Solved

USB Removable storage devices "Access denied"

Posted on 2011-02-28
50
1,609 Views
Last Modified: 2012-08-13
I am having the same problem as the author in this thread http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_24192838.html#notices and I am not computer savvy. My USB devices are acknowledged, but when I try to open them I get "Access denied." In the expert's accepted solution, he states it's probably the Device Wall Control as the culprit. I don't know what that is, how to uninstall the software and reinstall it. I'm sure my current installation has been corrupted by a virus. My computer was redirected to a malicious site and after that I ran Malwarebytes. It showed one virus, which I removed and the next day, the first time trying to access the USB device after doing so, is when the access was denied. It worked prior to that, yet I have no clue why it wont work. I tried updating drivers, but it wont let me.

Can you help? I'm on XP Pro.
0
Comment
Question by:surcher
  • 25
  • 19
  • 3
  • +1
50 Comments
 
LVL 16

Expert Comment

by:sjklein42
ID: 35000480
What does it show in the System Event Log?
0
 

Author Comment

by:surcher
ID: 35001718
For Malwarebytes?
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35001885
Sorry, that's not what I meant.

When you try to open the USB device and get the error message "Access Denied", there may be a message put in the System Event Log.

First, make the "Access Denied" error appear.  Then, go into the Event Viewer to see if there are any new messages.

One way to start the Event Viewer is to "Start/Run"  and then put in "eventvwr" and click OK.

Look under the System and Application tabs to see if there were any new messages put in the log at the same time you got the USB "Access Denied" error.  These messages would be at the top.


It sounds like the virus that Malwarebytes found has some lingering side-effects.

What happens when you try to update the drivers?  You said it wouldn't let you.  Was there an error message?
0
 

Author Comment

by:surcher
ID: 35001911
It's been a while, but I think it was this one. It wont allow Malwarebytes to finish in regular mode. I have to go to safe mode to run it successfully.
Someone using my computer downloaded a virus and it has affected everything, although I did my best to remove everything. I can't get my browsers to stop redirecting when I do a search and click on a link, as well as tabs opening up to shop sites or sites saying my computer is infected and I need to click to scan for problems. That's the site she clicked yes to and began the virus download.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5694

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

2/6/2011 1:46:30 PM
mbam-log-2011-02-06 (13-46-30).txt

Scan type: Quick scan
Objects scanned: 168978
Time elapsed: 5 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35002019
The redirect problem sounds like your router is infected with the Google Redirect virus.

It can infect your router if you have not changed the default password. Once the router is infected you get redirects even if your PC is clean.

http://tidystorm.com/423/the-redirect-virus-was-in-my-router/

If this is the problem, reset your router (paperclip in the hole in the back) and see if the redirects go away.  Set a password RIGHT AWAY.
0
 

Author Comment

by:surcher
ID: 35002244
I now put it in, it makes the sound it's been found, the "safely remove hardware" icon pops up on the bottom right, yet, when I open "my Computer" it's not there. Here's what the log says.
Timeout (%1 milliseconds) waiting for a transaction response from the LockServ service.

I also tried downloading IE8, but each time it restarted and went to load it, when it got to "finish" the computer shut down and restarted. The log says this;
The following boot-start or system-start driver(s) failed to load: Lbd
0
 

Author Comment

by:surcher
ID: 35002358
"The redirect problem sounds like your router is infected with the Google Redirect virus.

It can infect your router if you have not changed the default password. Once the router is infected you get redirects even if your PC is clean.

http://tidystorm.com/423/the-redirect-virus-was-in-my-router/

If this is the problem, reset your router (paperclip in the hole in the back) and see if the redirects go away.  Set a password RIGHT AWAY. "


I'm a quadriplegic and can't physically do this myself. I was in bed when I had a friend replace my old router that died. The redirects began on it. I have a Linksys 5. He did not put a password on it when he put it on as I asked, because it didn't offer a way. Should I put in the cd it came with to find out how, when I get someone to help?
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35002409
Hi.

Yes, those are the interesting messages in the Event Log.

Did you see my note about the Google Redirector virus having possibly infected your router?  As long as the router is infected, your PC will keep getting re-infected.   If your searches are still going off to bad places, then you need to reset your router and set a password on it.

Let's go back to your original question, where you mentioned the "Device Wall Control".

The way to find out if you have that software installed is to go to the Start menu and pick "Set Program Access And Defaults".  This is the same as the "Add or Remove Program" control panel.  Get to it either way.

Once there, pick the top-left choice:  "Change or Remove Programs"

After a little while (it always takes longer than it seems it should), a list of software installed on your computer will appear.  Scroll down the list and look for anything from Endpoint Securities that has a name like "Device Wall Control".  If you find it, the suggestion was that you "Remove" it.  You'll probably have to reboot after removing it.  I don't know anything about the "Device Wall Control" software in particular - these are the general rules to remove any program.

You may be surprised what you see in the Add/Remove Programs list if you haven't checked it before.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35002486
Understood.  Just keep this thread open as long as you need to.

It would be best if the person who set up this router for you originally is able to help you reset it.  He may need to do the wireless settings on the router over again - if you are using wireless, that is.

Please don't use the CD that came with the router - you can set the password without using the CD, and the CD may install stuff on your PC that is unnecessary.

After resetting the router with the paperclip (some of them have a small button on the back), you can set the password this way:

1) Open your Internet Explorer program or any other web browser.

2) In the Address Box at the top of the browser window, type  http://192.168.1.1  and then click on Go, or press the Enter key on the keyboard. A window should appear in the center of the screen asking for your User Name and Password.

*** IF THIS USERNAME/PASSWORD WINDOW DOES NOT APPEAR THEN WE NEED TO TAKE ANOTHER APPROACH ***

3) Leave the User Name box blank. Type admin in the Password box, then click on OK, or press the Enter key on the keyboard.

You should now see the Router's setup page.

Note: To change the password from admin to a more secure password:

1) Click on the Administration tab when the Linksys Wireless Router Setup page appears.

2) Type the password you want in the Password: box next to Local Router Access.

3) Click on Save Settings.

4) Be sure you remember or write down this password

http://www.ezinstructions.com/wrt54gsetup.html
0
 

Author Comment

by:surcher
ID: 35002491
I've used Add/Remove many times, however, for some reason it's not coming up. I opened Control Panel and double clicked on it. Nothing. I have to roll to the store, but I'll restart and try again when I return. I'll let you know within an hour, if you're there.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35002598
Sounds like the virus managed to deactivate the Add/Remove program control panel.  This is the kind of thing they do.   I am not sure I can help you patch it up.  The virus seems to have mucked up the software on your PC to the point that you'll need to have Windows reinstalled.  I know if it was my PC, that's that I would do.

I know this sounds pretty drastic.  It usually isn't that bad, but not a do-it-yourself job unless you've done it before.

If you would like to see if anyone else in ExpertsExchange has a better idea, please feel free to make a "Request for Attention" to attract some other opinions.
0
 

Author Comment

by:surcher
ID: 35003170
After restarting it the USB drive appeared in my computer. When I tried to open it, here's what it said:
F:\ is not accessible.
Access denied.
0
 

Author Comment

by:surcher
ID: 35003177
The add/remove now opens, but nothing appears.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35003412
Thank you for the update.  An empty Add/Remove program list is another result of the virus.  It will not be easy to fix without reinstalling Windows.
0
 

Author Comment

by:surcher
ID: 35010798
It finally filled in, it just took a few minutes.
0
 

Author Comment

by:surcher
ID: 35010817
After restarting it the USB drive appeared in my computer. When I tried to open it, here's what it said:
F:\ is not accessible.
Access denied.

Nothing was in the Event Viewer.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35011137
Yes, the Add/Remove Programs list always takes longer than it should to come up.  ;)

We should test if the USB drive is ok.  Have you tried plugging the USB drive into another computer yet?
0
 

Author Comment

by:surcher
ID: 35012803
Yes, three different ones and they work fine. It also can transfer in safe mode.
0
 

Author Comment

by:surcher
ID: 35012814
That's why I attached the link from the other guy. It seems he had the same problem, minus the virus.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35013095
If you didn't see "Device Wall Control" in  your Add Remove programs, then it isn't the same problem the other guy was having.

Next theory is that the USB drive got infected by the virus, too.

Try this.

Plug in the USB drive and ignore/close any errors you get.  Remember what letter the USB drive got (like F:)

From the Start menu:

Start/Run...  
then type "CMD" in the field and click OK

A black command window should open up.  (Sometime a virus will disable the command window - we'll see.)

If it opens the command window OK, type these two lines, substituting the USB letter instead of "F"

cd F:
del autorun.inf

Open in new window


Let me know what it says when you do this.

Then unplug the USB drive from the PC and plug it back in again.

If we're lucky, you'll be able to open it with Windows Explorer once again.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35023032
Hi.  I've still been thinking about your system.

Following up on my previous note that discussed the possibility that the external hard drive itself might be infected...

Is it just that one particular external hard drive (?) you are having trouble accessing?  Do we know?

If you haven't already done so, it would be interesting to see if you can use some other USB drive (hard drive or thumb drive) successfully.   That would help us know whether to focus on the drive or the PC (Windows).

While it would also be an interesting experiment, I suggest you don't try to plug your USB drive into anyone else's PC until we've figured out whether it has a virus or not.  If so, it could be spread by the autorun program and just plugging it into a system could give it a chance to spread.
0
 

Author Comment

by:surcher
ID: 35030593
Sorry, I was indisposed yesterday. As soon as I get someone here to put the USB drive in for me I'll see what happens. Thanks
0
 

Author Comment

by:surcher
ID: 35032375
It came up C:\Documents and Setting\Landon>

Do I hit "Enter" then type the two lines above? It's not just this one drive. I have three and only in safe mode can you transfer anything. They can't be opened otherwise. I get this:
F:\ is not accessible.
Access denied.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35033147
Thanks for the additional info.  I'll do some more digging and get back to you sometime tomorrow (Friday).
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 16

Expert Comment

by:sjklein42
ID: 35039268
I've run out of ideas.  Sorry.  No soup for me.  ;)

I suggest you re-ask the question and maybe get some new eyes on the problem.
0
 

Author Comment

by:surcher
ID: 35039690
Basically, you want me to start a new thread by reasking the question and adding all the info we discussed?  What happened with the "CMD"? You asked me to do this,

Start/Run...  
then type "CMD" in the field and click OK

A black command window should open up.  (Sometime a virus will disable the command window - we'll see.)

If it opens the command window OK, type these two lines, substituting the USB letter instead of "F"

1:
2:
 cd F:
del autorun.inf

Toggle HighlightingOpen in New WindowSelect All

Let me know what it says when you do this.

Then unplug the USB drive from the PC and plug it back in again.


Can it be done in safe mode? As I said before, I plugged in the USB then start/run CMD and it came up It came up C:\Documents and Setting\Landon>.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35040716
Hi.

I think there may be a way to make a Request For Attention to this question without having to ask it again.  I am not abandoning you.   I am just not sure I will be able to solve this problem by myself.

To the CMD window question:

Yes, you should be able to do this in SAFE mode.

You got the expected prompt ( C:\Documents and Setting\Landon> )

Then type the two lines as described above.  This will delete any autorun.inf file on the USB drive that may be preventing it from being mounted.

But since you are not able to mount any of your three USB drives, it is unlikely they are all three infected.  It seems like it must be a problem on the PC but I am at a loss.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35041359
Hi again.

One person fixed this problem on their PC by disabling the Threat Protection part of their anti-virus software.  We haven't talked about that.  Are you running any anti-virus software?  Are you able to disable it and then access the USB drive?

The fact you can get to the USB drive normally in SAFE mode (right?) is interesting.  Not sure what it means yet, but this is a good clue.

There are tons of other people out there with similar symptoms but no consistent solutions.


0
 

Author Comment

by:surcher
ID: 35041374
I'm running AVG free version, so I'm not sure I can do that. But yes, it does work in safe mode.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35041503
I went back over all your notes and saw again the Event Log message saying the the lockserv service had timed out.  Not having heard of the lockserv service, I looked it up and found that...

"lockserv.exe is a process from Security Service by Acer and part of eLock Management. This is a security utility that allows users to lock their removable data."

http://acer-elock-management.software.informer.com/

Turns out it doesn't work very well according to the reviews.

This could be the problem.

We need to get rid of it.

When you went into Add/Remove programs (after waiting forever for the list to fill in) was there anything that had a name that look like "Acer eLock Management Software Informer"?  If so, try to remove it.
 
0
 

Author Comment

by:surcher
ID: 35061611
I removed the Acer eLock Management and nothing happened. It's still the same. I'm going to do the "CMD" thing you suggested, but first wanted to be perfectly clear I'm doing it correctly. Here is you advice followed by my question.

To the CMD window question:

Yes, you should be able to do this in SAFE mode.

You got the expected prompt ( C:\Documents and Setting\Landon> )

Then type the two lines as described above.  This will delete any autorun.inf file on the USB drive that may be preventing it from being mounted.

But since you are not able to mount any of your three USB drives, it is unlikely they are all three infected.  It seems like it must be a problem on the PC but I am at a loss.

Do I type directly after Landon> or do I hit return and then type each line like the following?
1. cd F:
2. del autorun.inf
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35061928

Hi surcher,  welcome back.

Don't bother with the CMD exercise - we pretty much ruled that out when you indicated that several USB drives were not working, not just one.

I think we're onto something with the Acer eLock software.  Here's a guy who went through some fairly elaborate steps but got his drives working again.

http://thomasyl7075.wordpress.com/2008/04/02/access-denied-on-removable-storage-in-acer-vista-pc/

His final answer was to download version 1.7 of the Acer eLock program from here:

http://acer-elock.software.informer.com/1.7/

He says to install it and then use it to lock and then unlock the USB drive.  He said this reset the Access Denied error for him on that drive.  He then did it to each of his USB drives.

Once they are all unlocked you could either leave the eLock program installed or remove it.

Sounds like it has a chance.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35062100
I found a copy of eLock V1.7 and put it in my kits folder on the web.  You can get it here:

http://www.sjklein.com/kits/elock_1.7.6.17.zip

Open in new window

0
 

Author Comment

by:surcher
ID: 35075080
I tried to install the eLock, but it wont install. I keep getting a box stating "Please install Acer Empowering Technology first" I thought that was already on my computer.
0
 

Author Comment

by:surcher
ID: 35075109
Actually, it's "Acer Empowering Technology framework."
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35075188
Here's a link to the  "Acer Empowering Technology framework." download:

ftp://ftp.support.acer-euro.com/notebook/empowering_technology/utility/tm3300/Empowering_2.1.20.40.zip

It came from this page:

http://support.acer-euro.com/empowering_technology/utility.html

Good luck!
0
 

Author Comment

by:surcher
ID: 35075459
I have it and opened it. If I download it again will it erase the eRocovery I last saved? It's been a few years, but if I decide to use the recovery to revert back to that to try to fix these problems as a last resort before reinstalling XP, I want to be sure it will be there. Yes, I'm aware I'll lose a lot doing that, but I'll lose everything the other way.
0
 
LVL 16

Expert Comment

by:sjklein42
ID: 35075788
Re- Installing the eLock stuff is not a sure thing.  You know as much about it as I do, or more.

Just to throw out another approach:

Have you gotten all the data you need off the USB drives already?  Tried hooking them to another PC?  If you're able to read them using another PC, copy off all the data and  then reformat and copy the data back, maybe that would unlock them.

I don't know anything about eRecovery.  Is this another Acer program?
0
 

Author Comment

by:surcher
ID: 35087173
ERecovery is like system restore, except you copy the data on the computer at a point in time and save it. This way you can revert back to the time you copied and everything done, added and saved to that point you keep, instead of a full system restore, which wipes out everything.
0
 

Author Comment

by:surcher
ID: 35087199
It's not so much getting things off the USB as it is getting things off the computer. I'd hate to have to resrt to burning cd's.
0
 

Author Comment

by:surcher
ID: 35117639
Actually, I don't know about elock and since removing it I can't reinstall it. I will have to ask Acer if reinstalling Acer Empowering Technology will remove my saved versions on eRecovery.

I have a question in case I do have to restore it. Will it revert back to that time or will whatever the virus may have hidden on my computer that AVG, Malwarebytes and Spybot could not remove, or has damaged, remain?

I don't know what to do to save the data I want to keep, since the flash drives are only 2G and I can only retrieve things in safe mode. I had a 16G but I believe it was formatted for Windows, because without my knowledge the MIT student put it in her Macbook to transfer movies and it went out of whack and now holds just over 2G.

I do have a self contained hard drive from my previous computer that connects via usb. I haven't tried to see if it still works. If it does, could I transfer MS Office files and photos to it like a storage device? Granted, it used Millenium, but I'm not transferring programs.

What's your opinion of using eRecovery or should I just try to save all I can and reinstall XP, something I don't have, nor know how to do?
0
 

Author Comment

by:surcher
ID: 35117658
It seems I have another unrelated problem. The Mic works on Yahoo messaging, but stopped working correctly on Skype about the same time as the USB problem. It could be totally unrelated, but if you have a suggestion on how to check it, I'd appreciate it. Thanks
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35117690
>>  If it does, could I transfer MS Office files and photos to it like a storage device? Granted, it used Millenium, but I'm not transferring programs.

For documents that is not a problem.  It will work very satisfactorily.

>>  because without my knowledge the MIT student put it in her Macbook to transfer movies and it went out of whack and now holds just over 2G.

She probably has formatted it as FAT32 as Mac doesn't support NTFS for writing purposes.  See http://guides.macrumors.com/Drives_and_Filesystems  Presuming there is nothing important on this it can be wiped and reformatted as NTFS.  That should give you back your capacity.

------------------------------------------------------

I'll presume you are looking at wiping and restoring.  Make sure you have all necessary serial numbers, address books, email accounts, application installs off this computer before you wipe.

For your USB devices try getting hold of a Linux boot CD such as either Knoppix http://www.knoppix.org/ or Ubuntu http://www.ubuntu.com/

Boot from CD and see whether it can access the USB devices and data within.  If it can then the data can be transferred back to hard disk but I'd do that after a reinstallation of your machine.



0
 

Author Comment

by:surcher
ID: 35152575
I'm not sure how to reformat it. It's a 16G flash drive I bought from Newegg and used it on my PC and laptop. I used it for movies. She put it in her Macbook, deleted most of the movies and when she tried to upload movies from her mac, it lost it's memory. It's a Diesel and I can't remember it's original format. Could simply putting it into the Mac and opening it change it's format?

I still can't get the USB to work on the Acer except in safe mode.
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35152900
>>  Could simply putting it into the Mac and opening it change it's format?

Probably not.  It probably couldn't recognise it and offered to format it for her and she accepted.

If Disk Manager can see the flash drive in Safe Mode see if you can format it there.

http://www.bleepingcomputer.com/tutorials/tutorial116.html
0
 

Author Comment

by:surcher
ID: 35160116
Thanks, I'll try that. I'm sure it can be done on my laptop. I'm a quadriplegic, so I have to wait until someone get's here to help my put in the usb.
0
 
LVL 47

Expert Comment

by:dbrunton
ID: 35358876
If the questioner doesn't come back I suggest a refund of points and PAQing this question.

The questions weren't completely solved but there is some interesting information in this thread.
0
 

Accepted Solution

by:
ee_auto earned 0 total points
ID: 35438996
Question PAQ'd and stored in the solution database.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
How to update Firmware and Bios in Dell Equalogic PS6000 Arrays and Hard Disks firmware update.
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now