Jota.Ce Posted February 25, 2011 Share Posted February 25, 2011 XP SP3 updated to day-------------------------------This is what happens to me recently.I used a program to re-flash an USB flash drive (with 2 partitions), and installed a M$ update related to PenDrive's AutoRun in the same moment.Since then, i insert an USB flash drive and it idoesn't even autoplay, and it's not present in SRH dialog.I got Autoplay with M$ TweakUI Powertoy, but my USB drives won't appear on SRH dialog.SRH icon appears in the tray, cause i have a WLAN adapter (and i can stop it). SRH icon won't appear if i only have PenDrives connected.But if i manually open it, then i can't see any USB flash drive inside, there's nothing listed there.Anyone can help?Thanks in advance ;) Link to comment Share on other sites More sharing options...
Atasas Posted February 25, 2011 Share Posted February 25, 2011 Reformat? Link to comment Share on other sites More sharing options...
HX1 Posted February 25, 2011 Share Posted February 25, 2011 What version of XP3? Home or Professional - ( betting on Pro )... Link to comment Share on other sites More sharing options...
Jota.Ce Posted February 26, 2011 Author Share Posted February 26, 2011 XP SP3 ProfessionalThe winupdate was: KB971029 ( i thought it was related to that one).It's not too dramatic (it doesn't deserve a format), but i can't eject USB flash drives.I've tried some solutions found out there, but nothing works here.Any clue? Link to comment Share on other sites More sharing options...
HX1 Posted February 27, 2011 Share Posted February 27, 2011 Comb through your Group Policy/LSP settings and see if you can find anything about your USB, More than likely in the Account and Local Policies or could be somewhere else.. just depends... but I would check there and EVEN .. MAYBE do a registry scan wit SpyBot for possible infection ( of course you could be able to do it with something else as well ) Link to comment Share on other sites More sharing options...
Jota.Ce Posted February 27, 2011 Author Share Posted February 27, 2011 Hi again.Checking all GPedit sections i discovered there's a setting to allow to format/eject removable devices.It is set to "Admnistrators". But it remind me to check if a rootkit, for example, is taking me off administrator privileges.First choice is, of course, seeking in AutoRuns for unsigned drivers.And... THAT'S IT, an unsigned "mpfilt.sys" driver is there. I only have ESET, D-Link, HP, and Microsoft drivers (and an unsigned driver fom UDefrag).So i spotted it very fast.The problem is... if i uncheck that draiver to avoid my OS loading it, then USB hub doesn't work. I've seen that file is not present in my old WinXP partitions, so i guess it shouldn't be in my sys32/drivers folder. But i cand kill it without killing all USB connections including my WLAN adaptor).Anyone knows how to get rid of a driver without losing a part of your system ?PS: This reminds me a situation when i installed AnyDVD, and it loads a driver even if you uninstall AnyDVD. If you uncheck that driver to avoid loading, then you won't have any optical drive, they're gone. Link to comment Share on other sites More sharing options...
HX1 Posted February 27, 2011 Share Posted February 27, 2011 Sounds like a compatibility issue.. Did this start right away after installing the Hub.. or is it onboard? Have you tried rolling back and/or choosing MS drivers for the device.. Does it have some other method of installing drivers for it? Any settings that could be tweaked for the device at all.. This sort of reminds me of MyWebSerchToolbar installs itself as a driver and destroys systems performance and proper function.. One guy said yo might as well take you PC out and burn it.. LOL I have fixed a few with this type of infection/problem.. and the answer wound up being a fresh install.. If you removed that driver or disabled the device to be removed.. the system would not boot.. Link to comment Share on other sites More sharing options...
Jota.Ce Posted February 27, 2011 Author Share Posted February 27, 2011 Solved!A driver can't be "unregistered" with regsvr32, that was my problem. I only knew a way to "disable its loading" with AutoRuns.But searching for that...I discovered it's a driver that ALCOR (flash chip manufacturer) installs it to your computer when you use a chip "programmer" (i used one to merge the CDFS and FAT partitions of a PenDrive). So this problem was solved out there (solution on a chinese website, but referenced in M$ Technet inside a Win7 USB port failure post).So it wasn't a rootkit, i'm relieved.Solution method:Firstly, go to the folder \Windows\SysWow64\drivers (and whatever in your computer) and delete this file: "mpfilt.sys". Then, restart the computer.After that, open up regedit and then go to HKLM\System\CurrentControlSet\Services\mpfilt key, then delete it. Do the same to these two key also: HKLM\System\ControlSet001\Services\mpfilt and HKLM\System\ControlSet002\Services\mpfilt Go to this key HKLM\System\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000} and delete this value "Lowerfilters".Do the same to HKLM\System\ControlSet001\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}and HKLM\System\ControlSet002\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}.Restart.I'd say: delete the .sys, then search for "mpfilt" in your regedit and delete everything xDDDDTHANKS FOR HELPING / GIVING CLUES / GIVING SEARCH DIRECTIONS / GIVING YOUR SUPPORT !!! Link to comment Share on other sites More sharing options...
HX1 Posted February 27, 2011 Share Posted February 27, 2011 :thumbsup: Good to hear it's solved.. BUT you did most of the work.. LOL.. :P Link to comment Share on other sites More sharing options...
Jota.Ce Posted February 27, 2011 Author Share Posted February 27, 2011 Anyway... thanks for your time/patiente/help.It is greatly appreciated. Link to comment Share on other sites More sharing options...
HX1 Posted February 27, 2011 Share Posted February 27, 2011 Always Welcome.. :D Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.