External Hard Drive Created XP Problems

[MSW]

USB-attached a WD Passport external hard drive for a brief off-load from my Dell Inspiron 1501 with XP Home. Ever since then, (1) XP Themes will not stay selected, changes to Modified => desktop w/ plain blue background (Control Panel > Display > re-selecting XP Themes restores the screen saver, but only temporarily; (2) in My Computer, cannot open drives (C: or a flash drive) by clicking on drive icon -- instead, must right-click and then select open; (3) one of my flash drives frequently has difficulty closing; (4) installing the balky flash drive in another computer (Dell desktop with XP Pro) has created the same set of glitches there.  It appears as though the Passport did not properly close, for whatever reason, and that has knocked things askew and perpetuated the behavior.  I can live with it -- but any suggestions on how to rectify these glitches would be appreciated.

TIA,
MSW

[lostcoast]

Have you ran antivirus and malware scans on all drives in question?

[patio]

Are you running the Passport software that came with the drive ? ?
There are known issues with it.

[MSW]

(1) I did not check the Passport for malware before using it, and I no longer have access to it.  I use AVG Free on my laptop, and it reports my C: drive is clean.
(2) I did not set up any special Passport s/w -- I just plugged the Passport's drive into my laptop's USB port and copied a file to it.

MSW

[lostcoast]

I have a question, do you use the windows usb disconnect function when you un-attach a drive or just pull the usb plug to disconnect?  I'm just curious

[patio]

Here's one thing you can try...actually 2:
Travel to Control Panel/System/Hardware/Device Manager.
Right click all instances of USB roots and hubs and select Remove/Uninstall...you will recieve a warning...ignore it.
When you re-boot Windows will automatically re-install them.
Do this with only the minimum USB devices you need hooked up.

Try the drive again and see if it is properly recognised.

If no joy-joy go to Start/Run and type in sfc /scannow and hit Enter...have your XP CD handy as it will ask for it. Let it run to completion remove the XP CD and re-boot.

Good Luck and let us know...

[MSW]

Thanks for the feedback. To reply to the points raised --
(1) I do not just pull out USB devices -- I click the disconnect icon.  But my
gut feeling is that the Passport's close sequence did not complete
properly, for whatever reason, and when I pulled the drive's connection,
things went out of whack.
(2) Un-installing the USB root hubs unfortunately did not cure any of
the symptoms.
(3) Ran Sfc /scannow -- it did not request an XP CD (I"m using OEM-installed
XP Home), appeared from the progress bar to run all the way through to
completion, no diagnostic messages issued.

The balky flash drive is now no longer recognized when plugged in --
previously, it just had trouble closing/stopping once started.  The other
flash drive still works fine.

Plugged a Sandisk Cruzer photo drive into the other, now-similarly-impaired
machine (w/ XP Pro), off-loaded photos, but then the system could not close the drive
afterward.  Ugh!  May also be causing issues with an iPod.  Ugh!

MSW

[patio]

Reply to reply:

Both the roots AND hubs should be removed.
I'm suprised sfc did not ask for a CD...this is a first, unless you have the Recovery Console installed on that machine.
Would this be the front USB ports you are using ? ?
On a lot of big box machines they are notoriously under-powered and can cause these issues.
This is starting to sound more and more like a hardware issue...

[squall_01]

If thats all there is protecting the system I recommend so more scanning programs you said you used avg but what?  Try using spybot or avast or something.  Seems like malware issues.

[MSW]

Patio wrote:
>Both the roots AND hubs should be removed.<

Device Manager lists the following:  (1) Standard Enhanced PCI to USB Host Controller, (5) Standard OpenHCD USB Host Controllers, (6) USB Root Hubs.
I removed all the Root Hubs.  Should I have removed the other stuff, too?

>I'm suprised sfc did not ask for a CD...this is a first, unless you have the Recovery Console installed on that machine.<

I don't know what that is -- this is just a standard-config Dell laptop, AFAIK.

>Would this be the front USB ports you are using ? ?<

My laptop has 2 USB ports on the side, 2 in the back.  I used 1 of the side ones.

>On a lot of big box machines they are notoriously under-powered and can cause these issues. This is starting to sound more and more like a hardware issue...<

Except all it took for my other Dell machine (desktop, w/ XP Pro) to start manifesting similar behavior was plugging in the balky (i.e., apparently corrupted) flash drive that
the first (laptop) machine could not close (and now cannot register as a drive).

P.S.  I know EXACTLY when the problem started, so I just tried a System Restore to a point 2 weeks before then.  Result was a "System has not changed" message.
As another poster noted, malware that AVG (which incl. anti-spy, anti-root,
anti-virus, etc.) failed to catch is possible.  Seems to me since display, flash I/O and
volume open/close have gone somewhat funcky, maybe the BIOS has taken a hit?

MSW

[patio]

Expand the roots and hubs and remove ALL instances of USB.

Clarify "balky" flash drive...is this a flash drive or the WD passport drive ? ?
Try connecting it to a rear port...save your data from it and format it.
WARNING: Formatting will erase all the data so make sure your backups are intact.

P.S. This is not a BIOS issue.

[MSW]

>Expand the roots and hubs and remove ALL instances of USB.<

Those 12 items are everything listed under Universal Serial Bus controllers.
None of those 12 nodes is expandable.  I uninstalled the 6 Root Hubs.
Should I also remove the 6 listed as controllers?

>Clarify "balky" flash drive...is this a flash drive or the WD passport drive ? ?

I USB-attached a WD Passport drive to my laptop only long enough to copy a couple of
files to it.  Clicked the disconnect icon...but, even though I waited sufficiently,
I'm not sure I got a definitive message before scratching my head & finally
disconnecting the Passport.  It was immediately after that that I began seeing
weird behavior.  In addition to the obvious screen saver issue, a 4 Gb flash
drive (not the Passport, which I never attached again) would not close after
it had been opened -- i.e., repeated clicking on the disconnect icon always brought
up the following message:  Problem Ejecting USB Mass Storage Device, "The device 'Generic Volume' cannot be stopped right now. Try stopping the device again later."  That's what I mean by balky.

Trying the same flash drive in my desktop, I got the same message.  Eventually
shut down the machine to pull the drive, rather than simply
yanking it with the message displaying.  Hopefully safely -- but no such luck.
Now the desktop shows the same behaviors -- and, after plugging a Sandisk Cruzer photo drive into the desktop to put some pix on the hard drive, clicking the
disconnect icon gives the same bleepin' not-stopped message!

Now, the balky flash drive is no longer recognized by the laptop -- it does not register it as a drive when it is plugged in (instead of the usual two-tone recognition, I get 3 of the same tones when it is inserted).  It IS still recognized as a drive when I plug it into
the desktop, and I can access all the files  But, when I try to disconnect it by clicking the icon, I get the same message.  Alternatively, I tried right-clicking the drive icon in My Computer and selecting Eject, and that gave me the message "Removable Disk 'G' is current in use."  Tried to run a disk check on it, but got the message "The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk."

>Try connecting it to a rear port...save your data from it and format it.
WARNING: Formatting will erase all the data so make sure your backups are intact.<

I will try that next -- am currently copy the data to the desktop while it is still being recognized.  (Since the system thinks the bleepin' thing is in use, I decided to actually
use it!!!)  I will post my result.

Thanks for your continued feedback on this.

[MSW]

Score one for Patio and for Squall_01.  Formatting the bad flash drive (suggested by Patio) proved difficult, because the system kept insisting that it was in use and exclusive use of Windows files thereon was required in order to format.  But, after much clicking around, I was able to reformat the bleepin' thing.  This morning, I plugged the freshly formatted drive into the desktop to see if it would be recognized.  Slowly, it was -- slowly enough to where I immediately opened the volume, expecting to see no files.  But there was one:  wa6.vbs.  Googling quickly revealed that it's (as Squall_01 suspected) malware -- a worm, not currently detectable by major anti-virus prgs.  A number of people are reporting similar symptoms to mine, including posts in late Oct. from people who caught it in India (where my brother -- whose WD Passport I borrowed, lives) and Cambodia (where he traveled last month, shortly before visiting me).  I still have to do the disinfection work, but thanks to everyone who offered me their feedback.

MSW 

[BC_Programmer]

congratulations on getting it working proper again! But- I wonder how, after formatting- there were ANY files on the drive.

In any case- it also explains your inability to stop it, since the script was running.



This is one reason why I have autoplay disabled universally.

[MSW]

When I plugged in the freshly formatted flash drive, the desktop promptly reinfected it.  The delayed volume recognition + winking drive indicated something (a write) was happening there.  That's why I immediately opened it & took a look and saw wa6.vbs sitting there all by its lonesome self.  Don't know why it wasn't hidden. (I wasn't explictly checking for hidden files and folders, AFAIK.)...Ah, well, I'll accept the break at this point!

MSW