"Safely Remove Hardware" trayicon has left the building....

B

Bill Evans

I'm crossposting this to three newsgroups because I'm not sure which
newsgroup this topic should be discussed in. This isn't my computer problem
I'm asking about, but rather it's my Dad's. I'm a computer consultant and
lifer college student, and my Dad has been bugging me for the past three
weeks to fix a problem he's having on his computer. So far I have had very
little success.

My Dad has two USB flash memory sticks; one (128 MB) that's about four years
old, and another (1 GB) that's brand new. The new one is a PNY Attaché. I
can't remember what brand the old one is, and the label has worn off of the
plastic case.

Recently the "Safely Remove Hardware" trayicon that lets him shut down any
USB mass storage device so it can be safely removed disappeared. It hasn't
just hidden itself because it thinks it's inactive, because I have "Hide
inactive icons" turned "Off" on this machine. I did try turning it back
"On", opening the "Customize Notifications" dialog box, and changing the
behavior for the "Safely Remove Hardware" trayicon to "Always Show", and
still it doesn't show itself when either of the USB flash memory sticks are
attached to a USB port on this computer.

I have googled the entire internet, including usenet archives, and have seen
several people ask this same identical question. None of the people that I
saw that asked this question ever found a solution to this problem.
Predictably they were told that they'd turned the icon to "Always Hide", or
"Hide When Inactive", and almost always the original poster of the question
would
say that he'd already thought of that and tried changing that. Usually
anyone that's knowledgeable enough about computers and tech support issues
to
get around to posting a question in a newsgroup is going to be savvy enough
to have already tried the obvious solution to a problem without success, but
I digress....

Even though this isn't my computer and I rarely if ever use it, I know for a
fact that the "Safely Remove Hardware" trayicon did operate as intended up
until three weeks ago. This is a Dell 3000 2.8 GHz P-4 with 512 MB of RAM
running Windows XP Home SP2 that was purchased in August of 2005. I set it
up and protected it against malware before turning it over to my Dad and
hooking it up to the home network at it's permanent location on his desk.

When I set it up, the USB flash drive worked exactly as it's supposed to: If
you stuck it into any USB port while the machine was on, you would hear the
Windows sound for "Device Connect", then the trayicon would appear. After
using it, you could then shut it down using the trayicon, the Windows sound
for "Device Disconnect" would chime, and then you could safely remove it.

According to my Dad, about a month ago the "Safely Remove Hardware" trayicon
disappeared, and when my Dad asked me what he should do about it, I told him
not to worry about it and to remove his USB 128 MB flash memory stick
whenever he needed to remove it. After waiting five-ten seconds after
copying files to it for the file transfer to be flushed from any cache, of
course.

He did this for about a week, until he lost some files on the memory stick
and had to recopy them to the stick a second time. After that, he had to
shut the machine down and wait for the machine to power down fully before he
felt confident that he could safely remove the USB flash memory stick. Also
the memory stick started acting flaky in general (according to my Dad), so
we ordered him a new 1 GB USB flash memory stick.

I had hopes that when the new memory stick arrived and I installed it, that
the problem with the missing trayicon would rectify itself. It didn't. It
has the same identical symptoms as the old USB flash memory stick.

ANY SUGGESTIONS? I've already installed the most recent USB 2.0 drivers,
motherboard, chipset, and BIOS updates I could get from the Dell web site.


Also I have other weird things happening with this machine:


1) When I have been experimenting with the memory sticks on my Dad's
computer, and also on my computer, naturally I've been removing the entry in
"Device Manager" for the USB flash memory stick under the disk drive
section, and any other various entries (like "USB Mass Storage Device") that
I could find.

Then I'd reboot, and try reattaching the USB flash memory stick so I could
reinstall the device drivers from scratch. When I would insert the memory
stick into a USB port, the first dialog box that would come up would be "New
Hardware Found", and it would say that it had found new hardware called
"Security Device" that I can't find the driver for anywhere. Neither memory
stick came with any CD or floppy disk with any drivers, and Windows XP
couldn't find a driver for any "Security Device" when I would tell it to
automatically search locally and on "Windows Update" for the driver, and I
tried to manually find the driver in the \I386 folder, or in the
\Windows\Options\Cabs or \Windows\Inf or \Windows\System or
\Windows\System32 or anywhere else.

I also googled the net for an answer to this one with no success, but if you
cancel the search for a driver for "Security Device", a second "New Hardware
Found" dialog box would appear and correctly install the needed generic
Windows driver for USB flash memory sticks and also for USB mass storage
devices and it would work. As I said earlier, this odd behavior happens on
his machine and also on my machine. Other than this, my machine's "Safely
Remove Hardware" trayicon acts normally.


2) A Ctrl-Alt-Del three fingered salute on my Dad's machine does NOT bring
up Task Manager.

The machine has seemed slower than it did three months or even two months
ago, and it was purchased in October of this past year. Naturally the first
thing I think is "What bad thingie is running in the back ground, using MY
precious CPU cycles?". So I tried to bring up Task Manager to see if I
recognized anything bad, or even anything marginal that I would remove if
one of my parents had installed anything unwise like Weatherbug or whatever.
I tried to bring up Task Manager in the normal fashion, by hitting
Ctrl-Alt-Del, with no response.

That really concerns me, but there's no reason for me to think it's another
symptom of the same problem that's caused the "Safely Remove Hardware"
trayicon to disappear. It may indeed be connected to that problem, but
since
I have no reason to think that at this time, I'm going to table that problem
for later since that machine is relatively protected against malware, at
least it's better protected than 99.9% of the other computers I've run
across doing computer consulting. It's "Windows Updates" are 100% up to
date; it's using ZoneAlarm; Symantec Anti-Virus with it's definitions
up-to-date; Javacool Spywareblaster with all protections enabled and it's
definitions up-to-date; the MS Anti-Spyware beta with a daily disk scan, all
protections enabled and it's definitions up-to-date; Spybot with a daily
disk scan, all protections (including the HOSTS file locked down and IE's
home page locked down) enabled and it's definitions up-to-date; and manual
weekly Ad-Aware disk scans with it's definitions up-to-date.


2) Every time I reboot, the machine keeps opening up a copy of Windows
Explorer, viewing the contents of a particular folder on the hard drive.

The machine does have "Restore previous folder windows at logon" turned on,
but the folder gets closed every time the machine boots, and still after a
reboot, it reappears. I turned off "Restore previous folder windows at
logon", and still after a reboot, it reappears. Then I turned "Restore
previous folder windows at logon" back on, and still after a reboot, it
reappears, even after having been closed when the machine was shut down.


3) Naturally the first thing I wanted to check to see what might be opening
this folder was the "Startup" folder, and there was nothing unusual there.

Next I wanted to look in the registry for any keys in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run that I
didn't recognize.

I tried typing "Regedit" in the "Run" dialog box, and Windows told me that
it couldn't find or access the resource. So I checked the PATH environment
variable, and it was assigned to "PATH=C:\WINDOWS\system32;C:\WINDOWS" as it
should be.

Then I tried browsing to the C:\WINDOWS\ folder, double-clicked on
regedit.exe, and the browse dialog box correctly returned
"C:\WINDOWS\regedit.exe" to the run dialog box. I thought "Surely it'll be
able to find it now....", but when I clicked on the OK button in the run
dialog box, NOTHING HAPPENED!

Ditto opening a command prompt and typing "regedit".

So how do I open a copy of Regedit to try to diagnose and fix these other
problems?

Do I need to make a new user ID on that machine and see if it exhibits these
same weird symptoms?


--
bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."
 
J

jel183\(UK\)

Bill Evans said:
I'm crossposting this to three newsgroups because I'm not sure which
newsgroup this topic should be discussed in. This isn't my computer
problem
I'm asking about, but rather it's my Dad's. I'm a computer consultant and
lifer college student, and my Dad has been bugging me for the past three
weeks to fix a problem he's having on his computer. So far I have had
very
little success.

My Dad has two USB flash memory sticks; one (128 MB) that's about four
years
old, and another (1 GB) that's brand new. The new one is a PNY Attaché.
I
can't remember what brand the old one is, and the label has worn off of
the
plastic case.

Recently the "Safely Remove Hardware" trayicon that lets him shut down any
USB mass storage device so it can be safely removed disappeared. It
hasn't
just hidden itself because it thinks it's inactive, because I have "Hide
inactive icons" turned "Off" on this machine. I did try turning it back
"On", opening the "Customize Notifications" dialog box, and changing the
behavior for the "Safely Remove Hardware" trayicon to "Always Show", and
still it doesn't show itself when either of the USB flash memory sticks
are
attached to a USB port on this computer.

I have googled the entire internet, including usenet archives, and have
seen
several people ask this same identical question. None of the people that
I
saw that asked this question ever found a solution to this problem.
Predictably they were told that they'd turned the icon to "Always Hide",
or
"Hide When Inactive", and almost always the original poster of the
question would
say that he'd already thought of that and tried changing that. Usually
anyone that's knowledgeable enough about computers and tech support issues
to
get around to posting a question in a newsgroup is going to be savvy
enough
to have already tried the obvious solution to a problem without success,
but
I digress....

Even though this isn't my computer and I rarely if ever use it, I know for
a
fact that the "Safely Remove Hardware" trayicon did operate as intended up
until three weeks ago. This is a Dell 3000 2.8 GHz P-4 with 512 MB of RAM
running Windows XP Home SP2 that was purchased in August of 2005. I set
it
up and protected it against malware before turning it over to my Dad and
hooking it up to the home network at it's permanent location on his desk.

When I set it up, the USB flash drive worked exactly as it's supposed to:
If
you stuck it into any USB port while the machine was on, you would hear
the
Windows sound for "Device Connect", then the trayicon would appear. After
using it, you could then shut it down using the trayicon, the Windows
sound
for "Device Disconnect" would chime, and then you could safely remove it.

According to my Dad, about a month ago the "Safely Remove Hardware"
trayicon
disappeared, and when my Dad asked me what he should do about it, I told
him
not to worry about it and to remove his USB 128 MB flash memory stick
whenever he needed to remove it. After waiting five-ten seconds after
copying files to it for the file transfer to be flushed from any cache, of
course.

He did this for about a week, until he lost some files on the memory stick
and had to recopy them to the stick a second time. After that, he had to
shut the machine down and wait for the machine to power down fully before
he
felt confident that he could safely remove the USB flash memory stick.
Also
the memory stick started acting flaky in general (according to my Dad), so
we ordered him a new 1 GB USB flash memory stick.

I had hopes that when the new memory stick arrived and I installed it,
that
the problem with the missing trayicon would rectify itself. It didn't.
It
has the same identical symptoms as the old USB flash memory stick.

ANY SUGGESTIONS? I've already installed the most recent USB 2.0 drivers,
motherboard, chipset, and BIOS updates I could get from the Dell web site.


Also I have other weird things happening with this machine:


1) When I have been experimenting with the memory sticks on my Dad's
computer, and also on my computer, naturally I've been removing the entry
in
"Device Manager" for the USB flash memory stick under the disk drive
section, and any other various entries (like "USB Mass Storage Device")
that
I could find.

Then I'd reboot, and try reattaching the USB flash memory stick so I could
reinstall the device drivers from scratch. When I would insert the memory
stick into a USB port, the first dialog box that would come up would be
"New
Hardware Found", and it would say that it had found new hardware called
"Security Device" that I can't find the driver for anywhere. Neither
memory
stick came with any CD or floppy disk with any drivers, and Windows XP
couldn't find a driver for any "Security Device" when I would tell it to
automatically search locally and on "Windows Update" for the driver, and I
tried to manually find the driver in the \I386 folder, or in the
\Windows\Options\Cabs or \Windows\Inf or \Windows\System or
\Windows\System32 or anywhere else.

I also googled the net for an answer to this one with no success, but if
you
cancel the search for a driver for "Security Device", a second "New
Hardware
Found" dialog box would appear and correctly install the needed generic
Windows driver for USB flash memory sticks and also for USB mass storage
devices and it would work. As I said earlier, this odd behavior happens
on
his machine and also on my machine. Other than this, my machine's "Safely
Remove Hardware" trayicon acts normally.


2) A Ctrl-Alt-Del three fingered salute on my Dad's machine does NOT bring
up Task Manager.

The machine has seemed slower than it did three months or even two months
ago, and it was purchased in October of this past year. Naturally the
first
thing I think is "What bad thingie is running in the back ground, using MY
precious CPU cycles?". So I tried to bring up Task Manager to see if I
recognized anything bad, or even anything marginal that I would remove if
one of my parents had installed anything unwise like Weatherbug or
whatever.
I tried to bring up Task Manager in the normal fashion, by hitting
Ctrl-Alt-Del, with no response.

That really concerns me, but there's no reason for me to think it's
another
symptom of the same problem that's caused the "Safely Remove Hardware"
trayicon to disappear. It may indeed be connected to that problem, but
since
I have no reason to think that at this time, I'm going to table that
problem
for later since that machine is relatively protected against malware, at
least it's better protected than 99.9% of the other computers I've run
across doing computer consulting. It's "Windows Updates" are 100% up to
date; it's using ZoneAlarm; Symantec Anti-Virus with it's definitions
up-to-date; Javacool Spywareblaster with all protections enabled and it's
definitions up-to-date; the MS Anti-Spyware beta with a daily disk scan,
all
protections enabled and it's definitions up-to-date; Spybot with a daily
disk scan, all protections (including the HOSTS file locked down and IE's
home page locked down) enabled and it's definitions up-to-date; and manual
weekly Ad-Aware disk scans with it's definitions up-to-date.


2) Every time I reboot, the machine keeps opening up a copy of Windows
Explorer, viewing the contents of a particular folder on the hard drive.

The machine does have "Restore previous folder windows at logon" turned
on,
but the folder gets closed every time the machine boots, and still after a
reboot, it reappears. I turned off "Restore previous folder windows at
logon", and still after a reboot, it reappears. Then I turned "Restore
previous folder windows at logon" back on, and still after a reboot, it
reappears, even after having been closed when the machine was shut down.


3) Naturally the first thing I wanted to check to see what might be
opening
this folder was the "Startup" folder, and there was nothing unusual there.

Next I wanted to look in the registry for any keys in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run that I
didn't recognize.

I tried typing "Regedit" in the "Run" dialog box, and Windows told me that
it couldn't find or access the resource. So I checked the PATH
environment
variable, and it was assigned to "PATH=C:\WINDOWS\system32;C:\WINDOWS" as
it
should be.

Then I tried browsing to the C:\WINDOWS\ folder, double-clicked on
regedit.exe, and the browse dialog box correctly returned
"C:\WINDOWS\regedit.exe" to the run dialog box. I thought "Surely it'll
be
able to find it now....", but when I clicked on the OK button in the run
dialog box, NOTHING HAPPENED!

Ditto opening a command prompt and typing "regedit".

So how do I open a copy of Regedit to try to diagnose and fix these other
problems?

Do I need to make a new user ID on that machine and see if it exhibits
these
same weird symptoms?


--
bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."

This may not solve your first problem BUT its worth a try. I use the
xp_pastitems.vbs (Remove Past Items From Notification Area) from Kelly's
Korner site - http://www.kellys-korner-xp.com/xp_tweaks.htm (line 53) this
refreshes the systray and often replaces icons, including the Safely
Remove... icon that have either disappeared or not loaded at startup. Works
well for me... in particular to recover the sound icon which never seems to
load. I have the script as a shortcut on my quicklaunch bar.
 
U

Ulf

I must say you definitelly sound like a real thorough guy from your
long, detailed explanation...I just can´t come to think of anything
else to do with this machine´s strange behaviour than what you´ve
already done...I would myself reinstall everything and when everything
was installed and patched up with the latest security updates, service
packs, virus definitions, drivers etc I would do an image clone with
for instance Norton Ghost (don´t forget to do a file integrity check
to make sure that the image file isn´t corrupt with crc errors) and
burn it down to cd´s or dvd...the only thing you haven´t done might
perhaps be to reinstall sp2 for xp?!? but I don´t know...good luck!
 
G

Guest

I've got a similar problem.
For now I used this solution.
Go to My conputer
Select dive's letter, rigth click on it and select Eject.
 
N

Nepatsfan

In said:
I'm crossposting this to three newsgroups because I'm not
sure which newsgroup this topic should be discussed in. This
isn't my computer problem I'm asking about, but rather
it's my Dad's. I'm a computer consultant and lifer college
student, and my Dad has been bugging me for the past three
weeks to fix a problem he's having on his computer. So far
I have had very little success.
My Dad has two USB flash memory sticks; one (128 MB) that's
about four years old, and another (1 GB) that's brand new.
The new one is a PNY Attaché. I can't remember what brand
the old one is, and the label has worn off of the plastic
case.
Recently the "Safely Remove Hardware" trayicon that lets him
shut down any USB mass storage device so it can be safely
removed disappeared. It hasn't just hidden itself because
it thinks it's inactive, because I have "Hide inactive
icons" turned "Off" on this machine. I did try turning it
back "On", opening the "Customize Notifications" dialog box,
and changing the behavior for the "Safely Remove Hardware"
trayicon to "Always Show", and still it doesn't show itself
when either of the USB flash memory sticks are attached to a
USB port on this computer.
I have googled the entire internet, including usenet
archives, and have seen several people ask this same
identical question. None of the people that I saw that
asked this question ever found a solution to this problem.
Predictably they were told that they'd turned the icon to
"Always Hide", or "Hide When Inactive", and almost always
the original poster of the question would say that he'd
already thought of that and tried changing
that. Usually anyone that's knowledgeable enough about
computers and tech support issues to
get around to posting a question in a newsgroup is going to
be savvy enough to have already tried the obvious solution
to a problem without success, but I digress....

Even though this isn't my computer and I rarely if ever use
it, I know for a fact that the "Safely Remove Hardware"
trayicon did operate as intended up until three weeks ago.
This is a Dell 3000 2.8 GHz P-4 with 512 MB of RAM running
Windows XP Home SP2 that was purchased in August of 2005. I
set it up and protected it against malware before turning it
over to my Dad and hooking it up to the home network at it's
permanent location on his desk.
When I set it up, the USB flash drive worked exactly as it's
supposed to: If you stuck it into any USB port while the
machine was on, you would hear the Windows sound for "Device
Connect", then the trayicon would appear. After using it,
you could then shut it down using the trayicon, the Windows
sound for "Device Disconnect" would chime, and then you
could safely remove it.
According to my Dad, about a month ago the "Safely Remove
Hardware" trayicon disappeared, and when my Dad asked me
what he should do about it, I told him not to worry about it
and to remove his USB 128 MB flash memory stick whenever he
needed to remove it. After waiting five-ten seconds after
copying files to it for the file transfer to be flushed from
any cache, of course.
He did this for about a week, until he lost some files on
the memory stick and had to recopy them to the stick a
second time. After that, he had to shut the machine down
and wait for the machine to power down fully before he felt
confident that he could safely remove the USB flash memory
stick. Also the memory stick started acting flaky in
general (according to my Dad), so we ordered him a new 1 GB
USB flash memory stick.
I had hopes that when the new memory stick arrived and I
installed it, that the problem with the missing trayicon
would rectify itself. It didn't. It has the same identical
symptoms as the old USB flash memory stick.
ANY SUGGESTIONS? I've already installed the most recent USB
2.0 drivers, motherboard, chipset, and BIOS updates I could
get from the Dell web site.

Also I have other weird things happening with this machine:


1) When I have been experimenting with the memory sticks on
my Dad's computer, and also on my computer, naturally I've
been removing the entry in "Device Manager" for the USB
flash memory stick under the disk drive section, and any
other various entries (like "USB Mass Storage Device") that
I could find.
Then I'd reboot, and try reattaching the USB flash memory
stick so I could reinstall the device drivers from scratch.
When I would insert the memory stick into a USB port, the
first dialog box that would come up would be "New Hardware
Found", and it would say that it had found new hardware
called "Security Device" that I can't find the driver for
anywhere. Neither memory stick came with any CD or floppy
disk with any drivers, and Windows XP couldn't find a driver
for any "Security Device" when I would tell it to
automatically search locally and on "Windows Update" for the
driver, and I tried to manually find the driver in the \I386
folder, or in the \Windows\Options\Cabs or \Windows\Inf or
\Windows\System or \Windows\System32 or anywhere else.
I also googled the net for an answer to this one with no
success, but if you cancel the search for a driver for
"Security Device", a second "New Hardware Found" dialog box
would appear and correctly install the needed generic
Windows driver for USB flash memory sticks and also for USB
mass storage devices and it would work. As I said earlier,
this odd behavior happens on his machine and also on my
machine. Other than this, my machine's "Safely Remove
Hardware" trayicon acts normally.

2) A Ctrl-Alt-Del three fingered salute on my Dad's machine
does NOT bring up Task Manager.

The machine has seemed slower than it did three months or
even two months ago, and it was purchased in October of this
past year. Naturally the first thing I think is "What bad
thingie is running in the back ground, using MY precious CPU
cycles?". So I tried to bring up Task Manager to see if I
recognized anything bad, or even anything marginal that I
would remove if one of my parents had installed anything
unwise like Weatherbug or whatever. I tried to bring up Task
Manager in the normal fashion, by hitting Ctrl-Alt-Del, with
no response.
That really concerns me, but there's no reason for me to
think it's another symptom of the same problem that's caused
the "Safely Remove Hardware" trayicon to disappear. It may
indeed be connected to that problem, but since
I have no reason to think that at this time, I'm going to
table that problem for later since that machine is
relatively protected against malware, at least it's better
protected than 99.9% of the other computers I've run across
doing computer consulting. It's "Windows Updates" are 100%
up to date; it's using ZoneAlarm; Symantec Anti-Virus with
it's definitions up-to-date; Javacool Spywareblaster with
all protections enabled and it's definitions up-to-date; the
MS Anti-Spyware beta with a daily disk scan, all protections
enabled and it's definitions up-to-date; Spybot with a daily
disk scan, all protections (including the HOSTS file locked
down and IE's home page locked down) enabled and it's
definitions up-to-date; and manual weekly Ad-Aware disk
scans with it's definitions up-to-date.

2) Every time I reboot, the machine keeps opening up a copy
of Windows Explorer, viewing the contents of a particular
folder on the hard drive.
The machine does have "Restore previous folder windows at
logon" turned on, but the folder gets closed every time the
machine boots, and still after a reboot, it reappears. I
turned off "Restore previous folder windows at logon", and
still after a reboot, it reappears. Then I turned "Restore
previous folder windows at logon" back on, and still after a
reboot, it reappears, even after having been closed when the
machine was shut down.

3) Naturally the first thing I wanted to check to see what
might be opening this folder was the "Startup" folder, and
there was nothing unusual there.
Next I wanted to look in the registry for any keys in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
that I didn't recognize.

I tried typing "Regedit" in the "Run" dialog box, and
Windows told me that it couldn't find or access the
resource. So I checked the PATH environment variable, and
it was assigned to "PATH=C:\WINDOWS\system32;C:\WINDOWS" as
it should be.
Then I tried browsing to the C:\WINDOWS\ folder,
double-clicked on regedit.exe, and the browse dialog box
correctly returned "C:\WINDOWS\regedit.exe" to the run
dialog box. I thought "Surely it'll be able to find it
now....", but when I clicked on the OK button in the run
dialog box, NOTHING HAPPENED!
Ditto opening a command prompt and typing "regedit".

So how do I open a copy of Regedit to try to diagnose and
fix these other problems?

Do I need to make a new user ID on that machine and see if
it exhibits these same weird symptoms?


--
bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."

Let's see, what are the symptoms your Dad's computer exhibits:

1. You can't run Task Manager by hitting Ctrl + Alt + Del.
2. The computer runs slower than expected.
3. You can't run the Registry Editor in the usual manner.

If you checked, you might find that other Windows utilities,
such as msconfig, don't work as expected. Sure sounds an awful
lot like a virus or trojan to me.

You asked for suggestions so here goes:

If you want to be able to run Task Manager and the Registry
Editor go to this web site and follow the instructions:
Courtesy of Doug Knox, MS-MVP
Creates usable copies of REGEDIT, MSCONFIG and Task Manager
http://www.dougknox.com/xp/utils/xp_emerutils.htm

For a workaround to the Safely Remove Hardware issue:
Right click an open spot on the desktop.
Select New -> Shortcut from the menu.
Copy and paste the following into the location box:

%windir%\system32\rundll32.exe shell32.dll,Control_RunDLL
hotplug.dll

Note: If you end up having to enter this info manually, keep in
mind that there is a space before shell32.dll and hotplug.dll.

Give your new shortcut an appropriate name. How about "Safely
Remove Hardware".
When you're finished, right click the shortcut and select
Properties.
On the Shortcut page, hit the "Change Icon" button.
Browse to %windir%\system32\hotplug.dll to gain access to the
correct icon.
If you want, you can drag this shortcut onto the Quick Launch
toolbar for easier access.

Next, you might want to visit some of the online virus scanners
and see what they find:

Trend Micro Housecall:
http://housecall.trendmicro.com/

Panda Active Scan:
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp

You might also consider downloading and running the 14 day
evaluation version of Ewido Anti-Malware:

http://www.ewido.net/en/download/

Once you're assured that your Dad's PC is pest free you can
move on to running System File Checker. If SFC doesn't help
resolve the issues your dealing with, it may be time to run at
least a repair installation if not a clean installation.

Good luck

Nepatsfan
 
F

Frank

This may help. Insert the memory stick, then go to >properties
hardware
highlight the flash drive >properties policies check it out. I would
recommend
running >sfc /purgecache then >sfc /scannow >reboot. First in case of
corrupted
files.
 
B

Bill Evans

Nepatsfan said:
Let's see, what are the symptoms your Dad's computer exhibits:

1. You can't run Task Manager by hitting Ctrl + Alt + Del.
2. The computer runs slower than expected.
3. You can't run the Registry Editor in the usual manner.

If you checked, you might find that other Windows utilities, such as
msconfig, don't work as expected. Sure sounds an awful lot like a virus or
trojan to me.

After I posted my initial post in this thread last night, the suspicion that
some piece of malware was the root cause of all or a great deal of these
symptoms grew and grew on me.
You asked for suggestions so here goes:

If you want to be able to run Task Manager and the Registry Editor go to
this web site and follow the instructions:
Courtesy of Doug Knox, MS-MVP
Creates usable copies of REGEDIT, MSCONFIG and Task Manager
http://www.dougknox.com/xp/utils/xp_emerutils.htm

For a workaround to the Safely Remove Hardware issue:
Right click an open spot on the desktop.
Select New -> Shortcut from the menu.
Copy and paste the following into the location box:

%windir%\system32\rundll32.exe shell32.dll,Control_RunDLL hotplug.dll

Note: If you end up having to enter this info manually, keep in mind that
there is a space before shell32.dll and hotplug.dll.

Give your new shortcut an appropriate name. How about "Safely Remove
Hardware".
When you're finished, right click the shortcut and select Properties.
On the Shortcut page, hit the "Change Icon" button.
Browse to %windir%\system32\hotplug.dll to gain access to the correct
icon.
If you want, you can drag this shortcut onto the Quick Launch toolbar for
easier access.

Thanks! I'll do that, but first....
Next, you might want to visit some of the online virus scanners
and see what they find:

As I said, bouncing around possible scenarios that would lead to a
bewildering set of seemingly unrelated symptoms in my head makes me suspect
malware, just as it does you.

So I got back up out of bed around 5:00 in the morning and tried to run
Housecall, which is my favorite of the online scanners, possibly because it
was the first one that I knew of, but also because Trend Micro does a good
job. I did what I usually do, and googled for "free online virus scanner",
and tried to run Housecall and the other usual results from the top ten:

Panda: I've had good results from Panda's scanner.

BitDefender

.... and lastly, RAV. Sadly RAV seems to have closed down there free online
scanner:

http://www.ravantivirus.com/scan/

But here's the significant thing: On each and every free online scanner's
web page, I could load the page's just fine, until I got to the point of
actually downloading the ActiveX control and installing it. IE would give
me an Error 404 then, for EVERY FREE ONLINE SCANNER!

So now I'm thinking it's definitely malware, whether it's a virus, worm,
Trojan horse, or whatever I have no idea. But I'll guarantee you that your
suggestion and my suspicion is correct.

So tonight when my Dad is done surfing the web and goes to bed, I'm going to
pop the hard drive out of that computer and put it into another computer as
a secondary drive so I don't have to boot from it. Then I'm going to scan,
scan, and scan it some more with an installed copy of Symantec Anti-Virus
followed by the free online scanners. That's one of the advantages to
having a 16 port network here at the house and plenty of spare junk
computers to stick the drive in and not have to worry about that hard drive
infecting the system volume on MY machine. Gotta draw the line somewhere.
;-)

Will report the results.
Trend Micro Housecall:
http://housecall.trendmicro.com/

Panda Active Scan:
http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

McAfee FreeScan
http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp

You might also consider downloading and running the 14 day evaluation
version of Ewido Anti-Malware:

http://www.ewido.net/en/download/

Once you're assured that your Dad's PC is pest free you can move on to
running System File Checker. If SFC doesn't help resolve the issues your
dealing with, it may be time to run at least a repair installation if not
a clean installation.

Good luck

Nepatsfan

Patriots fan?

I'm a Red Sox fan, even though Alabama isn't exactly juxtapositioned next to
Massachusetts. Although I must admit that they lost a little bit of their
charm when they actually won the '04 series. ;-)



--

bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."
 
B

Bill Evans

Bill Evans said:
So tonight when my Dad is done surfing the web and goes to bed, I'm going
to pop the hard drive out of that computer and put it into another
computer as a secondary drive so I don't have to boot from it. Then I'm
going to scan, scan, and scan it some more with an installed copy of
Symantec Anti-Virus followed by the free online scanners. That's one of
the advantages to having a 16 port network here at the house and plenty of
spare junk computers to stick the drive in and not have to worry about
that hard drive infecting the system volume on MY machine. Gotta draw the
line somewhere. ;-)

Will report the results.


According to SAV, the hard drive had two Trojan horses:

Trojan.Loader

Trojan.Mitglieder

Now scanning with BitDefender. Housecall 6.5 wouldn't load, I waited over
five minutes for both versions to load and neither would ever complete.


--

bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."
 
N

Nepatsfan

Bill Evans said:
After I posted my initial post in this thread last night, the
suspicion that some piece of malware was the root cause of
all or a great deal of these symptoms grew and grew on me.


Thanks! I'll do that, but first....


As I said, bouncing around possible scenarios that would lead
to a bewildering set of seemingly unrelated symptoms in my
head makes me suspect malware, just as it does you.

So I got back up out of bed around 5:00 in the morning and
tried to run Housecall, which is my favorite of the online
scanners, possibly because it was the first one that I knew
of, but also because Trend Micro does a good job. I did what
I usually do, and googled for "free online virus scanner",
and tried to run Housecall and the other usual results from
the top ten:

Panda: I've had good results from Panda's scanner.

BitDefender

... and lastly, RAV. Sadly RAV seems to have closed down
there free online scanner:

http://www.ravantivirus.com/scan/

But here's the significant thing: On each and every free
online scanner's web page, I could load the page's just fine,
until I got to the point of actually downloading the ActiveX
control and installing it. IE would give me an Error 404
then, for EVERY FREE ONLINE SCANNER!

So now I'm thinking it's definitely malware, whether it's a
virus, worm, Trojan horse, or whatever I have no idea. But
I'll guarantee you that your suggestion and my suspicion is
correct.

So tonight when my Dad is done surfing the web and goes to
bed, I'm going to pop the hard drive out of that computer and
put it into another computer as a secondary drive so I don't
have to boot from it. Then I'm going to scan, scan, and scan
it some more with an installed copy of Symantec Anti-Virus
followed by the free online scanners. That's one of the
advantages to having a 16 port network here at the house and
plenty of spare junk computers to stick the drive in and not
have to worry about that hard drive infecting the system
volume on MY machine. Gotta draw the line somewhere. ;-)

Will report the results.


Patriots fan?

I'm a Red Sox fan, even though Alabama isn't exactly
juxtapositioned next to Massachusetts. Although I must admit
that they lost a little bit of their charm when they actually
won the '04 series. ;-)



--

bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."


If you have no luck getting Housecall working you can download
the Trend Micro Sysclean package from either of these two
sites:

http://www.trendmicro.com/download/dcs.asp

http://www.trendmicro.com/ftp/products/tsc/sysclean.com

Here's an article that explains how to use the system cleaner:
http://uk.trendmicro-europe.com/enterprise/support/knowledge_base_detail.php?searchSolutionID=25991

You'll also need the latest virus pattern files, lpt157..zip:
http://www.trendmicro.com/download/viruspattern.asp

Good luck

Nepatsfan
 
U

Uncle Grumpy

Bill said:
Recently the "Safely Remove Hardware" trayicon that lets him shut down any
USB mass storage device so it can be safely removed disappeared.

What am I missing here!?

I thought that USB items could be safely connected/disconnected at
will.

I do it all the time... and have done it since USB was freakin'
invented.
 
H

Hans-Georg Michna

Bill Evans wrote:
What am I missing here!?

I thought that USB items could be safely connected/disconnected at
will.

I do it all the time... and have done it since USB was freakin'
invented.

Grumpy,

it depends on how the device is set up. There is a setting for
best performance. If you choose that, you have to use the Safely
Remove Hardware icon.

Hans-Georg
 
J

Juan I. Cahis

Dear friends:

A good idea is to create the following permanent shortcut on the
desktop:

%windir%\system32\rundll32.exe shell32.dll,Control_RunDLL hotplug.dll

and to call it "Hardware Unplug" or similar.

I hope this help.

Bill Evans said:
I'm crossposting this to three newsgroups because I'm not sure which
newsgroup this topic should be discussed in. This isn't my computer problem
I'm asking about, but rather it's my Dad's. I'm a computer consultant and
lifer college student, and my Dad has been bugging me for the past three
weeks to fix a problem he's having on his computer. So far I have had very
little success.

My Dad has two USB flash memory sticks; one (128 MB) that's about four years
old, and another (1 GB) that's brand new. The new one is a PNY Attaché. I
can't remember what brand the old one is, and the label has worn off of the
plastic case.

Recently the "Safely Remove Hardware" trayicon that lets him shut down any
USB mass storage device so it can be safely removed disappeared. It hasn't
just hidden itself because it thinks it's inactive, because I have "Hide
inactive icons" turned "Off" on this machine. I did try turning it back
"On", opening the "Customize Notifications" dialog box, and changing the
behavior for the "Safely Remove Hardware" trayicon to "Always Show", and
still it doesn't show itself when either of the USB flash memory sticks are
attached to a USB port on this computer.

I have googled the entire internet, including usenet archives, and have seen
several people ask this same identical question. None of the people that I
saw that asked this question ever found a solution to this problem.
Predictably they were told that they'd turned the icon to "Always Hide",or
"Hide When Inactive", and almost always the original poster of the question
would
say that he'd already thought of that and tried changing that. Usually
anyone that's knowledgeable enough about computers and tech support issues
to
get around to posting a question in a newsgroup is going to be savvy enough
to have already tried the obvious solution to a problem without success,but
I digress....

Even though this isn't my computer and I rarely if ever use it, I know for a
fact that the "Safely Remove Hardware" trayicon did operate as intended up
until three weeks ago. This is a Dell 3000 2.8 GHz P-4 with 512 MB of RAM
running Windows XP Home SP2 that was purchased in August of 2005. I setit
up and protected it against malware before turning it over to my Dad and
hooking it up to the home network at it's permanent location on his desk.

When I set it up, the USB flash drive worked exactly as it's supposed to: If
you stuck it into any USB port while the machine was on, you would hear the
Windows sound for "Device Connect", then the trayicon would appear. After
using it, you could then shut it down using the trayicon, the Windows sound
for "Device Disconnect" would chime, and then you could safely remove it.

According to my Dad, about a month ago the "Safely Remove Hardware" trayicon
disappeared, and when my Dad asked me what he should do about it, I toldhim
not to worry about it and to remove his USB 128 MB flash memory stick
whenever he needed to remove it. After waiting five-ten seconds after
copying files to it for the file transfer to be flushed from any cache, of
course.

He did this for about a week, until he lost some files on the memory stick
and had to recopy them to the stick a second time. After that, he had to
shut the machine down and wait for the machine to power down fully before he
felt confident that he could safely remove the USB flash memory stick. Also
the memory stick started acting flaky in general (according to my Dad), so
we ordered him a new 1 GB USB flash memory stick.

I had hopes that when the new memory stick arrived and I installed it, that
the problem with the missing trayicon would rectify itself. It didn't. It
has the same identical symptoms as the old USB flash memory stick.

ANY SUGGESTIONS? I've already installed the most recent USB 2.0 drivers,
motherboard, chipset, and BIOS updates I could get from the Dell web site.


Also I have other weird things happening with this machine:


1) When I have been experimenting with the memory sticks on my Dad's
computer, and also on my computer, naturally I've been removing the entry in
"Device Manager" for the USB flash memory stick under the disk drive
section, and any other various entries (like "USB Mass Storage Device") that
I could find.

Then I'd reboot, and try reattaching the USB flash memory stick so I could
reinstall the device drivers from scratch. When I would insert the memory
stick into a USB port, the first dialog box that would come up would be "New
Hardware Found", and it would say that it had found new hardware called
"Security Device" that I can't find the driver for anywhere. Neither memory
stick came with any CD or floppy disk with any drivers, and Windows XP
couldn't find a driver for any "Security Device" when I would tell it to
automatically search locally and on "Windows Update" for the driver, andI
tried to manually find the driver in the \I386 folder, or in the
\Windows\Options\Cabs or \Windows\Inf or \Windows\System or
\Windows\System32 or anywhere else.

I also googled the net for an answer to this one with no success, but ifyou
cancel the search for a driver for "Security Device", a second "New Hardware
Found" dialog box would appear and correctly install the needed generic
Windows driver for USB flash memory sticks and also for USB mass storage
devices and it would work. As I said earlier, this odd behavior happenson
his machine and also on my machine. Other than this, my machine's "Safely
Remove Hardware" trayicon acts normally.


2) A Ctrl-Alt-Del three fingered salute on my Dad's machine does NOT bring
up Task Manager.

The machine has seemed slower than it did three months or even two months
ago, and it was purchased in October of this past year. Naturally the first
thing I think is "What bad thingie is running in the back ground, using MY
precious CPU cycles?". So I tried to bring up Task Manager to see if I
recognized anything bad, or even anything marginal that I would remove if
one of my parents had installed anything unwise like Weatherbug or whatever.
I tried to bring up Task Manager in the normal fashion, by hitting
Ctrl-Alt-Del, with no response.

That really concerns me, but there's no reason for me to think it's another
symptom of the same problem that's caused the "Safely Remove Hardware"
trayicon to disappear. It may indeed be connected to that problem, but
since
I have no reason to think that at this time, I'm going to table that problem
for later since that machine is relatively protected against malware, at
least it's better protected than 99.9% of the other computers I've run
across doing computer consulting. It's "Windows Updates" are 100% up to
date; it's using ZoneAlarm; Symantec Anti-Virus with it's definitions
up-to-date; Javacool Spywareblaster with all protections enabled and it's
definitions up-to-date; the MS Anti-Spyware beta with a daily disk scan,all
protections enabled and it's definitions up-to-date; Spybot with a daily
disk scan, all protections (including the HOSTS file locked down and IE's
home page locked down) enabled and it's definitions up-to-date; and manual
weekly Ad-Aware disk scans with it's definitions up-to-date.


2) Every time I reboot, the machine keeps opening up a copy of Windows
Explorer, viewing the contents of a particular folder on the hard drive.

The machine does have "Restore previous folder windows at logon" turned on,
but the folder gets closed every time the machine boots, and still aftera
reboot, it reappears. I turned off "Restore previous folder windows at
logon", and still after a reboot, it reappears. Then I turned "Restore
previous folder windows at logon" back on, and still after a reboot, it
reappears, even after having been closed when the machine was shut down.


3) Naturally the first thing I wanted to check to see what might be opening
this folder was the "Startup" folder, and there was nothing unusual there.

Next I wanted to look in the registry for any keys in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run that I
didn't recognize.

I tried typing "Regedit" in the "Run" dialog box, and Windows told me that
it couldn't find or access the resource. So I checked the PATH environment
variable, and it was assigned to "PATH=C:\WINDOWS\system32;C:\WINDOWS"as it
should be.

Then I tried browsing to the C:\WINDOWS\ folder, double-clicked on
regedit.exe, and the browse dialog box correctly returned
"C:\WINDOWS\regedit.exe" to the run dialog box. I thought "Surely it'llbe
able to find it now....", but when I clicked on the OK button in the run
dialog box, NOTHING HAPPENED!

Ditto opening a command prompt and typing "regedit".

So how do I open a copy of Regedit to try to diagnose and fix these other
problems?

Do I need to make a new user ID on that machine and see if it exhibits these
same weird symptoms?
Thanks
Juan I. Cahis
Santiago de Chile (South America)
Note: Please forgive me for my bad English, I am trying to improve it!
 
B

Bill Evans

Hans-Georg Michna said:
Grumpy,

it depends on how the device is set up. There is a setting for
best performance. If you choose that, you have to use the Safely
Remove Hardware icon.

Hans-Georg


I'm with you Uncle Grumpy, it seems like that was entirely the point when
they came up with USB ports. Hot-swapping and having a single type of
connector for multiple devices were the big two selling points.


--

bill evans
WHEvansIII_no@spam_Charter.net
Hartselle, AL

"Superman where are you now,
When everything's gone wrong somehow..."
 
H

Hans-Georg Michna

A good idea is to create the following permanent shortcut on the
desktop:

%windir%\system32\rundll32.exe shell32.dll,Control_RunDLL hotplug.dll

and to call it "Hardware Unplug" or similar.

Juan,

thanks, I like this!

Hans-Georg
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top