subkeys by clicking on the "+" on the left, and grouped by clicking on the "-".
By selecting a lowest-level key on the left, you get the corresponding data on the right: three columns (Name, Type, and Data).
First key to modify according to Microsoft: UpperFilters
The indicated path is:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}
To do this, start from HKEY_LOCAL_MACHINE and expand with the "+"
Expand the SYSTEM key, then CurrentControlSet, etc., until reaching the folder (in alphabetical order):
{4D36E980-E325-11CE-BFC1-08002BE10318} MAKE SURE TO CHECK ITS LABEL!
Select it and check on the right, if a key named UpperFilters exists (it’s not guaranteed)
If yes, select it and:
a // first save the "corresponding branch" of the registry:
File/export => save as Sauve_UpperFilters.REG (".reg" is automatic) in My_documents\RegistryBackup
b // right-click on UpperFilters then "delete"
Second key to modify according to Microsoft: LowerFilters
Proceed as before by following the path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}
Warning this is not the same folder
Before deleting the key, if it exists, save the "branch" of the registry under the name Sauve_LowerFilters.REG
With the partial backups, we can restore the registry just in case... by a simple File/import.
Before exiting the registry, tidy up by clicking on the "-" encountered, otherwise, the disorder will remain, but it’s not critical...
Hoping Microsoft has correctly provided this information, but you can find all sorts everywhere...
See you later
Nyctaclope
Additional information:
Microsoft method for solving USB key recognition issue:
For information only (do not follow the method as is!):
http://support.microsoft.com/kb/925196/en
Modification of the proposed method:
Do not search by "Edit/search" in the registry, as the UpperFilters and LowerFilters keys exist in several places, other than the indicated location!
1// Instead of a prior backup of the registry, create a system restore point, it will be easier to recover than a registry backup:
Start/all programs/accessories/system tools/system restore
Select "create a restore point" then next...
Enter a label such as "before registry modification, UpperFilters and LowerFilters keys"
Then next...
2// Prepare a partial backup of the registry:
Create a folder named "RegistryBackup" in "My Documents"
3// Access the registry:
Start/run/type regedit then OK
The registry, in the form of "keys" and subkeys, is explored exactly like folders (on the left) and files (on the right) in Windows Explorer. A key is expanded into subkeys by clicking on the "+" on the left, and grouped by clicking on the "-".
By selecting a lowest-level key on the left, you get the corresponding data on the right: three columns (Name, Type, and Data).
First key to modify according to Microsoft: UpperFilters
The indicated path is:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}
To do this, start from HKEY_LOCAL_MACHINE and expand with the "+"
Expand the SYSTEM key, then CurrentControlSet, etc., until reaching the folder (in alphabetical order):
{4D36E980-E325-11CE-BFC1-08002BE10318} MAKE SURE TO CHECK ITS LABEL!
Select it and check on the right, if a key named UpperFilters exists (it’s not guaranteed)
If yes, select it and:
a // first save the "corresponding branch" of the registry:
File/export => save as Sauve_UpperFilters.REG (".reg" is automatic) in My_documents\RegistryBackup
b // right-click on UpperFilters then "delete"
Second key to modify according to Microsoft: LowerFilters
Proceed as before by following the path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}
Warning this is not the same folder
Before deleting the key, if it exists, save the "branch" of the registry under the name Sauve_LowerFilters.REG
With the partial backups, we can restore the registry just in case... by a simple File/import.
Before exiting the registry, tidy up by clicking on the "-" encountered, otherwise, the disorder will remain, but it’s not critical...
Hoping Microsoft has correctly provided this information, but you can find all sorts everywhere...
See you later
Nyctaclope
Re
Upperfilters :
In the second image above, while we were expecting LowerFilters, we find the UpperFilters value on the right.
I think it should be removed (make before exporting a file as Sauve_UpperFilters.reg as mentioned above) because it seems to concern disk drives this time, the first folder being for floppy disk drives.
The backup will allow you to go back if there is no effect, or if any issues occur, which is unlikely.
NoDriveTypeAutorun
Can you in the registry editor:
Select HKEY_CURRENT_USER on the left (so the search starts from there)
Then launch edit/search NoDriveTypeAutorun and click next
You should find this value in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
==>> what is the value on the right? you should find 0x00000091(145) which is 145 in decimal?
Hiding DrivesIMPORTANT
It is indeed possible to let drives appear in the disk management, but prevent their display or access in the explorer.
Normally these keys do not exist, or are set to zero, but we could assume that your virus has touched them ..
Can you in the registry do an edit/search (next for the first search, then F3 to continue searching), starting from the beginning, that is to say "Computer", on the following two keys:
1// NoDrives (it's in plural)
2// NoViewOnDrive (in singular)
Do not touch them if you find any, just let me know if they exist somewhere.
Thanks ..
A+
Nyctaclope
PS: did you do the FAT32 formatting?
Upperfilters :
In the second image above, while we were expecting LowerFilters, we find the UpperFilters value on the right.
I think it should be removed (make before exporting a file as Sauve_UpperFilters.reg as mentioned above) because it seems to concern disk drives this time, the first folder being for floppy disk drives.
The backup will allow you to go back if there is no effect, or if any issues occur, which is unlikely.
NoDriveTypeAutorun
Can you in the registry editor:
Select HKEY_CURRENT_USER on the left (so the search starts from there)
Then launch edit/search NoDriveTypeAutorun and click next
You should find this value in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
==>> what is the value on the right? you should find 0x00000091(145) which is 145 in decimal?
Hiding DrivesIMPORTANT
It is indeed possible to let drives appear in the disk management, but prevent their display or access in the explorer.
Normally these keys do not exist, or are set to zero, but we could assume that your virus has touched them ..
Can you in the registry do an edit/search (next for the first search, then F3 to continue searching), starting from the beginning, that is to say "Computer", on the following two keys:
1// NoDrives (it's in plural)
2// NoViewOnDrive (in singular)
Do not touch them if you find any, just let me know if they exist somewhere.
Thanks ..
A+
Nyctaclope
PS: did you do the FAT32 formatting?
Re
Sorry for the delay, I had to be away for the weekend and I fell behind...
Regarding post 71:
1// regarding:
Upperfilters: if you deleted the key, and since it didn't yield any results, you might as well restore the registry to its previous state by doing File/import from the Sauve_Upperfilters.reg file.
NoDriveTypeAutorun: the value is therefore correct on your end.
NoDrives and NoViewOnDrive: these keys (actually "values" according to the exact terminology) would, with a value different from zero, have allowed hiding in the explorer, and preventing access to one or more keys or USB drives. That’s what I was hoping to find on your side... but your virus did not touch it.
I think it's unnecessary to create these keys with a value of zero, which would mean displaying and accessing all, which is the default case. Prohibiting a negative order does not necessarily imply a positive order in your case. The problem is elsewhere.
2// regarding your post 73:
The inability to format comes from the same problem of inability to access the key.
You should be able to format this key in FAT32 without any issues on another PC, since you said this key was readable elsewhere. I suggest you do this, as the format "FAT" alone can only create problems for you later.
3// Other suggested checks:
=> Go to Device Manager:
Start/control panel/system/hardware/device manager,
=> request the display of hidden devices in the "view" menu of the manager
In the newly displayed list of "Non-Plug and Play Drivers",
a// check that no driver is "sick" (with a yellow exclamation point)
b// identify the three drivers:
MountMgr
PartMgr
Volsnap
By double clicking on each (or "properties"), tab "driver", check that the driver is in a "state" (started, system, automatic...) <bold>other than "stopped", otherwise set it to automatic. These three drivers are important for managing removable storage.
4// Hidden devices "storage volumes"
The previous manipulation "display hidden devices" in the device manager reveals a new list, at the last position, below "mouse", titled "Storage Volumes", which can be expanded into a list of "generic volumes".
It seems to be the memory of all previous and ongoing connections of keys or external drives, with their signatures.
I think you should have several (please send a photo!).
By double-clicking on each "generic volume", then the "general" tab:
=> one of them cannot be enabled or disabled (choice list at the bottom)
all others should be able to be disabled. Don't do it yet!
=> one should correspond to your key (if it is plugged in, but you can do it "hot"): you see it in the 4th line "location" which indicates a reference to your key, instead of the usual "On volume manager".
Can you proceed with just this identification?
As for my machine, in your case, I wouldn't hesitate to disable, as a test, all other generic volumes except these two specific cases. Because it's reversible. But I'm really hesitant to suggest this to you...
I'm starting to "run dry" regarding your problem, and I don't see too much where to search now!...
It seemed quite simple and has turned out to be quite twisted after all...
There remains the possibility of complete reinstallation, as a last resort, but it is quite heavy...
What do you think?
A+
Nyctaclope
Sorry for the delay, I had to be away for the weekend and I fell behind...
Regarding post 71:
1// regarding:
Upperfilters: if you deleted the key, and since it didn't yield any results, you might as well restore the registry to its previous state by doing File/import from the Sauve_Upperfilters.reg file.
NoDriveTypeAutorun: the value is therefore correct on your end.
NoDrives and NoViewOnDrive: these keys (actually "values" according to the exact terminology) would, with a value different from zero, have allowed hiding in the explorer, and preventing access to one or more keys or USB drives. That’s what I was hoping to find on your side... but your virus did not touch it.
I think it's unnecessary to create these keys with a value of zero, which would mean displaying and accessing all, which is the default case. Prohibiting a negative order does not necessarily imply a positive order in your case. The problem is elsewhere.
2// regarding your post 73:
The inability to format comes from the same problem of inability to access the key.
You should be able to format this key in FAT32 without any issues on another PC, since you said this key was readable elsewhere. I suggest you do this, as the format "FAT" alone can only create problems for you later.
3// Other suggested checks:
=> Go to Device Manager:
Start/control panel/system/hardware/device manager,
=> request the display of hidden devices in the "view" menu of the manager
In the newly displayed list of "Non-Plug and Play Drivers",
a// check that no driver is "sick" (with a yellow exclamation point)
b// identify the three drivers:
MountMgr
PartMgr
Volsnap
By double clicking on each (or "properties"), tab "driver", check that the driver is in a "state" (started, system, automatic...) <bold>other than "stopped", otherwise set it to automatic. These three drivers are important for managing removable storage.
4// Hidden devices "storage volumes"
The previous manipulation "display hidden devices" in the device manager reveals a new list, at the last position, below "mouse", titled "Storage Volumes", which can be expanded into a list of "generic volumes".
It seems to be the memory of all previous and ongoing connections of keys or external drives, with their signatures.
I think you should have several (please send a photo!).
By double-clicking on each "generic volume", then the "general" tab:
=> one of them cannot be enabled or disabled (choice list at the bottom)
all others should be able to be disabled. Don't do it yet!
=> one should correspond to your key (if it is plugged in, but you can do it "hot"): you see it in the 4th line "location" which indicates a reference to your key, instead of the usual "On volume manager".
Can you proceed with just this identification?
As for my machine, in your case, I wouldn't hesitate to disable, as a test, all other generic volumes except these two specific cases. Because it's reversible. But I'm really hesitant to suggest this to you...
I'm starting to "run dry" regarding your problem, and I don't see too much where to search now!...
It seemed quite simple and has turned out to be quite twisted after all...
There remains the possibility of complete reinstallation, as a last resort, but it is quite heavy...
What do you think?
A+
Nyctaclope
hi
for the 1 it's your letter like the hard drive c:// or if you have another hard drive d:// for the 2 you have problems with your usb ports a++
for the 1 it's your letter like the hard drive c:// or if you have another hard drive d:// for the 2 you have problems with your usb ports a++
- 1
- 2
- 3
Next
In the USB storage device manager, properties, driver tab, try reinstalling or installing a better version of the driver. You probably need to have your USB key inserted to see it.
Otherwise, search for USBSTOR.SYS on Google; you should have some leads, including on this site.
Also on www.touslesdrivers.com
Or copy it from another PC where it works, same version of Windows.
Make a backup of the current driver before possibly replacing it.
I am also looking for another way to resolve your issue, but I still need to search before I can post something for you tomorrow, I think in the morning.
See you
Nyctaclope
P.S.: excuse my quick response, I'm pressed for time this evening...
PS :
You should be able to find interesting information here :
http://www.commentcamarche.net/forum/affich 1212055 absence de reconnaissance de cle usb sous xp
Basically :
1// check the assignment of your drive letters, maybe F: is already taken by a network drive or something else.
2// reinstall your driver by searching for it in windows\inf (hidden folder that needs to be "unhidden" in the folder options of the control panel)
See you later
Nyctaclope
First of all, thank you very much for the efforts you are making for me.
I have tried everything, and it seems that everything is working normally, but I still can't access the content of my USB key.
On another note, I noticed a small detail that might, perhaps, enlighten you. When I click on "This PC" then on "Properties" of the DVD-RAM drive (D:) or Floppy Disk (A:) then "Hardware" - AU6982 flash disk USB device - "Properties" - "Volumes" - "Populate", all the details are displayed, among which, what I can’t understand is the partition type MBR (Master Boot Record). I hope I have been clear enough.
Question: Does the connection of the Bluetooth device affect other removable devices?