All USB ports don't recognized usb drives but do see other devices

pscowboy said:

Please excuse me jumping in, but I've cured some USB woes with the following tactics. Nothing to lose and you won't "break" anything. Unplug all USB stuff except keyboard and mouse.

In C:\Windows\System32\Driverstore:
Do not touch the folders (en-US; File Repository; Temp).
Right-click each file, (one at a time), go to Properties - Security - Edit. Select your User account - check off Full Control - OK. When done, select all the files and delete them.

In C:\Windows\System32\Driverstore\File Repository:
Scroll down to folder usbstor.inf(........) If there are two, work on the first one. Go into this folder and copy & paste usbstor.inf and usbstor.pnf to C:\Windows\inf. Agree to overwrite.

Reboot. When back to your desktop, find the command prompt - right-click & run as administrator and type the following: mountvol.exe /N

Then type: mountvol.exe /e
This will disable then re-enable auto mounting.

Start plugging in your stuff one at a time and see if they're recognized.

Thanks for the suggestion and I will keep it in case I have more trouble. But doing all that I did in the last post, plus getting snapman.sys and fltsrv (old Acronis file) out of every corner of the registry, as well as finding updated Renesas usb 3 drivers, seems to have worked. What a relief!

I am, however. left with one chronic error and one chronic warning. Do you think your suggestion(s) might address either of these - or - do you have another suggestion:

Session "Homegroup Log" failed to start with the following error: 0xC0000035 - error

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 1/26/2013 4:17:39 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: mg-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3328621373-938311138-4019764245-1001:
Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3328621373-938311138-4019764245-1001

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-01-26T21:17:39.449287200Z" />
<EventRecordID>134371</EventRecordID>
<Correlation />
This is the warning

Thanks again for your help
<Execution ProcessID="144" ThreadID="284" />
<Channel>Application</Channel>
<Computer>mg-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-3328621373-938311138-4019764245-1001:
Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3328621373-938311138-4019764245-1001
</Data>
</EventData>
</Event>

ICit2lol said:

Ok Madeline I understand why you nee so many now - sorry I wasn't being nosey just it seemed a lot of ports to be used.

NOw before you do that if you can getthese devices hooked up to another machine can you check the files system they are using.

To do that > Start > Computer > right click on a drive > click on properties it should say whether it is a FAT32 or NTFS see my pics the FAT32 is one stick I have in and the other is my C: SSD drive - NTFS filing

Hi,

I didn't think you were being nosey - I am aware of how many devices I'm using and everytime I look at all the wires I ask myself the same question. I read your question as wanting to understand more, perhaps find a clue, as to what was going on, and for that, I thank you.

As you will note from my previous post, I made progress last night. and this morning, after more hours, I think it is fixed except for two repeated errors.

This AM I researched files left by Acronis and used the aggressive setting on my registry cleaner. I removed fltsrv and snapman (one word). On the aggressive setting I was allowed to move all of them.

I checked and changed some permissions on the disk management console so that I clearly have full permission and so does Everyone.

At this moment all my usb drives that are plugged into the usb 3 powered hub are working and I was even able to do an incremental backup with Macrium Pro so I have a before and after - or some semblence of it. With CrashPlan completely disabled and not blocking VSS every few minutes, and no files that can't be found, my machine is snappy again. I almost can't believe it will last.

However, I am receiving one repeated error and one repeated warning and I'd like to resolve them to be sure they wont cause problems when I have time to reinstall all my usb equipment and make sure it works, which will be later tonight or tomorrow. The error and the warning are:

Session "Homegroup Log" failed to start with the following error: 0xC0000035 this is the error

Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 1/26/2013 4:17:39 PM
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: mg-PC
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3328621373-938311138-4019764245-1001:
Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3328621373-938311138-4019764245-1001

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-01-26T21:17:39.449287200Z" />
<EventRecordID>134371</EventRecordID>
<Correlation />
<Execution ProcessID="144" ThreadID="284" />
<Channel>Application</Channel>
<Computer>mg-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-3328621373-938311138-4019764245-1001:
Process 912 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3328621373-938311138-4019764245-1001
</Data>
</EventData>
</Event>
this is the warning which I don't fully understand but have a feeling it may be important?

Thank you so much for your help and I'm so grateful to have a working system again.

BTW, do you know of a cloud backup service that might be more sophisticated in its design than CrashPlan?

Madeline

I would not be concerned with one leaked handle and one (what I consider it to be) minor warning.

Don't be too caught up with Event Viewer errors. Windows almost always comes up with something its not happy with. I see EV errors on brand new clean installs.

So happy to see the great progress you made after a lot of work on your part. Follow our down under mates advice, and perform those three scans in full. Start one each night before you go to bed; probably will be 1 1/2 to 2 hours each.

ICit2lol said:

Ok Madeline looks some progress now before you go delving into the registry can you tell me when you last scanned for malware and what with?

If you haven't got it get Malwarebytes and SuperAntiSpyware plus ADWcleaner downloaded and run them.

I noticed a recent USB fix that turned out to be malware related so-

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/


http://www.bleepingcomputer.com/download/adwcleaner/

all are free they may take a little while to run if you haven't run these before - this is again a process of elimination and just delete any rubbish that comes up.:)

I run Mbam ongoingly along with my Eset AV. The day before this happened I'd run Mbam and SAS along with doing a complete virus scan. I wasn't aware of ADWCleaner, but I've just downloaded it and will run it.

Madeline

ICit2lol said:

pscowboy said:

I would not be concerned with one leaked handle and one (what I consider it to be) minor warning.

Don't be too caught up with Event Viewer errors. Windows almost always comes up with something its not happy with. I see EV errors on brand new clean installs.

So happy to see the great progress you made after a lot of work on your part. Follow our down under mates advice, and perform those three scans in full. Start one each night before you go to bed; probably will be 1 1/2 to 2 hours each.

+1 and Madeline if you haven't got CCleaner it might be a good tool to use to clear some of the crud out of the system. Be careful when deleting cookies if they are linked to sites where you need a password like here for example .

To do that run the CCleaner when analysed click on Options then cookies and highlight the ones to keep that is done by sending the to the right hand list with the little > (centre column). Go back to the Analyse page (C and the brush) and run cleaner.
The first time you run it it might take a while but then run it everyday or when you like - to keep the machine clutter free.
CCleaner - Download < from the piriform site - a lot of us use this app:)

I've used CCleaner to clean temp files and such but I've always shied away from the registry section because I don't really know how to use it properly. I presently use JV16 (have for many years) and clean the registry when there have been a lot of changes, or use it to search such as I just did with Acronis.

But I've read a lot about people using CClearner. I never knew you could choose cookies and I will do so immediately - that's really great! Do you use it as your registry cleaner as well?

Thanks

Madeline

ICit2lol said:

Yes Madeline I do but I always back up the reg before I apply any changes - it gives you that option before you do that and the back up is stored in My Documents usually - if you need to reverse the changes you click on the Documents entry and it will reapply the changes but I have never had to do that. Piriform - Registry cleaning is some info on the feature as well as other stuff

This is is the only reg cleaner that I will ever use but it is always down to ones own preferences. In any case using a reg cleaner of any sort needs caution at all times as you will see in my pics I did just a while ago the entries are files that are obsolete / invalid / or missing files that I just ran the cleaner for as they were of little consequence but I still backed up first.

The CCleaner I use far more frequently than the reg feature.

Just as a by the by piriform do an app called Recuva - retrieves deleted stuff and Speccy which will show you a lot of details about your machine and system - very handy to have for when you have problems and folks want to know details.:)
Recuva - Undelete, Unerase, File and Disk Recovery - Free Download

Speccy - System Information - Free Download

Defraggler - File and Disk Defragmentation - Free Download < some use this too (bit slow for me and as I have an SSD do not use a defrag anyway)

Thanks for the above information and the link to Piriform - it is perfectly clear and would be well worth trying. Yes - I will definitely back up the registry.

I've tried defraggler and I do find it quite slow. I have two SSDs on which I don't use it, but I also have three WD black caviars which do need some defragmenting from time to time. The last time I used it, it took forever. I remember liking Auslogics a while ago and perhaps I'll try that again.

I'll also download recuva - it could come in very handy. I've used Speccy for quite some time since I have so much in my case I use it to check temperatures in hot weather.

Thanks for all the tips.l

Madeline