Cant safely eject USB drive w/o restart XP

October 4, 2011 at 22:20:42
Specs: Windows XP-Home vers 2002 SP3
After a virus attack which I resolved, I find I cannot eject any USB drive on any of my 3 ports. I know I have closed all my programs using the drive, yet it says cannot safely remove the drive.
I noticed that "ctfmon.exe" is still running. Could this be the problem?
My drives are set as "Optimise for quick removal" and before the attack I had no problems.
I now have to Restart every time I want to remove the drive which I do before starting up again or else the problem remains.
I feel some setting in windows has been 'altered; by the virus program.
All suggestions welcome


See More: Cant safely eject USB drive w/o restart XP

Report •


#1
October 5, 2011 at 13:01:59
You didn't resolve it. It is still there in some form. Start by trying to put an autorun.inf FOLDER on the usb drive.

I suspect the system is trying to access some file on the usb devices still. Might look at registry.

May be time for a clean install of the OS. Format the usb drives in linux and put a folder called autorun.inf on every usb drive you have. Even mp3 players and such that have usb access.

1/3 of highway deaths are caused by drunks. The rest are by people who can't drive any better than a drunk.


Report •

#2
October 5, 2011 at 13:40:35
You only get that message from Safely Remove Hardware, or when you RIGHT click on the drive and select Eject, when the files or folders on the flash drive (or external hard drive, or memory card, etc.) are still being accessed.
Make sure the files / folders aren't being accessed - e.g. if you have minimized any window(s), by default there is a label for that/those in the bottom bar on your main desktop screen - restore those and close the one(s) that are accessing the flash drive.


Report •

#3
October 14, 2011 at 04:17:45
All files closed. No visible program accessing flash drive.
Happens even with friend's drive where I checked drive was recognised via My Computer, did not open it, closed My Computer and tried to eject drive with right click.


Report •

Related Solutions

#4
October 14, 2011 at 11:08:22
Have you tried loading Windows in Safe mode and seeing if you have the same problem there ? If you don't, it's likely you still have malware.

"I noticed that "ctfmon.exe" is still running. Could this be the problem?"

No.
It's a standard Windows file.
Look it up on the web, or look up any file that you don't what it's for, if you want to know what it is.
If you disable it from loading in msconfig - startup, it just loads again eventually anyway - it's loaded elsewhere in the registry. I have never seen that it causes any problem.

"My drives are set as "Optimise for quick removal""

That's the default for a flash drive.
My XP is set that way too.

I haven't heard of any malware that messes up your ability to eject a flash drive but that's possible.(Most malware these days IS NOT a virus.) It's a lot more likely to not allow you to access flash drives, although I haven't seen that yet. .

If that was working fine when you had the malware BEFORE you removed the malware, I HAVE heard of some anti-malware programs that have been known to make mistakes and mess up Windows when they remove supposed malware. E.g. Spybot, AdAware.
What did you use ?

I'm assuming you can access the contents of the flash drives fine . If you can't, that's a completely different situation.

Does the Safely Remove Hardware icon appear in your taskbar when you plug in a flash drive while Windows is running when it wasn't there previously ?
Does it appear in your taskbar when it's already plugged in after you have Restarted the computer ?
If NO to either or both of those, it's quite common for the Safely Remove Hardware feature to get messed up and need to be fixed.

Other than that, if that was NOT working fine when you had the malware BEFORE you removed the malware, or in any case, try doing a Full scan with Makwarebytes. It often finds malware most other major anti-malware programs do not.

See response 1:
http://www.computing.net/answers/wi...

Ignore the part about loading your latest System Restore restore point unless you did what the guy in that Topic said he did in the first post - loaded a previous restore point.


Report •

#5
October 17, 2011 at 03:19:32
Thanks, your suggestions were very welcome.

The Safely Remove Hardware icon appears in my taskbar when I plug in a flash drive while Windows is running when it wasn't there previously

In Safe Mode, I plugged drive then tried to eject, but same problem.

If I restart Windows with flash drive plugged, always goes to 'select' Safe mode but whatever I select it returns to this screen. If I unplug the flash drive, Windows starts up as normal.

I can access contents on flash drive ok. What I do is unplug the flash drive when Windows is hibernating. On Resuming, I hear the 'unplug' sound, but Windows carries on ok.

I had not used any anti-malware programs until now, but on your suggestion did Full scan with Makwarebytes.
It found the following and removed it.
" PUM.Hijack.StartMenu
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs"

However, the problem is still there !!!
HELP


Report •

#6
October 17, 2011 at 08:40:38
"I had not used any anti-malware programs until now..."

You stated in your first post...

"After a virus attack which I resolved,..."

If you had not used any anti-malware programs until now, what did you do to supposedly resolve the problem ?

Do you know the name of whatever the malware was or can you describe the symptoms ?

No one anti-malware program finds all malware these days. You may need to run several of them in some cases to find the malware. There are many free online scans that can be done without having to install any more than a minimal amount of software on your computer. If you run a FULL scan with whatever anti-malware prgram you DO have installed, it often finds malware it's resident module that runs all the time doesn't find.
.........

When you plug in a flash drive, a window is supposed to pop up on which you are supposed to select what you want to do or which program to use to examine it - are you seeing that ? If yes, are you closing that window BEFORE you attempt to eject the drive or use the Safely Remove Hardware feature to STOP accessing the drive ?

Also, when you plug in a flash drive while Windows is running, you should see a window pop up that says it is scanning the drive (to find out what types of files are on it) BEFORE you see the above window pop up Are you seeing that ? If yes, are you closing that window if it's still there BEFORE you attemprtto eject the drive or use the Safely Remove Hardware feature to STOP accessing the drive ? (That window disappears once the drive's partitions has/have been fully scanned).

"In Safe Mode, I plugged drive then tried to eject, but same problem."

OK, good to be informed about.
That indicates your problem is not caused by some software that loads when you load Windows normally that is not loaded when you load Safe mode.

"If I restart Windows with flash drive plugged, always goes to 'select' Safe mode but whatever I select it returns to this screen. If I unplug the flash drive, Windows starts up as normal."

You didn't mention that specifically previously.
That probably indicates it's a software problem, not a hardware problem, since the flash drive is recognized fine when you plug it in while Windows is running.
.....

Try loading a previous System Restore restore point with a time and date just before you first had this problem.




Report •

#7
October 17, 2011 at 09:11:16
If you want ctfmon not to run it can be stopped prematurely by accessing control panel/regional and language options, languages tab, details button, advanced tab, under "system configuration" place check mark by "Turn off advanced text services." Click on Ok. Check windows task manager and you should see that ctfmon.exe is no longer running.

Please let us know if our advice was able to help you.


Report •


Ask Question