Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Generic [USB] Device is being accessed by a program


  • Please log in to reply
11 replies to this topic

#1 Pershore

Pershore

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 25 November 2015 - 12:10 PM

I have an irritating problem which not infrequently occurs with USB  storage devices, HDs or flash drives.

 

In this case it is with a pair of HGST HTS72532A7E630 2.5in 320GB disk drives (one at time).

 

Connected as an external USB drive, on trying to eject (safely remove), I get the message on my screen something like "Generic Device cannot be stopped because a program is accessing it".  It seems the program is permanently accessing the drive.

 

(it's a generic disk because it suddenly loses NTFS format to become RAW format after computer drops disk, I safely eject it, stop power to it. and reconnect everything.  Despite being set to always on, after running SeaTools and finding no errors on the disk, I left everything, and when I returned hours later, the computer had "dropped" the disk - didn't show in My Compute. That was when I ejected the disk reconnected, and it was in RAW format and non-ejectable)

 

The HD is assigned the letter H: . Even with no applications running (ie task bar is empty, none shown in Task Manager) I get this message.  Using procmon, a search for "H:\" shows nothing. 

 

How do I get to "safely" eject this disk without powering down the whole computer ? 

 

Pershore

25.November.2015

 

Compaq Presario S5160UK DT261A under XP Home/SP3
Processor - Celeron 2.7 GHz
Motherboard - MSI MS-6577 v2.1 'Xenon'
RAM - 2 (1GB +1GB max) DDR PC2700
PSU - OCZ 500W
BFG GeForce 6800GT graphics card in AGP slot.



BC AdBot (Login to Remove)

 


#2 DataMedic

DataMedic

    Authorized DataMedic Rep


  • Members
  • 89 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Providence, RI
  • Local time:05:40 AM

Posted 25 November 2015 - 01:19 PM

If I had to guess, and I mean really just guess, I'd say it's probably some antivirus or anti-malware software that's trying to scan the drive.  Just a guess though, without actually being in front of it it's hard to say for sure.

 

That or it could be actual malware or a virus such as one of the crypt-o ransomware viruses busy at work encrypting data on it.


Edited by DataMedic, 25 November 2015 - 01:20 PM.


#3 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 25 November 2015 - 01:29 PM

thanks for troubling to answer my post.

In the past, when I have experienced similar non-eject issues, I have turned off AVG (the only one I have that runs autonomously) and  this never made any difference.  I did end a process gtcat....exe or something like that to do with MS antispyware, and that didn't make any difference.

 

Pershore

25.November.2015



#4 Captain_Chicken

Captain_Chicken

  • BC Advisor
  • 1,354 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:40 AM

Posted 25 November 2015 - 09:52 PM

Please do a malware bytes scanand see if the problem persists.

Computer Collection:

Spoiler

Spoiler

Spoiler

Spoiler

#5 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 26 November 2015 - 02:50 PM

Ok I've done the scan, results are attached the end of the post, but as I don't what they mean I don't know which to delete/remove.  Advice ?  AVG doesn't find anything.

 

Particularly I do not wish to tamper with utorrent files of firefox files, so me I know can go, like the mindspark and Tagak items. 

 

Pershore

26.November.2015

Attached Files



#6 Captain_Chicken

Captain_Chicken

  • BC Advisor
  • 1,354 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:40 AM

Posted 26 November 2015 - 09:59 PM

The log shows what has already been deleted by the scan. Have you tried running sfc /scannow?

Computer Collection:

Spoiler

Spoiler

Spoiler

Spoiler

#7 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 27 November 2015 - 04:14 AM

Thanks for your attention in this matter, Cap'n

 

I didn't think that; because on my PC's screen, I still uncheck the items not to be deleted (mbam hasn't finished yet; it is still running awaiting a decision as to what to do, what to delete/remove and what to keep.

 

no, I haven't tried sfc /scannow for a few months

 

(btw before running mbam I powered down from Windows, removed the disk-under-test from USB and power, went to bed, and switched on the morning and only then ran mbam.  The  disk issue was bugging me.  I could reconnect it, I am pretty sure it would eject normally  the first time but not the second.  I could then run mbam again or test the disk again and even format it without difficulty provided I did these operations quickly after one another - if I left the system for any length of time, that is when the computer drops the disk and the problems ensue.)

 

Pershore

27.November.2015



#8 Captain_Chicken

Captain_Chicken

  • BC Advisor
  • 1,354 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:40 AM

Posted 27 November 2015 - 10:24 PM

Run chkdsk d: /r in an elevated command prompt. This should check drive d (replace with whatever letter the drive is assigned) for corruption and attempt to repair.

Computer Collection:

Spoiler

Spoiler

Spoiler

Spoiler

#9 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 28 November 2015 - 10:12 AM

I'm a bit wary of CHKDSK /R : last time I tried it (on a different disk) it took over a month and made little difference.  Does it do anything SeaTools for Windows doesn't do ? Oddly, on this pair of Hitachi disks, SeaTools recognizes it as a "Seagate" brand, and so Long Generic (Repair All) is available

 

Pershore

28.November.2015



#10 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 28 November 2015 - 10:21 AM

To return to the question of Malwarebytes scan, what do you recommend I do ?  Delete the obvious, and leave everything else, or delete all, with the possible risk (it seems to me) of making Firefox or uTorrent have problems ?

 

Pershore

28.November.2015



#11 Pershore

Pershore
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 30 November 2015 - 04:21 PM

This is what I did do:

 

I quarantined everything malwarebytes had found, there were just too many to look at each individual entry, afterwards restarting my computer as necessary for mawarebytes quarantines to take effect (so it said)

 

I reconnected the disk I was testing several times (as on numerous previous occasions), power first, USB second, before it registered on the USB system and with a drive letter assigned.  It was in RAW format with all space in My Computer > Properties reading 0 bytes.

 

Next I ran HDTune v.2.55 to look for any bad sectors.  It found two damaged (HDTune) 'blocks' adjacent about 4GB from the start.  Then I ran SeaTools for Windows, Long Generic Repair All (I was surprised I could do this as you are only supposed to be able to do this on Seagate affiliated or branded disks, and this was a Hitachi) and found 29 bad blocks (sectors) which it was able to repair. This damage had occurred before the initial problem which started this, because immediately previously the same tests showed no faults.  I did the other tests without issue.  Next I ran WD's WinDLG and that passed everything, I was surprised to notice that the SMART parameters seemed unchanged despite the 'repaired' sectors.

 

I (long) formatted the disk (Wizard not called ??), and in DiskManagement it regained the label I'd given it.  In My Computer it was still 'Local Disk' without a label and format 'RAW' though it now have the spaces correct.  I ran CHKDSK H: /F and it made some corrections, but it was quick and completed.  My Computer now showed the correct format & disk label.

 

I performed all the tests straight though with hardly idle time between tests.  When finished it ejected safely without trouble.  I disconnected from USB and power,

 

I don't what the problems were caused by, the disks twin was virtually identical behavior, except it didn't fail to eject safely, which is why I started this thread: it's been a problem on and off for years with different disks and computers and it just seems to come and go at random.  When it happens, it's very aggravating.

 

Pershore

30.November.2015



#12 hamluis

hamluis

    Moderator


  • Moderator
  • 55,742 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:40 AM

Posted 30 November 2015 - 05:20 PM

Topic moved Am I Infected.

 

Louis






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users