Link to home
Start Free TrialLog in
Avatar of dkozakoff
dkozakoff

asked on

CD/DVD not accessible.

My operating system is WinXP SP2 on an eMachine T2885 model D845GVSR

I sudddenly cannot access my CD-RW drive (D:), my DVD/CD-ROM drive (E:), or a Daemon emulated CD  on my HD drive (I:), nor can I connect my digital camera via USB drive (J:). The problem is intermitant, sometimes I boot up and everything works fine. However, I haven't been able to identify a causitive factor. In Safemode all the drives are accessible. A couple of times, after booting in Safemode and rebooting in  Normal mode, the CD/DVD were accessible, but this doesn't happen every time.

The laser lenses are clean.
The CD-RW and DVD have power, the drawers open and close from the front button, the lights blink when a CD is inserted.The drive icons appear normal in the My Computer display. The CD/DVD icons change when a CD is inserted in the drive drawer. When I try to open the CD/DVD  devices, with an audio or data CD in the drive, I either get a blank screen or the message "Not accessible. Access denied.". The program which needs access to the emulated CD will not run because it can't find the data CD. If I right click on the drive in My Computer and click on 'Eject' for the CD/DVD drives nothing happens.

As an experiment, I tried to change the CD/DVD icons and got the message "The name ('D:\' or 'E:\') specified in the Target box is not valid."
The Device Manager indicates all DVD/CD-ROM drives are working properly.
I tried uninstalling the CD/DVD drives listed in Device Manager and rebooted with no effect.
I have done a System Restore to a point a week back with no effect.
I have scanned for malware and viruses and the system is clean.
I ran the System File Checker.
I have uninstalled the Daemon CD emulator and downloaded and installed the newest version with no success.
I have tried the suggested Registry edit in MS Knowledge Base article 314060; i.e., deleteing the "Upperfilters" and "Lowerfilters" entries in
"HKEY_LOCAL_MACHINE>SYSTEM > CurrentControlSet > Control > Class>{4D36E965-E325-11CE-BFC1-08002BE10318}" in the Registry.
Opening ComputerManagement>Storage>Disk Management display shows only my Hard Drives and Partitions, C:, G:, F:, K:, and H:. I don't know whether the CD/DVD drives, the CD emulated drive, and the USB (when the camera is connected) should also be displayed.
I have a copy of Everest Home Edition which extracts system storage info. The D:, E:, I:, and J: drives are all listed and nothing appears unusual.
System Info (MsInfo.exe) under Components>Multimedia>CD-ROM appears normal -- but I may not know what to look for.

Since the problem affects 4 devices, it is something common to 2 HW devices, the USB, and the software CD emulator. The system acts as if the logical drives D:\, E:\, I:\, and J:\ associations are not recognized. This suggests a software problem rather than a HW problem, something like a corrupted association between logical drive letters and the devices.

What else can I try to do to identify and fix the problem?
Avatar of iCoreKC
iCoreKC
Flag of United States of America image

Check you System Event Log for hints.

You may have some kind of Malware activity going on.  Run your Adaware and Spybot and perhaps even the MS Defender.  Make sure you run these in Safe Mode.

When did it begin?  What was the last change that you did before the issue began?  You may be able to use the System Restore to go back to a time when everything worked.



Avatar of ☠ MASQ ☠
☠ MASQ ☠

Installed any games lately?
Avatar of dkozakoff

ASKER

As my initial post indicated I have checked for malware and done a System Restore. I checked again and Restored to an even earlier date - no success. I also have logged in as another User,. Still no CD/DVD. However, I can boot the system with boot CD.

I don't play games. The only SW I have downloaded lately was the defragger JvDefrag for comparison to Diskeeper Lite.

By System Event Log, do you mean the Event Viewer reached via CONTROL PANEL>ADMINISTRATIVE TOOLS>EVENT VIEWER?
I do not know how to interpret what I see there. I do see things labelled 'ERROR' or 'WARNING' but I can't tell they are associated with my CD/DVD problem. For example, under EVENT VIEWER>APPLICATION I found:

Event Type:      Error
Event Source:      SecurityCenter
Event Category:      None
Event ID:                       1802
Date:            8/6/2007
Time:            11:27:34 AM
User:            N/A
Computer:      YOUR-GURG0DYWDC
Description:
The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus and Firewall.
Data: 0000: 02 40 00 80               .@.€    ,

and under EVENT VIEWER>SYSTEM I found:

Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:                        7000
Date:            8/6/2007
Time:            11:40:43 AM
User:            N/A
Computer:      YOUR-GURG0DYWDC
Description:
The McNASvc service failed to start due to the following error:
The system cannot find the path specified.



The service query for this "sc query McNASvc" returns:

SERVICE_NAME: McNASvc
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED   (NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 3  (0x3)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

another error was:

Event Type:      Error
Event Source:      DCOM
Event Category:      None
Event ID:                        10005
Date:            8/6/2007
Time:            11:40:42 AM
User:            NT AUTHORITY\SYSTEM
Computer:      YOUR-GURG0DYWDC
Description:
DCOM got error "The system cannot find the path specified. " attempting to start the service McNASvc with arguments "" in order to run the server:
{24F616A1-B755-4053-8018-C3425DC8B68A}
 
Anything in the above that is suggestive of a solution to my CD/DVD problem?
As a "sanity" check, boot from a Knoppix CD and see if all your drives/USB devices behave properly. That will differentiate between hardware and OS problems.

http://www.knopper.net/knoppix/index-en.html
Nothing in event log pertaining to problem.

One additional thought. Run msconfig -- disable all startup items and all non MS services. Will determine whether software such as McAfee or a utility is causing the problem
NOBUS:
xp_cd_dvd_fix is said to be based on CDGONE, so I assume that it is an executable version of the CDGONE.REG file. This deletes the "Upperfilters" and "Lowerfilters" entries I have already tried. But I will try your suggestion.
WILLCOMP:
To boot from a Knoppix CD, I have to download the files and burn them to a CD which I can't do -- I would have to find a alternate way to get this boot CD. Aa I mentioned in my second post, I can boot off a CD. I used the PEBuilder 'Ultimate Boot CD (ver 3.1.1.10a). I can also boot in Safemode and get access to the CD/DVD.
I will try disabling the startups (particularly the McAfee programs) to see if that has any effect.
Since everything works in safe mode (assume USB devices do as well), appears software related.
Just a thought, the upper/lower filters problem clearly isn't the issue and the is no copy protection software like Starforce onboard. However the optical drives which seem fine when the PC is booting appear to be disabled once the OS is running.

Could this be a rootkit? It's reminiscent of what was happening with the Sony Music CD problem where PC owners found their optical drives disabled.
ok we seem to all agree its a software issue.   Lets start eliminating some software.

for testing purposes   do the following and report results please.

run Msconfig    ( start--> run --> type msconfig  press OK)
goto the last tab  (startup)
disable all  (yes i am aware this may disable your virtual optical drive)
press the services tab
put a check mark in the box that says hide all microsoft services
disable all the other services.  
press apply
press ok
you will be prompted to reboot
please do and check the optical drive and the usb camera.  (i'm pretty sure the virtual drive will be gone so we cant test that this reboot.)
if everything works fine   then we have narrowed it down to a start up  service or startup program thats blocking access.
add back the service  relating to the virtual drive and any start up program related to the virtual drive (if you have problem identifying which goes with it  post a list of the services disabled and the programs disabled and tell me what the name of the virtual drive software is and i'll point the needed entry's out)
reboot  and test again for proper functinality on all opticals and virtuals and usb
if all works well again   add back the anti virus / firewall /internet security software      services and startups
reboot  and check again
then slowly turn everything back on 2 or 3 at a time until you identify what program or service is causing the issue.

if it doesn't work fine  i'll think of something else but we need to start somewhere.
Based on one of the event errors

The McNASvc service failed to start due to the following error:
The system cannot find the path specified.

I suspect a bad McAfee Install.

I would uninstall and also get a Mcafee cleaner.

I hope this helps !
Tried xp_cd_dvd_fix -- no change.
Disabling all startup items and rebooting -- still no CD/DVD.
I uninstalled McAfee and rebooted and the CD worked; but after a second reboot it did not. I reinstalled McAfee in Safemode, rebooted -- CD/DVD still not working.
 
SysExpert:  What do you mean by a McAfee 'Cleaner'??

However, disabling all startup items  and all non MS services and rebooting does restore the CD, DVD, and USB operation.

I don't see anything among the Services that seems to pertain to the virtual drive, but the Daemon emulator appears among the startups.
I would like to provide a list of the services and startups disabled for examination but don't know how to cut and paste from the System Configuration Utility Window.

If I now re-enable these services and startups 2 or 3 at a time, does it matter which ones are re-enabled and in what order? That is, can I re-enable just the startups first? And, since there are many McAfee connected programs, do any of them have to be enabled as a group?  
McAfee has several services and startup items that must be enabled. Most have names indicating they are part of Mcafee. There are probably other programs which have multiple entries.

You can take screen shots of msconfig windows by pressing Alt + Print Scrn to copy to clipboard and then paste into document or Paint file. File can be uploaded to EE Stuff where we can take a look at it.

http://www.ee-stuff.com/accessLogin.php?returnURL=%2FExpert%2FUpload%2Fupload.php
Some of them will need to be done together.   for example all the mcaffee stuff will need to be done together or it will error out.  so i usually group them by program  but its not always easy to figure out which goes with which.  Since it was a service that restored it  you should be able to do all of the startup programs just be aware that the errors you receive on starting up will be related to some services that are currently disabled
I have copied and uploaded the MSCONFIG list of non-MS Services and, for good measure, the list of Startups. Links to the .jpg file are:
https://filedb.experts-exchange.com/incoming/ee-stuff/4295-MSCONFIG-SERVICES---STARTUPS-LI.jpg 
and
https://filedb.experts-exchange.com/incoming/ee-stuff/4295-MSCONFIG-SERVICES---STARTUPS-LI.jpg .

I will re-enable all the Startups and await any observations you may have regarding the Services and Startups. In the meantime, I'll be re-enabling small groups of the Services to see if I can localize the problem to one (?? Is it possible for it to be more than one or to be a combination of two or more working together??).
Do not enable any McAfee items in startup list.

Any reason for having NetZero installed?
I switched from NetZero a few months back. I maintain a free account to access any any residual email.

I re-enabled all the Startup items that were originally enabled -- including the McAfee programs. The CD, DVD, USB, and virtual CD all work. At least they do after one boot. I see if that continues to be the case after a reboot.
 
I haven't begun to try to narrow the problem down to one Service. Any advice about how to proceed, i.e., which Services to try first? Should I disable the McAfee Startups before doing the Services?
Nope. Enable all the McAfee services and see what happens. That's most of the non-MS services.

If all is OK, enable the rest, 1 or 2 at a time until you find the problem.
the first service that is all numbers  has to go (any service that looks that random in name and refuses to list manufacturer  is rarely a good service)
also i suspect the  diskeeper service is the actual problem
This is the list of my non-MS services. The ones preceded by a 1 were re-enabled in the first round. My CD/DVD/UBS/Virtual CD worked OK; however, my printer is not recognized. The four services preceded by 22 were enabled in the 2nd round. Again all the devices worked OK and the printer still is not found. However, a connection to the Internet could not be made. I disabled the four in order to send this post.

The first service looks like it might be used for McAfee installation cleanup. Does something like that need to be permanently installed?

        0063382270620489mcinstcleanup                                     Unknown
        AOL Connectivity Service                                                           Unknown
        AdminWorks Agent X6                                                                OSA Technologies
1      Brother Popup Suspend service for Resource manager          Unknown
1      BrSplService                                                                           Brother Industries Ltd
        C-DillaCdaC22BA                                                                   Macrovision
22    Diskeeper                                                                               Unknown
1      McAfee E-maiI Proxy                                                             McAfee, linc.
22    Fax                                                                                           Unknown
22    Google Updater Service                                                        Unknown
        LexBce Service                                                                       Lexmark, International
        MBackMonitor
1      McAfee HackerWatch Service                                              Unknown
1      McAfee Update Manager                                                         McAfee, Inc.
1      McAfee Services                                                                    McAfee, Inc.
1      McAfee Network Agent                                                          Unknown
1      McAfee Scanner                                                                     McAfee, Inc.
1      McAfee Protecton Manager                                                   McAfee, Inc.
1      McAfee Proxy Service                                                            McAfee, Inc.
1      McAfee Redirector Service                                                    McAfee, Inc.
1      McAfee ReaI-time Scanner                                                    McAfee, Inc.
1      McAfee SystemGuards                                                          McAfee, Inc.
1      McAfee Personal Firewall Servlce                                         Unknown
1      McAfee PrIvacy Service                                                         McAfee, Inc.
1      McAfee SpamKiller Service                                                   Unknown
        Intel NCS NetService                                                              Unknown
        Spyware Doctor Auxiliary Service                                          PC Tools
1      Spyware Doctor Service                                                         PC Tools
22    SiteAdvisor Service                                                                McAfee, Inc.
        Cryptainer service                                                                   Cypherix
        Messenger Sharing Folders USN Journal Reader service  Unknown
1      Windows Defender                                                                 Unknown
 
Printer is dependent on LexBce service -- go ahead and enable it

I would suspect either Google updater service or SiteAdvisor Service prevented internet connection.

Re: McAfee cleanup service -- I wouldn't think so, but am not positive.
Macrovision/SafeCast's C-Dilla is almost certainly the culprit, it's a copy protection device installed almost by stealth onto your machine and diables optical drives capable of writing and emulators.
I would use Hijackthis to determine what is malware. see the info below:

malware - Leetutor list
Have you tried running virus scans and spyware scans  This could be a problem with viruses/trojans/spyware or other malware. Some free online virus scanners:

http://housecall.antivirus.com 

http://www.pcpitstop.com/antivirus/default.asp

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Also try these free programs to rid your system of spyware, trojans, and other malware:

http://download.com.com/3000-2144-10194058.html?tag=lst-0-1
Spybot - Search & Destroy

http://download.com.com/3000-2094-10045910.html?legacy=cnet
LavaSoft Ad-aware  

I use BOTH of the above programs on my 3 Windows systems; what one program misses, the other catches.  Also make sure to download the most up-to-date data before you run the programs.

Another very good freeware program for ridding yourself of spyware is this:

http://www.superantispyware.com/
SuperAntiSpyware

You might also try this free program (HijackThis) -- install it in its own folder, don't download to your Desktop:

http://www.spychecker.com/download/download_hijackthis.html

HijackThis is a tool that is for advanced users, because it lists all the installed browser add-on and startup items, allowing you to inspect them and then optionally remove any ones you select.  You must be careful in choosing what to remove, although the program can create a backup of your original settings.  But put a check mark to fix any home page or search page setting that HijackThis detects which you have not entered yourself.  The program has an option to download online updates of the hijack data.

You should first post the log at this site:  

http://www.hijackthis.de/index.php?langselect=english

and it will be automatically analyzed for you (after you click on the button labeled "Analyze" near the bottom of the page), telling you which entries (called "Nasty") should be fixed.  You will also be told if you have any items that are "Possibly Nasty", or "Unnecessary", or "Unknown". If you don't know what to do about these, you might find something on the module name by doing a Google search of the internet.

If you have any questions about what it is asking you to fix that you would like the E-E experts to comment on, then do this:  right above the Analyze button you will see this message: "The following analyses has been stored temporarily", and there will be a link where the analysis file will be saved (for a period of three days). Click on it and then copy the link of that page from the address bar of your browser and paste it here, and experts can check it for you.  (Please DON'T post the entire log itself in your question.)

In case you would like to learn more yourself how to use HijackThis, here are a couple of urls:

http://www.tomcoyote.org/hjt/
HijackThis Quick Start


http://www.spywareinfo.com/~merijn/htlogtutorial.html
HijackThis log tutorial

--------------------
I hope this helps !
WILLCOMP:
As you said, the printer returned when LexBce service was enabled. However, enabling    Google updater or SiteAdvisor Service did not interfer with internet connection. Diskeeper or FAX services might be responsible since I didn't re-enable them.
MASQUERAID:
I'll try the Macrovision/SafeCast's C-Dilla next. However I don't understand what purpose would be served by it disabling optical drives capable of writing and emulators.
SYSEXPERT:
You must have gleaned from my initial post that I had tried most of the things you suggested. While I know of HijackThis, and have it on my system, I have been to lazy, to delve into it enough to become proficient in it's use. Maybe, I'll look at it again. As far as browser add-ons go, I have most of those diabled since the were one or more of them were drastically slowing down the opening of any new browser windows.

Well, at laest you're narrowing it down. Pretty much trial and error at this point.
And tedious. Enablng Macrovision/SafeCast's C-Dilla caused no problems.
The culprit Service appears to be AdminWorks Agent X6 (awServ.exe), produced by OSA Technologies, an Avocent company. It is described as an Intel(R) Desktop Utility, v2.1 -- "a collection of system monitoring and maintenance tools." It was downloaded more than a year ago and hasn't been used since. I wonder why it went berserk.

I have this Service disabled. The CD/DVD,s etc work. But their icons have changed -- they have what looks like a red circle with a diameter line through it at 45 degrees; i.e., the 'forbidden' symbol. But they all work normally.

I would like to remove Intel(R) Desktop Utility but it won't go away vis Control Panel> Add/Remove. I would also like to remove it from the Services list.
You can do a brute force uninstall -- delete program files and folders and run a registry cleaner to remove registry items. However; if not done properly, can create more problems than it solves.

As long as service is disabled, shouldn't pose a problem.
That service  likely relates to your chipset drivers or your network card drivers.  Since its affecting your drive's  i would assume its your chipset drivers which is why they are hard to uninstall.  I would actually reinstall the latest version of your chipset drivers to return icon's to their proper format and it will also fix the wonky service.
ASKER CERTIFIED SOLUTION
Avatar of willcomp
willcomp
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The 'forbidden' icons originate in culprit Service/program folder. They are named FloppyDiskLocked.ico, OpticalDriveLocked.ico,  and RemovableDriveLocked.ico -- implying that in its operation this Service may, on occasion, lock the drives.

The Intel(R) Desktop Utilities program is described as a collection of system monitoring and maintenance tools.  It includes a hardware monitor that checks sensors on the Intel(R) desktop board and alerts if the sensors go outside of their recommended ranges. This product is only qualified to run on a specific Intel desktop board and specific heatsink/fan combinations. So the program seems to be chipset specific but is installed separately from the chipset drivers.

In any case, I was thinking of doing a 'brute force' program removal. If this creates a problem, you guys are available to hold my hand and walk me through a fix -- right?

My current problem appears to be fixed. Thanks for all the help. I learned some new stuff and maybe you experts did too.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial