[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

What is creating the virtual CD drive?

Posted on 2006-06-01
27
Medium Priority
?
1,587 Views
Last Modified: 2013-11-18
I have several applications that can mount iso images as cd drives.  I have one virtual drive showing up now and I dont know which application/process is creating it.  I think I have disabled mounting virtual drives in all these applications but it still shows up.  My question is, how do i discover which app is creating this virtual drive?
0
Comment
Question by:dave4dl
  • 10
  • 7
  • 5
  • +3
26 Comments
 
LVL 70

Expert Comment

by:Merete
ID: 16813677
Hi, there is  Daemon Tools. r/click the icon on the taskbar unmount all drives.  http://cr.yp.to/daemontools.html

Nero image drive: Nero Image Drive:
will allow you to view the contents of a Nero CD Images (*.nrg) and mount them in the system explorer.
You can remove from the program Nero Image C:\Program Files\Ahead\ImageDrive to dis-able it and then uninstall it from add remove programs.


 a digital camera.<< to remove the virtual drive for this there should be a safely remove icon Mass storage device before unplugging yoru USB stop the mass storage device. http://www.mcgill.ca/emf/help/safely-remove-usb/


That's all I can think of for the most common.
0
 
LVL 88

Expert Comment

by:rindi
ID: 16813841
Right Click "My Computer", select "manage", "Diskmanagement" and find the mounted virtual drive. Right click that and check the properties. Usually the driver or software used will be noted here.
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16814003
Merete,

I have alcohol 120% (demo), nero image drive, daemon tools, isomagic (demo), powerISO (demo), and probably a few others I can't think of that mount images.  I've checked all the ones i listed and virtual drives are disabled in all of them so that is why i need to find out which app is mounting the drive

rindi,

Good idea but the virtual drive does not show up in disk management.  Maybe it would if there was an image mounted on it but there isnt and I dont know which app is creating the drive so i can't mount an image on it.

Thanks for taking the time to reply guys.  Any other ideas?
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 
LVL 88

Assisted Solution

by:rindi
rindi earned 400 total points
ID: 16814061
run msconfig, it should show what is loaeded, or

Download the latest version of HijackThis

http://www.hijackthis.de

(Click on the „Directdownload“ link).

run it and save the log. Paste the log to the following website

http://www.hijackthis.de/en

Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16814173
i dont think any of the entries in any of the msconfig tabs is mounting the drive.  I have my startup pretty pared down so unless mcafee or the adobe license manager has decided to start mounting a virtual cd-drive, I still dont know what it is (kidding).  I dont have hijackthis installed but when i have some time if nobody has some easier way to check i may try it out.

Thanks for your time on this.
0
 
LVL 88

Expert Comment

by:rindi
ID: 16814244
hijackthis doesn't need installation, it is just a single program you run. Although it is meant to help you remove malware, it also shows the running processes and so it can be used to identify and remove other software than malware which might not be necessary.
0
 
LVL 70

Expert Comment

by:Merete
ID: 16814891
just a thought have you rebooted may refesh it

A couple of ideas to mull over:
ensure you delete st3*.sys driver files in Windows\System32\Drivers directory
check this thread to remove leftovers from v3.47:
http://www.daemon-tools.cc/dtcc/showthread.php?t=4374

 have you checked in control panel administrative tools> computer management disc management.
Did you uninstall nero image drive? from add remove programs

http://www.daemon-tools.cc/dtcc/t3701-no-drive-letters-assigned-to-the-virtual-drives-or-virtual-drives-disappear.html

Uninstall CloneCD, reboot, choose a custom install and uncheck the Virtual DRive, reboot.  Uninstall it again.

Alcohol's Virtual drive
Go into the register and delete all Alcohol references.
Then re-boot into safe mode and delete the Programs/Alcohol Folder.
http://www.betaone.net/forum/showthread.php?p=82445

Familiarise yourself with taskmanager, it shows all running proceses.
0
 
LVL 70

Expert Comment

by:Merete
ID: 16814992
0
 

Expert Comment

by:area51guru
ID: 16815028
you could run a program called Security Task Manager. Its available for free at
http://www.neuber.com/taskmanager/

It will show you all the dll's currently loaded, what program they are attached to,
and if they are signed by a software vendor.

It also gives you a safety rating depending on the files properties.
0
 
LVL 2

Expert Comment

by:wilniuk
ID: 16815035
Look in the registry HKLM\HARDWARE\DEVICEMAP\Scsi. There are devices and driver names listed.
0
 
LVL 15

Expert Comment

by:f-king
ID: 16815650
remove any external devices like a flash disk ,cardreader,printer with card reader etc and see what happens
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16880278
I still dont know what is mounting this device.

The point of this thread for me was not to uninstall everything on my computer and see if the drive disappeared, it was "How can find out which line of code or script entry or startup file is mounting that drive?"

More info:

i have no external devices like flash disks, card readers, or printers.  I only have a usb keyboard and a usb mouse plugged in (although occassionally i do plug in my digital camera which i guess is the same as a card reader but it is definitely not plugged in now)

area51, i use sysinternal's process explorer which does the same thing (except the safety rating).  No untoward dlls loaded.

wilnuik, very interesting registry area, i'd never looked there before.  But all that was there besides the entries for my hard drives and physical cd drives was an entry for the alcohol driver and an entry for the daemon driver (neither of which is mounting the drive).

when alcohol, daemon, poweriso, or nero mount a drive, windows recognizes it as hardware (right click on the drive --> properties --> hardware tab) but it does not with this drive.  In fact it seems like windows explorer is the only app that recognizes that it exists.  This drive does not show up in Disk Management.  Could this be an artifact from some piece of software i uninstalled?  How do i find out what is mounting this drive?

Thank you all very much for helping me.
0
 
LVL 70

Expert Comment

by:Merete
ID: 16882949
Hi dave4dl , to help you I need to see in my head lol what you have there, what is in your My Computer?
C: drive windows
D: drive << slaved hdd??
E: drive << a rom drive
F: drive<< a rom drive??
G: drive <<a virtual drive ?? unkown possibly from a digital camera??<< is this the one
A: floppy drive

do you have an extra partition in a different format lets say a fat or some other?

try this open the run  type in cmd press enter type in > mountvol    press enter
what do you see.
-----------------------------------------------
On my computer
when I do this I see:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>mountvol
Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L

    path        Specifies the existing NTFS directory where the mount
                point will reside.
    VolumeName  Specifies the volume name that is the target of the mount
                point.
    /D          Removes the volume mount point from the specified directory.
    /L          Lists the mounted volume name for the specified directory.

Possible values for VolumeName along with current mount points are:

    \\?\Volume{06b93108-d6be-11da-b604-806d6172696f}\
        C:\

    \\?\Volume{06b93106-d6be-11da-b604-806d6172696f}\
        D:\

    \\?\Volume{06b93103-d6be-11da-b604-806d6172696f}\
        E:\

    \\?\Volume{06b93104-d6be-11da-b604-806d6172696f}\
        F:\

    \\?\Volume{06b93102-d6be-11da-b604-806d6172696f}\
        A:\


0
 
LVL 70

Expert Comment

by:Merete
ID: 16883003
you may have a ghost, try booting to safemode

the problem maybe solved by removing
all USB drivers from Device Manager, rebooting and letting them
reinstall.
In safemode:
Go into Device Manager and expand the "Universal Serial Bus Controllers" group.
Uninstall every device listed under this group (right click on
device, left click uninstall)
Be sure all USB devices are unplugged!! *THIS IS KEY*
Restart Computer







0
 
LVL 88

Expert Comment

by:rindi
ID: 16883504
Why don't you run hijackthis? It shows what is loaded and running, and possibly it'll allow us to find out which driver is loading your virtual disk.
0
 
LVL 15

Expert Comment

by:f-king
ID: 16883968
hi I think that you should reformat your PC and start again ,could be some file corruption somewhere and reinstalling will fix that problem.
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16965130
Thank you everyone so much for your comments so far (I'm really sorry i have let this one run so long too).

Merte, I think you might be the most on track here

What I see in windows Explorer under My Computer:

3½ Floppy (A:)
Local Disc (C:)
SHAREDFAT32 (D:)
MAXTOR1 (E:)
WINXP (F:)
WINDOWS98 (G:)
CD-RW Drive (H:)
MAXTOR2 (I:)
TEMPXP (J:)
DVD Drive (K:)
backup drive 1 (L:)
CD Drive (Z:)

The Z drive is the one that should not be there.  The H and K drives are my cd burner and my dvd drive (respectively).  Currently I have my external usb hard drive plugged in (L:) but this does not show up when it is disconnected).  All the other drive letters are either fat32 or ntfs partitions on 4 internal hard drives.

Since this is long enough I will post the mountvol results in a second
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16965131
Possible values for VolumeName along with current mount points are:

    \\?\Volume{7344833a-73b2-11da-85ee-806d6172696f}\
        G:\

    \\?\Volume{73448338-73b2-11da-85ee-806d6172696f}\
        C:\

    \\?\Volume{7344833b-73b2-11da-85ee-806d6172696f}\
        F:\

    \\?\Volume{94476790-771f-11da-b562-806d6172696f}\
        D:\

    \\?\Volume{94476791-771f-11da-b562-806d6172696f}\
        I:\

    \\?\Volume{94476792-771f-11da-b562-806d6172696f}\
        J:\

    \\?\Volume{f2edfd42-73f3-11da-92ff-806d6172696f}\
        E:\

    \\?\Volume{94476793-771f-11da-b562-806d6172696f}\
        K:\

    \\?\Volume{3a3bd0be-744b-11da-a825-806d6172696f}\
        H:\

    \\?\Volume{73448336-73b2-11da-85ee-806d6172696f}\
        A:\

    \\?\Volume{53cc0da0-7411-11da-9302-00508def1b99}\
        L:\
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16965148
results of "mountvol z: /l" are (as expected)

"Incorrect function."
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16965199
0
 
LVL 15

Author Comment

by:dave4dl
ID: 16965272
FYI, some of the pages I've found when searching for this problem talk about dosbox.  I have looked at this program (DOSBox) before and I may have installed it.  It is currently NOT installed but maybe it left some remnants (if I did install it).

0
 
LVL 88

Expert Comment

by:rindi
ID: 16966226
These below I'm not sure what they are and probably they aren't necessary. You could try remove them with hijackthis. Hijack makes a backup so you can return them again if something stops working. After removal, reboot and then retry:

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.razerzone.com/diamondbackdriver.html
O4 - HKLM\..\Run: [ABIT uGuru] F:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [razer] F:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [Profiler] F:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] F:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [SaiMfd] F:\Program Files\Saitek\Software\SaiMfd.exe


These here won't have anything to do with the actual problem, but they all are useless (in my point of view) and can be removed:

O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - F:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - F:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe


This one I don't know what it is, so I'd remove it and test:

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - F:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
0
 
LVL 70

Accepted Solution

by:
Merete earned 1600 total points
ID: 16966307
Hi dave4dl.
what is this SHAREDFAT32 (D:) <<, just wondering if this is split partition may have created that extra one but because you have used most of the assigned letters it chucked it at the bottom?
Windows xp does that .
You may want all the drives in order but as you have so many one may have been pushed out of the order or descent lol, and that may have slipped your memeory then what it can be. It could be an old USB or flash drive not removed using teh safely remove.
You could try assiging something to the drive.

 sit down and think about every drive you have every partition you have. Draw it on paper.
Look at these hardware and where they sit on the ide cables
Man your computer must be a mass of ide cables ehehe.

I think you have what is called a phanton drive Letter maybe related if there are any networked mapped drives involved.
It is not just USB drives. Mounting an encrypted Truecrypt volume and then dismounting it also leaves a phantom drive letter behind.
From what I have looked at it is possbly caused from a MS upadte gone wrong. A program windows detected before intsalling and auto assigned a drive letter
One suggestion is to run a USB fix.

here some others talking about this phantom drives to put you in a picture.
Eliminating Phantom Floppy Disk Drives under Windows 95/98/Me
http://www.microsoft.com/whdc/archive/PhantomDrv.mspx

 Unwanted phantom drive
http://www.pcanswers.co.uk/tips/default.asp?pagetypeid=2&articleid=37628&subsectionid=616

http://forums.techguy.org/hardware/467043-problems-phantom-drive-letters.html
http://www.infopackets.com/channels/en/windows/gazette/2003/20030923_change_drive_letter_assignment.htm
http://www.annoyances.org/exec/forum/win98/t1025591114

another idea is to use JDiskReport
graphical disk space analyzer
JDiskReport is a disk analysis utility, that allows you to view disk space usage with the help of graphical, interactive pie charts. It allows you to quickly find the largest, oldest or newest files and gather statistics about file sizes and types for each drive. You can choose between different graphical charts or text reports
http://www.snapfiles.com/get/jdiskreport.html

There you go at least now you should have some understanding about it.
Cheers Merete

0
 
LVL 15

Author Comment

by:dave4dl
ID: 17102482
Sorry for leaving this one open for so long.  I really appreciate you guys helping me with this.

I have not solved my problem but there were a lot of good ideas here.

Rindi, i have disabled all the apps that startup in the startup tab in msconfig and the problem still occurs so it is not one of those few processes you noted (and i know which app each one belongs to and none are malicious).

Merete, you were right IDing the problem as a phantom drive issue.  I will continue to search for the answer to the problem and if i ever find it i will post back here.

One other data point that i guess i never posted (I could swear i had posted a reply to Merete's last post but i guess not) is that the drive is not there in safe mode but remains when in regular mode.

Thanks guys!
0
 
LVL 15

Author Comment

by:dave4dl
ID: 17102535
btw Merete,
My case is a bit tangled with ide cables but it isnt too bad because two of the drives are SATA and i only have 2 regular ide hard drives (plus 2 cd/dvd drives).  I just have multiple partitions on some of the drives.

Thanks for your help!
0
 
LVL 70

Expert Comment

by:Merete
ID: 17104151
lol great stuff dave4dl and thank you for the points.
 If you could see my 3 computers networked together wires running all over the house to the tv to cable satelite dont ya just love it. I cant handle the idea of wireless just yet.
I was thinking of going into cabnet making, they just dont seem to sell computer cabnets that suit our needs :p
Yep I think the phantom drive is the only thing that can describe your situation.
Confirmed by the fact it doesnt appear in safemode.
Running a windows update may solve it.
http://forums.techguy.org/hardware/467043-problems-phantom-drive-letters-3.html

Regards Merete

0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
I have written articles previously comparing SARDU and YUMI.  I also included a couple of lines about Easy2boot (easy2boot.com).  I have now been using, and enjoying easy2boot as my sole multiboot utility for some years and realize that it deserves …
The viewer will learn how to dynamically set the form action using jQuery.
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question