Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

'A device attached to the system has stopped functioning' error, after combofix


  • Please log in to reply
5 replies to this topic

#1 PaleWing

PaleWing

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 06 December 2016 - 01:13 PM

Hi everyone, i had an ok windows 8 64bit computer & i think the USB was playing up, where it would ding to say USB stick or HDD was inserted, but nothing appeared & device manager showed a yellow exclamation symbol on one of the USB entries. I later read on the net a reset could fix it & it did (but it sometimes comes back, it's only started in the last week, or since i did the following (i forget which came first, i scanned because of the USB error i think)

 

I had put in a portable USB HDD & was trying to find out what was on it & i think it didn't show up & only dinged. I scanned it on a linux live disc on a laptop & it only showed some $avg folders (it's one of my gfs old drives, she was unsure what was on it)
anyway, i decided to scan this computer using Malwarebytes Anti malware & then Windows Defender, then Combofix

 

MBAM found a heap of 'ASK toolbar' 'AskPartnerNetwork' files & entries & removed those
Windows Defender found two entries, on the portable HDD which i also scanned (2 entries, win32/dynamer!ac)(i tink the AVG files mentioned Palevo Worm, as i'd looked that up)Then
I ran Combofix & it found a heap of entries & 'corrected' those

 

thinsg seemed fine, til i tried to run iViewRipper yesterday & it comes up with the 'A device attached to the system is not functioning' error.
First i thought it was only related to that program, but after researching that it uses .NET 4.5.2 i tried the .NET Framework Setup Verification Utility (which i downloaded just before) and ran that, when it gets to a point & fails with this info -

Actual Data:    REGISTRY VALUE FOUND
[12/07/16,04:14:51] Section [Registry - .NET Framework 4.5 (Wow6432Node)] - stop parsing entries
[12/07/16,04:14:51] Processing custom action 'Custom Action - .NET Framework 4.0 test application'
[12/07/16,04:14:51] ExecutablePath = 'Netfx40TestApplication.exe'
[12/07/16,04:14:51] FriendlyName = '.NET Framework 4 test application'
[12/07/16,04:14:51] TimeoutSeconds = '300'
[12/07/16,04:14:51] WaitOnExit = 'true'
[12/07/16,04:14:51] Silent = 'true'
[12/07/16,04:14:51] Launching process 'Netfx40TestApplication.exe' now
[12/07/16,04:14:51] ****ERROR**** CreateProcess failed for 'Netfx40TestApplication.exe' with error code 31 - A device attached to the system is not functioning.

[12/07/16,04:14:51] ****ERROR**** Verification failed for product .NET Framework 4.5.2

 

I also then read that combofix should be unsinstalled after using it, so i did that too.

 

I then thought to try other programs, JsonView.exe fails with same error, but many other programs work fine. (puzzlex, vlc, irfanview, EAC, imgburn, utorrent, trader's little helper, games, notepad, 7-zip, CoreTemp.  SBSRipper works perfectly fine, but not iViewRipper?)

What could be wrong? (apart from using combofix without supervision O_Q)
thanks for any help



BC AdBot (Login to Remove)

 


#2 PaleWing

PaleWing
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 06 December 2016 - 01:21 PM

some extra info - in the .NET 4.0 folder, there's a ton of .exe files, some launch & some have the 'A device attached to the system is not functioning' error

error ones = AddInProcess.exe, AddInUtil.exe, ComSvcConfig.exe, DataSvcUtil.exe, dfsvc.exe, EdmGen.exe, Microsoft.Workflow.Compiler.exe, SMSvcHost.exe, WsatConfig.exe
all the other .exes open a window or have no error.

I was thinking the error is something to do with .NET



#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:56 AM

Posted 07 December 2016 - 08:53 AM

From your description, I'd suspect that there's some damage to the OS as your primary problem.

Once the damage is fixed, then we can get on to fixing the other problems.

 

Here are my suggestions for repairing the OS - but, the damage caused by the file deletions and registry edits may not be repairable by these methods.

If this were my system, I'd wipe it clean and start over (but you may not wish to do this).

So, here's my other restore/recovery suggestions:

 

NOTE:  Try a clean boot to see if the problem clears up that way:  http://www.thewindowsclub.com/what-is-clean-boot-state-in-windows
If it does, then different troubleshooting steps are called for.

Here's some repair/recovery/restore options (in this order).   Be sure to backup your stuff if you don't want to take the chance of losing it.:

1 - Startup Repair.  Run it 3 times, rebooting in between tries.

2 - System Restore to a point before this started happening.

3 - DISM/SFC repair (DISM doesn't work with W7, although SFC does)  - doesn't work if you're not able to boot to Windows (let me know and I'll post a way to do it from Startup Repair)
    

Then please run the following DISM commands to see if there's any problems with the system (from an elevated (Run as administrator) Command Prompt).  Press Enter after typing it:
   
Dism /Online /Cleanup-Image /RestoreHealth

    FYI - I have repaired systems using the last command even though problems weren't found with the first 2 - so I suggest running them all.

    From this article: http://technet.microsoft.com/en-us/library/hh824869.aspx

    You can also run sfc.exe /scannow from an elevated (Run as administrator) Command Prompt to check for further corruption. Include the CBS log (located at C:\Windows\Logs\CBS\CBS.log) if you'd like to have a Windows Update expert check it (I don't check them because I can't read them)


4 - RESET using the "Keep My Files" option (W8 calls this a REFRESH; W7 and earlier doesn't have this function)

5 - Repair install of the OS (Thanks to FreeBooter!):
   

"How To Perform a Repair Installation For Windows 8, 8.1 and 10"
    https://www.winhelp.us/non-destructive-reinstall-of-windows-8-and-8-1.html

    "How to Do a Repair Install to Fix Windows 7"
    http://www.sevenforums.com/tutorials/3413-repair-install.html

    "How To Perform a Repair Installation For Vista"
    http://www.vistax64.com/tutorials/88236-repair-install-vista.html

    "Non-destructive reinstall of Windows XP"
    https://www.winhelp.us/non-destructive-reinstall-of-windows-xp.html


6 - RESET using the "Remove Everything" option (W8 calls this a RESET; W7 and earlier doesn't have this function)

If using W7 or earlier, this can be accomplished by resetting the system by use of the recovery partition/recovery disks/recovery drive.
If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here:  http://www.carrona.org/recdisc.html )

7 - Wipe and reinstall from the Recovery Partition (if so equipped)

8 - Wipe and reinstall from Recovery Media - to include deleting all partitions.
If you don't have them, you can usually order them from the OEM manufacturer of your system ( US points of contact here:  http://www.carrona.org/recdisc.html )

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 PaleWing

PaleWing
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 13 December 2016 - 09:48 PM

can i just replace the files & changes?
i've been using the computer since i posted & no real problems, other than i noticed today the Acer power button on the taskbar also pops up the error. (ePowerButton.exe)
i can post the combofix log if tat helps. Am reluctant to restart the computer to do the repair in case it won't boot properly. Yet everything seems to be working (apart from the programs mentioned)



#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:56 AM

Posted 15 December 2016 - 06:06 AM

You can try to replace files - but I don't get involved in that as it's generally unreliable.

If you like advice on that, post over in the appropriate Windows forum for one of the experts there to help you.

 

DO NOT USE COMBOFIX without being told to use it by our malware staff (in the Security forums)

If infected, I'd suggest posting over in the Am I Infected forum:  http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/
Please read the pinned topics at the top of the forum for instructions on how to post there.

 


My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 PaleWing

PaleWing
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 16 December 2016 - 12:51 PM

'Have you tried turning it off & on again?' - Roy I took the plunge & restarted it. All programs work fine now. O_o Could it be Combofix fixed whatever it did & when i uninstalled it, it required a reboot to be back to normal? It's possible nothing was wrong with it to start with. (I'd use combofix once before after getting advice years ago with a virus i had on a different system. I forgot that it wasn't the program i was looking for )(was trying to find a rootkit detecting program that i'd used in the previous situation) Thanks for your help




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users