On Mon, 7 Nov 2022 14:24:37 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 06/11/2022 18:55, jetjock wrote:
>>
>> On Sun, 06 Nov 2022 11:46:28 -0600, jetjock <jetjock@unkown.com>
>> wrote:
>>
>>> On Sat, 5 Nov 2022 17:06:10 +0000, Java Jive <java@evij.com.invalid>
>>> wrote:
>>>>
>>>> If a device that should work in Windows fails to work after
>>>> uninstallation and re-installation, then that often means one or other
>>>> or both of two things:
>>>> A ghost device
>>>> An incorrect driver, possibly a 'ghost' driver.
>>>>
>>>> [Big snip: refer to my original post if necessary]
>
>Before referring back to your following of my previous instructions
>snipped above, let me begin by making some other points beforehand, as
>it may save your time for me to cover things in this order ...
>
>First, briefly skimming back through the initial first replies, I didn't
>spot anyone - including, I'm sorry, myself - suggesting that you
>should do the obvious thing and look at the Event Viewer, which is the
>first thing that should have been done for an issue like this!
>
>A 1 <Rt-Click> 'My Computer'
> 2 Choose 'Manage'
> 3 In the console, choose, ie expand:
> Computer Management (local)
> System Tools
> Event Viewer
> Windows Logs
> 4 Click on 'System'
>
>There should be some warning or error messages relating to an issue like
>this. Warnings are an exclamation mark in a yellow triangle. Errors
>are an exclamation mark in a red circle. Can you see any errors or
>warnings related to the problem? If there are any of either seeming
>relevant, <double-click> them, click the Details tab, choose XML View,
>and copy and paste the entire message into a reply here.

The first time I plugged it in, this is what I got:

- <Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Disk" />
<EventID Qualifiers="49156">11</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2022-11-07T15:45:18.223414900Z" />
<EventRecordID>1650156</EventRecordID>
<Channel>System</Channel>
<Computer>MikesDesktop</Computer>
<Security />
</System>
- <EventData>
<Data>\Device\Harddisk4\DR4</Data>

<Binary>0E00800001000000000000000B0004C003010000000000000000000000082D000000000000000000C1DE480000000000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000402BC90F80FAFFFF00000000000000007042620E80FAFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
</EventData>
</Event>

Now when I plug it in, this is what I get:

- <Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-BitLocker-Driver"
Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
<EventID>24620</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
<EventRecordID>1650171</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="84" />
<Channel>System</Channel>
<Computer>MikesDesktop</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="ErrorCode">0x80000010</Data>
<Data Name="Volume" />
<Data Name="WritePhase">0x0</Data>
</EventData>
</Event>
>
>Secondly, I've been looking again at the properties pages you provided
>for us. I have a working EasyDisk USB storage stick in this W7 PC at
>the moment ...
>
>B 1 In Device Manager, I <rt-click> it and choose Properties
>
> 2 I select the Driver tab. I have ...
> Microsoft
> 21/06/2006
> 6.1.7601.19133
> Microsoft Windows
> ... and clicking Driver Details gives me ...
> disk.sys
> partmgr.sys
> ... both in %WinDir%\System32\Drivers.
>
>What do you have?

I have the same for the first part. Driver details gives me:

C:Windows\system32\drivers\UMDF\WpdFs.dll
C:\Windows\system32\Drivers\WUDFRd.sys
>
>Next I refer back to one of your messages in reply to Paul, wherein you
>included an extract from SetUpAPI.log:
>
> ServiceBinary=C:\Windows\system32\DRIVERS\WUDFRd.sys
>
>WTF? This is not a UDF (CD,DVD) device! This suggests to me that
>perhaps we have to find out why your Windows thinks you are inserting a
>CD or DVD?
>
>It might be worthwhile examining what has been installed under Control
>Panel, Programs and Features. Any drivers or software for CD/DVD drives
>there, particularly USB ones? If so, and that device is no longer in
>use, try uninstalling its software, rebooting, and trying to install the
>SanDisk again.
>
I uninstalled WinCDEmu but it didn't help. I didn't see anything else
that had been installed this year that would have had anything to do
with USB or Disk Drives.

>Now I will return to my previous post and the procedure that you were
>attempting to follow, but note that my post preceded some of the above,
>and consequently may by now be redundant, which is why in this reply I
>covered things in the order that I did ...
>
>>> I did a search for oem.inf files in the Windows INF folder. There were
>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>> .inf files in total in that folder. I neither have the time nor the
>>> inclination to inspect that many files for "SanDisk". Even if I found
>>> one, I wouldn't know a good one from an abnormal one.
>
>I agree that the Search GUI for Windows 7+ - I suspect actually Vista+
>but not having used that version of Windows I can't speak with authority
>about it - is nothing like as good as the 2k/XP versions, which
>enabled you to search within files as an option at the beginning of your
>search. However, you can still do so ...
>
>C 1 Locate the navigator tree on the LHS of an Explorer window on the
>'inf' folder
>
> 2 Press <F3>
>
> 3 Enter any search term, eg 'storage'
>
> 4 Once the search is complete, underneath the results on the RHS you
>get an icon labelled 'File Contents', click it.
>
>Besides 'SanDisk', I would try broader terms, such as 'storage', and,
>given the above, anything to do with UDF, CD, or DVD.
>
>>> I really appreciate your help here, but it is becoming apparent that
>>> this is way too complicated for someone like me to fix. I have a new
>>> Kingston, 64GB drive coming for $6! I'm 81 and the drive will only be
>>> used as an emergency boot drive, so I don't care if it might not last
>>> as long as a more expensive drive. Hopefully, it will never be used! I
>>> just hate to admit defeat, but sometimes the computer wins! :-)
>
>At what stage you give up is always up to you!
>
>> Just for the hell-of-it I tried plugging that drive into my wife's
>> computer. Same OS, Win 7 Ultimate, and the file manager found it
>> immediately. Even allowed me to change drive letter in disk manager.
>> Apparently the drive is fine; it's my computer that is the problem!
>> Any ideas on what could cause this?
>
>On both PCs:
>
>D 1 Run 'Task Manager', which is an option when you do <Ctrl-Alt-Del>
> 2 Click the Processes tab
> 3 Enable the option at the bottom 'Show processes from all users'
> 4 Click on the column heading 'Image name' to get alpha ordering.
>
>Compare the processes running on the two PCs, and tell us here of any
>*differences*, being careful to clarify which extra or missing processes
>relate to which PC.
>
>If none of the above or any other suggestions find the cause of the
>problem, then probably there will only remain the 'sledgehammer to crack
>a nut' approach, compare the two PCs on a file by file basis, but we'll
>only cross that bridge if and when we ever come to it.

On 07/11/2022 17:37, jetjock wrote:
>
> On Mon, 7 Nov 2022 14:24:37 +0000, Java Jive <java@evij.com.invalid>
> wrote:
>>
>> First, briefly skimming back through the initial first replies, I didn't
>> spot anyone - including, I'm sorry, myself - suggesting that you
>> should do the obvious thing and look at the Event Viewer, which is the
>> first thing that should have been done for an issue like this!
>>
>> A 1 <Rt-Click> 'My Computer'
>> 2 Choose 'Manage'
>> 3 In the console, choose, ie expand:
>> Computer Management (local)
>> System Tools
>> Event Viewer
>> Windows Logs
>> 4 Click on 'System'
>>
>> There should be some warning or error messages relating to an issue like
>> this. Warnings are an exclamation mark in a yellow triangle. Errors
>> are an exclamation mark in a red circle. Can you see any errors or
>> warnings related to the problem? If there are any of either seeming
>> relevant, <double-click> them, click the Details tab, choose XML View,
>> and copy and paste the entire message into a reply here.
>
> The first time I plugged it in, this is what I got:
>
> - <Event
> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Disk" />
> <EventID Qualifiers="49156">11</EventID>
> <Level>2</Level>
> <Task>0</Task>
> <Keywords>0x80000000000000</Keywords>
> <TimeCreated SystemTime="2022-11-07T15:45:18.223414900Z" />
> <EventRecordID>1650156</EventRecordID>
> <Channel>System</Channel>
> <Computer>MikesDesktop</Computer>
> <Security />
> </System>
> - <EventData>
> <Data>\Device\Harddisk4\DR4</Data>
>
> <Binary>0E00800001000000000000000B0004C003010000000000000000000000082D000000000000000000C1DE480000000000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000402BC90F80FAFFFF00000000000000007042620E80FAFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
> </EventData>
> </Event>
>
> Now when I plug it in, this is what I get:
>
> - <Event
> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Microsoft-Windows-BitLocker-Driver"
> Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
> <EventID>24620</EventID>
> <Version>0</Version>
> <Level>2</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8000000000000000</Keywords>
> <TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
> <EventRecordID>1650171</EventRecordID>
> <Correlation />
> <Execution ProcessID="4" ThreadID="84" />
> <Channel>System</Channel>
> <Computer>MikesDesktop</Computer>
> <Security UserID="S-1-5-18" />
> </System>
> - <EventData>
> <Data Name="ErrorCode">0x80000010</Data>
> <Data Name="Volume" />
> <Data Name="WritePhase">0x0</Data>
> </EventData>
> </Event>

AFAICR, this is the first mention of BitLocker, so are you running it on
either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
a guess that your, the problem, PC is running it, but your wife's, which
is reading the drive with no problem, is not? Also, did you ever
encrypt the USB drive, either before or after reformatting it?

>> Secondly, I've been looking again at the properties pages you provided
>> for us. I have a working EasyDisk USB storage stick in this W7 PC at
>> the moment ...
>>
>> B 1 In Device Manager, I <rt-click> it and choose Properties
>>
>> 2 I select the Driver tab. I have ...
>> Microsoft
>> 21/06/2006
>> 6.1.7601.19133
>> Microsoft Windows
>> ... and clicking Driver Details gives me ...
>> disk.sys
>> partmgr.sys
>> ... both in %WinDir%\System32\Drivers.
>>
>> What do you have?
>
> I have the same for the first part. Driver details gives me:
>
> C:Windows\system32\drivers\UMDF\WpdFs.dll
> C:\Windows\system32\Drivers\WUDFRd.sys

I'd expect a newly formatted USB storage drive, to appear as mine, so
the above definitely looks wrong to me, but I'm not a user of BitLocker,
so can only make limited comments in relation to it. Others may be able
to help more.

>> Next I refer back to one of your messages in reply to Paul, wherein you
>> included an extract from SetUpAPI.log:
>>
>> ServiceBinary=C:\Windows\system32\DRIVERS\WUDFRd.sys
>>
>> WTF? This is not a UDF (CD,DVD) device! This suggests to me that
>> perhaps we have to find out why your Windows thinks you are inserting a
>> CD or DVD?
>>
>> It might be worthwhile examining what has been installed under Control
>> Panel, Programs and Features. Any drivers or software for CD/DVD drives
>> there, particularly USB ones? If so, and that device is no longer in
>> use, try uninstalling its software, rebooting, and trying to install the
>> SanDisk again.
>
> I uninstalled WinCDEmu but it didn't help. I didn't see anything else
> that had been installed this year that would have had anything to do
> with USB or Disk Drives.

As per my follow-up post, I was mistaken there. Most probably there is
no reason not to reinstall WinCDEmu if you want.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

Java Jive <java@evij.com.invalid> wrote:
> On 07/11/2022 17:37, jetjock wrote:
[...]

> AFAICR, this is the first mention of BitLocker, so are you running it on
> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
> a guess that your, the problem, PC is running it, but your wife's, which
> is reading the drive with no problem, is not? Also, did you ever
> encrypt the USB drive, either before or after reformatting it?

That's what caught my eye as well. Probably one of the PCs is using
BitLocker and the other one is not. If the USB memory-stick is BitLocker
encrypted, the non-BitLocker machine won't understand it and therefor
not show it in File Manager.

But I could be wrong. Just learned about BitLocker creeping up on you,
myself (see the Windows 11 group).

[...]

On 11/7/2022 1:50 PM, Frank Slootweg wrote:
> Java Jive <java@evij.com.invalid> wrote:
>> On 07/11/2022 17:37, jetjock wrote:
> [...]
>
>> AFAICR, this is the first mention of BitLocker, so are you running it on
>> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>> a guess that your, the problem, PC is running it, but your wife's, which
>> is reading the drive with no problem, is not? Also, did you ever
>> encrypt the USB drive, either before or after reformatting it?
>
> That's what caught my eye as well. Probably one of the PCs is using
> BitLocker and the other one is not. If the USB memory-stick is BitLocker
> encrypted, the non-BitLocker machine won't understand it and therefor
> not show it in File Manager.
>
> But I could be wrong. Just learned about BitLocker creeping up on you,
> myself (see the Windows 11 group).
>
> [...]
>

But the non-reading machine is Windows 7. Why would it
not recognize Bitlocker ? It might not recognize it, if
a Windows 10 prepared the stick (no Elephant Diffuser).
I would expect forward compatibility, a Windows 7 BL
stick would be readable on a Windows 10. But a
Windows 10 BL stick might not be readable on a
Windows 7. Still, the header should declare things
in a way that make these determinations possible, and
result in an appropriate dialog.

While a USB stick can have an internal crypto engine,
I don't think Windows 7 recognizes such options and
has no code to act on them. I don't even know if crypto
in a USB stick, is the equivalent of FDE on a hard drive.
I doubt the interface or declaration is exactly the same.
Proprietary crypto, usually requires the usage of an
application stored on the USB stick when you receive it.
I have always steered clear of any brands/models advertising
such stuff -- I don't need "trouble makers" here :-) The
quality of TLC sticks is gift-enough for me. Three dead or
dying TLC sticks and counting. My MLC sticks keep on chugging.

Paul

On 11/7/2022 12:33 PM, jetjock wrote:

>
> My File Manager does search inside folders just like that. I searched
> the Windows\INF folder for WPDFS and WUDFUSBCCIDDRIVER, renamed both
> the .inf and .pnf files and rebooted. Didn't help a thing.

Most people do not have federated search set up, or have
it set up properly. When you've done all that work, you
are rewarded with "unstable operation". The indexer will
dump Windows.edb and start all over again, out of the blue.
It can take 24 hours of computer operation, drawing 100W,
while it indexes a million files (over again).

Here is a tribute to Federated Search:

filename:cheese ext:pdf content:"tastes good"

Don't just type

cheese

in the box, or it'll go nutz. That's the very first
lesson I learned. Using the language is how you can
actually use it. I was amazed at the extent even
doing this much helped. This was my first step, doing
all my searches this way (in the Explorer box, upper right).

filename:cheese

Even though there is a tick box to turn off content
indexing, the tick box *does not work*. It is a
very very evil joke, that tick box.

Paul

Paul <nospam@needed.invalid> wrote:
> On 11/7/2022 1:50 PM, Frank Slootweg wrote:
> > Java Jive <java@evij.com.invalid> wrote:
> >> On 07/11/2022 17:37, jetjock wrote:
> > [...]
> >
> >> AFAICR, this is the first mention of BitLocker, so are you running it on
> >> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
> >> a guess that your, the problem, PC is running it, but your wife's, which
> >> is reading the drive with no problem, is not? Also, did you ever
> >> encrypt the USB drive, either before or after reformatting it?
> >
> > That's what caught my eye as well. Probably one of the PCs is using
> > BitLocker and the other one is not. If the USB memory-stick is BitLocker
> > encrypted, the non-BitLocker machine won't understand it and therefor
> > not show it in File Manager.
> >
> > But I could be wrong. Just learned about BitLocker creeping up on you,
> > myself (see the Windows 11 group).
> >
> > [...]
> >
>
> But the non-reading machine is Windows 7. Why would it
> not recognize Bitlocker ? It might not recognize it, if
> a Windows 10 prepared the stick (no Elephant Diffuser).
> I would expect forward compatibility, a Windows 7 BL
> stick would be readable on a Windows 10. But a
> Windows 10 BL stick might not be readable on a
> Windows 7.

That was indeed the kind of scenario i was thinking of. What's the
Windows version of his wife's PC and on which PC was the stick (force,
not quick) formatted? I don't remember seeing that information in these
umpteen responses.

> Still, the header should declare things
> in a way that make these determinations possible, and
> result in an appropriate dialog.

Why would Windows 7 understand a Windows 10 formatted header?

When the relevant Windows 7 code was written, Windows 10 - and hence
the Windows 10 header format - did not exist yet. Yes, we expect
old-to-new compatibility, but not new-to-old [1].

[...]

[1] I intentionally don't use upward and downward compatibility, because
those terms depend too much on what you're looking at and where you're
looking from.

On Mon, 7 Nov 2022 08:55:21 -0800, "David E. Ross"
<nobody@notme.invalid> wrote:

>On 11/6/2022 10:43 PM, Char Jackson wrote:
>> On Sun, 6 Nov 2022 21:38:55 -0800, "David E. Ross"
>> <nobody@notme.invalid> wrote:
>>
>>> On 11/6/2022 6:49 PM, Paul wrote:
>>>> On 11/6/2022 12:46 PM, jetjock wrote:
>>>>
>>>>> I did a search for oem.inf files in the Windows INF folder. There were
>>>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>>>> .inf files in total in that folder. I neither have the time nor the
>>>>> inclination to inspect that many files for "SanDisk". Even if I found
>>>>> one, I wouldn't know a good one from an abnormal one.
>>>>
>>>> But this is easy-peasy :-)
>>>>
>>>> Agent Ransack allows searching for all files ending in .inf
>>>>
>>>> File name: (Regular expression mode) inf$ # anything ending in INF
>>>>
>>>> Containing Text: SanDisk # search on the "realname" stored inside the INF
>>>>
>>>> Search area: Select custom single folder, set to C:\Windows\INF
>>>>
>>>> The tool is here. It'll tell you which files
>>>> meet the criterion, in maybe five seconds in this
>>>> case. This is how I solve the problem of looking inside oemXX.inf
>>>> files.
>>>>
>>>> https://www.mythicsoft.com/agentransack/
>>>>
>>>> When doing text searches, it will start as many threads
>>>> of execution, as you have CPU cores. It's not a slouch :-)
>>>>
>>>> Paul
>>>>
>>>
>>> Agent Ransack is great for searching for a given string within files.
>>> For searching files by their names or fragments of names, however, it is
>>> slow. For that latter search, I use the Everything search engine from
>>> <http://www.voidtools.com/>. Since Everything does not have the
>>> capability to search for a string within a file, I also have Agent
>>> Ransack. Thus, I have two different search tools for two different
>>> types of searches.
>>
>> ***
>> https://www.voidtools.com/faq/#does_everything_search_file_contents
>>
>> Does Everything search file contents?
>>
>> Yes, "Everything" can search file content with the content: search
>> function. File content is not indexed, searching content is slow.
>> ***
>>
>> Not saying it's going to replace Agent Ransack, but it can probably work
>> in a pinch.
>>
>
>Windows 7 Ultimate SP1 x64
>Everything 1.4.1.1022
>
>I cannot find "content" as an option. How do I do that?

From the Everything help file (Menu item Help>Search Syntax)

<SNIP>

Functions:
album:<text> Search media for album metadata.
ansicontent:<text> Search ANSI file content for text.
artist:<text> Search media for artist metadata.
attrib:<attributes> Search for files and folders with the
specified file attributes.
attribdupe: Find files and folders with the same attributes.
attributes:<attributes> Search for files and folders with the
specified file attributes.
bitdepth:<bitdepth> Find images with the specified bits per
pixel.
child:<filename> Search for folders that contain a child
with a matching filename.
childcount:<count> Search for folders that contain the
specified number of subfolders and files.
childfilecount:<count> Search for folders that contain the
specified number of files.
childfoldercount:<n> Search for folders that contain the
specified number of subfolders.
comment:<text> Search media for comment metadata.
content:<text> Search file content for text.

<SNIP>

I snipped it to include the "content:" keyword, right there at the end
of the truncated list. I tried it here on a smallish folder and it
worked fine with a single search term. I didn't try anything more
complicated than that.

On Mon, 7 Nov 2022 18:22:00 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 07/11/2022 17:37, jetjock wrote:
>>
>> On Mon, 7 Nov 2022 14:24:37 +0000, Java Jive <java@evij.com.invalid>
>> wrote:
>>>
>>> First, briefly skimming back through the initial first replies, I didn't
>>> spot anyone - including, I'm sorry, myself - suggesting that you
>>> should do the obvious thing and look at the Event Viewer, which is the
>>> first thing that should have been done for an issue like this!
>>>
>>> A 1 <Rt-Click> 'My Computer'
>>> 2 Choose 'Manage'
>>> 3 In the console, choose, ie expand:
>>> Computer Management (local)
>>> System Tools
>>> Event Viewer
>>> Windows Logs
>>> 4 Click on 'System'
>>>
>>> There should be some warning or error messages relating to an issue like
>>> this. Warnings are an exclamation mark in a yellow triangle. Errors
>>> are an exclamation mark in a red circle. Can you see any errors or
>>> warnings related to the problem? If there are any of either seeming
>>> relevant, <double-click> them, click the Details tab, choose XML View,
>>> and copy and paste the entire message into a reply here.
>>
>> The first time I plugged it in, this is what I got:
>>
>> - <Event
>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>> - <System>
>> <Provider Name="Disk" />
>> <EventID Qualifiers="49156">11</EventID>
>> <Level>2</Level>
>> <Task>0</Task>
>> <Keywords>0x80000000000000</Keywords>
>> <TimeCreated SystemTime="2022-11-07T15:45:18.223414900Z" />
>> <EventRecordID>1650156</EventRecordID>
>> <Channel>System</Channel>
>> <Computer>MikesDesktop</Computer>
>> <Security />
>> </System>
>> - <EventData>
>> <Data>\Device\Harddisk4\DR4</Data>
>>
>> <Binary>0E00800001000000000000000B0004C003010000000000000000000000082D000000000000000000C1DE480000000000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000402BC90F80FAFFFF00000000000000007042620E80FAFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
>> </EventData>
>> </Event>
>>
>> Now when I plug it in, this is what I get:
>>
>> - <Event
>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>> - <System>
>> <Provider Name="Microsoft-Windows-BitLocker-Driver"
>> Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
>> <EventID>24620</EventID>
>> <Version>0</Version>
>> <Level>2</Level>
>> <Task>0</Task>
>> <Opcode>0</Opcode>
>> <Keywords>0x8000000000000000</Keywords>
>> <TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
>> <EventRecordID>1650171</EventRecordID>
>> <Correlation />
>> <Execution ProcessID="4" ThreadID="84" />
>> <Channel>System</Channel>
>> <Computer>MikesDesktop</Computer>
>> <Security UserID="S-1-5-18" />
>> </System>
>> - <EventData>
>> <Data Name="ErrorCode">0x80000010</Data>
>> <Data Name="Volume" />
>> <Data Name="WritePhase">0x0</Data>
>> </EventData>
>> </Event>
>
>AFAICR, this is the first mention of BitLocker, so are you running it on
>either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>a guess that your, the problem, PC is running it, but your wife's, which
>is reading the drive with no problem, is not? Also, did you ever
>encrypt the USB drive, either before or after reformatting it?

I have never encrypted any drive, ever! It may have indexed, but
formatting should have taken care of that. BDESVC (Bitlocker
Encryption Service) is "Stopped" in Services, so it should not have
done anything to the SanDisk drive.
>
>>> Secondly, I've been looking again at the properties pages you provided
>>> for us. I have a working EasyDisk USB storage stick in this W7 PC at
>>> the moment ...
>>>
>>> B 1 In Device Manager, I <rt-click> it and choose Properties
>>>
>>> 2 I select the Driver tab. I have ...
>>> Microsoft
>>> 21/06/2006
>>> 6.1.7601.19133
>>> Microsoft Windows
>>> ... and clicking Driver Details gives me ...
>>> disk.sys
>>> partmgr.sys
>>> ... both in %WinDir%\System32\Drivers.
>>>
>>> What do you have?
>>
>> I have the same for the first part. Driver details gives me:
>>
>> C:Windows\system32\drivers\UMDF\WpdFs.dll
>> C:\Windows\system32\Drivers\WUDFRd.sys
>
>I'd expect a newly formatted USB storage drive, to appear as mine, so
>the above definitely looks wrong to me, but I'm not a user of BitLocker,
>so can only make limited comments in relation to it. Others may be able
>to help more.
>
>>> Next I refer back to one of your messages in reply to Paul, wherein you
>>> included an extract from SetUpAPI.log:
>>>
>>> ServiceBinary=C:\Windows\system32\DRIVERS\WUDFRd.sys
>>>
>>> WTF? This is not a UDF (CD,DVD) device! This suggests to me that
>>> perhaps we have to find out why your Windows thinks you are inserting a
>>> CD or DVD?
>>>
>>> It might be worthwhile examining what has been installed under Control
>>> Panel, Programs and Features. Any drivers or software for CD/DVD drives
>>> there, particularly USB ones? If so, and that device is no longer in
>>> use, try uninstalling its software, rebooting, and trying to install the
>>> SanDisk again.
>>
>> I uninstalled WinCDEmu but it didn't help. I didn't see anything else
>> that had been installed this year that would have had anything to do
>> with USB or Disk Drives.
>
>As per my follow-up post, I was mistaken there. Most probably there is
>no reason not to reinstall WinCDEmu if you want.

>>>>>>>>>>jetjock<<<<<<<<<<

On Mon, 07 Nov 2022 15:46:30 -0600, Char Jackson <none@none.invalid>
wrote:

>On Mon, 7 Nov 2022 08:55:21 -0800, "David E. Ross"
><nobody@notme.invalid> wrote:
>
>>On 11/6/2022 10:43 PM, Char Jackson wrote:
>>> On Sun, 6 Nov 2022 21:38:55 -0800, "David E. Ross"
>>> <nobody@notme.invalid> wrote:
>>>
>>>> On 11/6/2022 6:49 PM, Paul wrote:
>>>>> On 11/6/2022 12:46 PM, jetjock wrote:
>>>>>
>>>>>> I did a search for oem.inf files in the Windows INF folder. There were
>>>>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>>>>> .inf files in total in that folder. I neither have the time nor the
>>>>>> inclination to inspect that many files for "SanDisk". Even if I found
>>>>>> one, I wouldn't know a good one from an abnormal one.
>>>>>
>>>>> But this is easy-peasy :-)
>>>>>
>>>>> Agent Ransack allows searching for all files ending in .inf
>>>>>
>>>>> File name: (Regular expression mode) inf$ # anything ending in INF
>>>>>
>>>>> Containing Text: SanDisk # search on the "realname" stored inside the INF
>>>>>
>>>>> Search area: Select custom single folder, set to C:\Windows\INF
>>>>>
>>>>> The tool is here. It'll tell you which files
>>>>> meet the criterion, in maybe five seconds in this
>>>>> case. This is how I solve the problem of looking inside oemXX.inf
>>>>> files.
>>>>>
>>>>> https://www.mythicsoft.com/agentransack/
>>>>>
>>>>> When doing text searches, it will start as many threads
>>>>> of execution, as you have CPU cores. It's not a slouch :-)
>>>>>
>>>>> Paul
>>>>>
>>>>
>>>> Agent Ransack is great for searching for a given string within files.
>>>> For searching files by their names or fragments of names, however, it is
>>>> slow. For that latter search, I use the Everything search engine from
>>>> <http://www.voidtools.com/>. Since Everything does not have the
>>>> capability to search for a string within a file, I also have Agent
>>>> Ransack. Thus, I have two different search tools for two different
>>>> types of searches.
>>>
>>> ***
>>> https://www.voidtools.com/faq/#does_everything_search_file_contents
>>>
>>> Does Everything search file contents?
>>>
>>> Yes, "Everything" can search file content with the content: search
>>> function. File content is not indexed, searching content is slow.
>>> ***
>>>
>>> Not saying it's going to replace Agent Ransack, but it can probably work
>>> in a pinch.
>>>
>>
>>Windows 7 Ultimate SP1 x64
>>Everything 1.4.1.1022
>>
>>I cannot find "content" as an option. How do I do that?
>
>From the Everything help file (Menu item Help>Search Syntax)

One of the reasons I prefer to use Agent Ransack for content is that I
can never remember that.

On Mon, 07 Nov 2022 16:39:50 -0700, Ken Blake <Ken@invalid.news.com>
wrote:

>On Mon, 07 Nov 2022 15:46:30 -0600, Char Jackson <none@none.invalid>
>wrote:
>
>>On Mon, 7 Nov 2022 08:55:21 -0800, "David E. Ross"
>><nobody@notme.invalid> wrote:
>>
>>>On 11/6/2022 10:43 PM, Char Jackson wrote:
>>>> On Sun, 6 Nov 2022 21:38:55 -0800, "David E. Ross"
>>>> <nobody@notme.invalid> wrote:
>>>>
>>>>> On 11/6/2022 6:49 PM, Paul wrote:
>>>>>> On 11/6/2022 12:46 PM, jetjock wrote:
>>>>>>
>>>>>>> I did a search for oem.inf files in the Windows INF folder. There were
>>>>>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>>>>>> .inf files in total in that folder. I neither have the time nor the
>>>>>>> inclination to inspect that many files for "SanDisk". Even if I found
>>>>>>> one, I wouldn't know a good one from an abnormal one.
>>>>>>
>>>>>> But this is easy-peasy :-)
>>>>>>
>>>>>> Agent Ransack allows searching for all files ending in .inf
>>>>>>
>>>>>> File name: (Regular expression mode) inf$ # anything ending in INF
>>>>>>
>>>>>> Containing Text: SanDisk # search on the "realname" stored inside the INF
>>>>>>
>>>>>> Search area: Select custom single folder, set to C:\Windows\INF
>>>>>>
>>>>>> The tool is here. It'll tell you which files
>>>>>> meet the criterion, in maybe five seconds in this
>>>>>> case. This is how I solve the problem of looking inside oemXX.inf
>>>>>> files.
>>>>>>
>>>>>> https://www.mythicsoft.com/agentransack/
>>>>>>
>>>>>> When doing text searches, it will start as many threads
>>>>>> of execution, as you have CPU cores. It's not a slouch :-)
>>>>>>
>>>>>> Paul
>>>>>>
>>>>>
>>>>> Agent Ransack is great for searching for a given string within files.
>>>>> For searching files by their names or fragments of names, however, it is
>>>>> slow. For that latter search, I use the Everything search engine from
>>>>> <http://www.voidtools.com/>. Since Everything does not have the
>>>>> capability to search for a string within a file, I also have Agent
>>>>> Ransack. Thus, I have two different search tools for two different
>>>>> types of searches.
>>>>
>>>> ***
>>>> https://www.voidtools.com/faq/#does_everything_search_file_contents
>>>>
>>>> Does Everything search file contents?
>>>>
>>>> Yes, "Everything" can search file content with the content: search
>>>> function. File content is not indexed, searching content is slow.
>>>> ***
>>>>
>>>> Not saying it's going to replace Agent Ransack, but it can probably work
>>>> in a pinch.
>>>>
>>>
>>>Windows 7 Ultimate SP1 x64
>>>Everything 1.4.1.1022
>>>
>>>I cannot find "content" as an option. How do I do that?
>>
>>From the Everything help file (Menu item Help>Search Syntax)
>
>
>One of the reasons I prefer to use Agent Ransack for content is that I
>can never remember that.

I almost never need to search for content, but I frequently search on
partial filename, or no filename at all. One of my most frequent
searches is with Agent Ransack with a blank search to 'find' everything
in a specific folder and its subfolders. I could use Everything for
that, but AR seems easier, for some reason.

On 07/11/2022 23:22, jetjock wrote:
>
> On Mon, 7 Nov 2022 18:22:00 +0000, Java Jive <java@evij.com.invalid>
> wrote:
>
>> On 07/11/2022 17:37, jetjock wrote:
>>>
>>> On Mon, 7 Nov 2022 14:24:37 +0000, Java Jive <java@evij.com.invalid>
>>> wrote:
>>>>
>>>> First, briefly skimming back through the initial first replies, I didn't
>>>> spot anyone - including, I'm sorry, myself - suggesting that you
>>>> should do the obvious thing and look at the Event Viewer, which is the
>>>> first thing that should have been done for an issue like this!
>>>>
>>>> A 1 <Rt-Click> 'My Computer'
>>>> 2 Choose 'Manage'
>>>> 3 In the console, choose, ie expand:
>>>> Computer Management (local)
>>>> System Tools
>>>> Event Viewer
>>>> Windows Logs
>>>> 4 Click on 'System'
>>>>
>>>> There should be some warning or error messages relating to an issue like
>>>> this. Warnings are an exclamation mark in a yellow triangle. Errors
>>>> are an exclamation mark in a red circle. Can you see any errors or
>>>> warnings related to the problem? If there are any of either seeming
>>>> relevant, <double-click> them, click the Details tab, choose XML View,
>>>> and copy and paste the entire message into a reply here.
>>>
>>> The first time I plugged it in, this is what I got:
>>>
>>> - <Event
>>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>>> - <System>
>>> <Provider Name="Disk" />
>>> <EventID Qualifiers="49156">11</EventID>
>>> <Level>2</Level>
>>> <Task>0</Task>
>>> <Keywords>0x80000000000000</Keywords>
>>> <TimeCreated SystemTime="2022-11-07T15:45:18.223414900Z" />
>>> <EventRecordID>1650156</EventRecordID>
>>> <Channel>System</Channel>
>>> <Computer>MikesDesktop</Computer>
>>> <Security />
>>> </System>
>>> - <EventData>
>>> <Data>\Device\Harddisk4\DR4</Data>
>>>
>>> <Binary>0E00800001000000000000000B0004C003010000000000000000000000082D000000000000000000C1DE480000000000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000402BC90F80FAFFFF00000000000000007042620E80FAFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
>>> </EventData>
>>> </Event>
>>>
>>> Now when I plug it in, this is what I get:
>>>
>>> - <Event
>>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>>> - <System>
>>> <Provider Name="Microsoft-Windows-BitLocker-Driver"
>>> Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
>>> <EventID>24620</EventID>
>>> <Version>0</Version>
>>> <Level>2</Level>
>>> <Task>0</Task>
>>> <Opcode>0</Opcode>
>>> <Keywords>0x8000000000000000</Keywords>
>>> <TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
>>> <EventRecordID>1650171</EventRecordID>
>>> <Correlation />
>>> <Execution ProcessID="4" ThreadID="84" />
>>> <Channel>System</Channel>
>>> <Computer>MikesDesktop</Computer>
>>> <Security UserID="S-1-5-18" />
>>> </System>
>>> - <EventData>
>>> <Data Name="ErrorCode">0x80000010</Data>
>>> <Data Name="Volume" />
>>> <Data Name="WritePhase">0x0</Data>
>>> </EventData>
>>> </Event>
>>
>> AFAICR, this is the first mention of BitLocker, so are you running it on
>> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>> a guess that your, the problem, PC is running it, but your wife's, which
>> is reading the drive with no problem, is not? Also, did you ever
>> encrypt the USB drive, either before or after reformatting it?
>
> I have never encrypted any drive, ever! It may have indexed, but
> formatting should have taken care of that. BDESVC (Bitlocker
> Encryption Service) is "Stopped" in Services, so it should not have
> done anything to the SanDisk drive.

Then seemingly we need to find out why BitLocker is getting involved
when it shouldn't be.

Can you post here what event, presumably a normal event rather than a
warning or an error, is caused when you plug the SanDisk into the PC on
which it works, I think it was your wife's? Ditto next section for the
drivers?

This is what I get plugging in a FAT32 USB Stick which works:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager"
Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2022-11-08T11:53:31.476503800Z" />
<EventRecordID>111229</EventRecordID>
<Correlation />
<Execution ProcessID="684" ThreadID="4700" />
<Channel>System</Channel>
<Computer>Charles-I</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">Portable Device Enumerator Service</Data>
<Data Name="param2">running</Data>
<Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
</EventData>
</Event>

>>>> Secondly, I've been looking again at the properties pages you provided
>>>> for us. I have a working EasyDisk USB storage stick in this W7 PC at
>>>> the moment ...
>>>>
>>>> B 1 In Device Manager, I <rt-click> it and choose Properties
>>>>
>>>> 2 I select the Driver tab. I have ...
>>>> Microsoft
>>>> 21/06/2006
>>>> 6.1.7601.19133
>>>> Microsoft Windows
>>>> ... and clicking Driver Details gives me ...
>>>> disk.sys
>>>> partmgr.sys
>>>> ... both in %WinDir%\System32\Drivers.
>>>>
>>>> What do you have?
>>>
>>> I have the same for the first part. Driver details gives me:
>>>
>>> C:Windows\system32\drivers\UMDF\WpdFs.dll
>>> C:\Windows\system32\Drivers\WUDFRd.sys

As described above, please repeat this for when the SanDisk is plugged
into the PC on which it works.

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

jetjock <jetjock@unkown.com> wrote:
> On Mon, 7 Nov 2022 18:22:00 +0000, Java Jive <java@evij.com.invalid>
> wrote:
[...]

> >AFAICR, this is the first mention of BitLocker, so are you running it on
> >either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
> >a guess that your, the problem, PC is running it, but your wife's, which
> >is reading the drive with no problem, is not? Also, did you ever
> >encrypt the USB drive, either before or after reformatting it?
>
> I have never encrypted any drive, ever! It may have indexed, but
> formatting should have taken care of that. BDESVC (Bitlocker
> Encryption Service) is "Stopped" in Services, so it should not have
> done anything to the SanDisk drive.

AFAIK, it doesn't matter if the SanDisk USB memory-stick is actually
*encrypted* by BitLocker, as long as it is 'prepared' by BitLocker,
Windows 7 File Manager might not recognize it. So it does not matter if
the Bitlocker Encryption Service is running or not, as long as the stick
was 'prepared' by BitLocker at some point in time, Windows 7 File
Manager might barf on it.

I use the word 'prepared', because I do not know the correct BitLocker
term for the process. I didn't want to use 'initialized', because it
might be interpreted as 'formatted' in the file-system sense, i.e. for
example FAT32-formatted.

I had a similar/related problem on Windows 11, where my SSD (C:) was
'prepared' by BitLocker, but not (yet) actually *encrypted* by
BitLocker. That gave unexpected results, for example from Macrium
Reflect. See the thread " [Update] Current best way to set up a local
account" in alt.comp.os.windows-11.

Bottom line: Pay attention to the BitLocker message, (IMO) it's not
coming out of thin air, and might well be the cause of your problem.

BTW, what version Windows does your wife's PC have?

P.S. Paul can probably give you a command-line command for checking
(on a higher than Windows 7 PC) if the stick has been 'prepared' by
BitLocker. (I probably could do that too, but am a bit out of my league,
BitLocker-wise.)

[...]

On 7 Nov 2022 18:50:33 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:

>Java Jive <java@evij.com.invalid> wrote:
>> On 07/11/2022 17:37, jetjock wrote:
>[...]
>
>> AFAICR, this is the first mention of BitLocker, so are you running it on
>> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>> a guess that your, the problem, PC is running it, but your wife's, which
>> is reading the drive with no problem, is not? Also, did you ever
>> encrypt the USB drive, either before or after reformatting it?
>
> That's what caught my eye as well. Probably one of the PCs is using
>BitLocker and the other one is not. If the USB memory-stick is BitLocker
>encrypted, the non-BitLocker machine won't understand it and therefor
>not show it in File Manager.
>
> But I could be wrong. Just learned about BitLocker creeping up on you,
>myself (see the Windows 11 group).

Drive has never been encrypted (intentionally, anyway) by me. I have
checked "Services" on both computers and Bitlocker is either stopped
or disabled on both.

>>>>>>>>>>jetjock<<<<<<<<<<

On 7 Nov 2022 20:15:16 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:

>Paul <nospam@needed.invalid> wrote:
>> On 11/7/2022 1:50 PM, Frank Slootweg wrote:
>> > Java Jive <java@evij.com.invalid> wrote:
>> >> On 07/11/2022 17:37, jetjock wrote:
>> > [...]
>> >
>> >> AFAICR, this is the first mention of BitLocker, so are you running it on
>> >> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>> >> a guess that your, the problem, PC is running it, but your wife's, which
>> >> is reading the drive with no problem, is not? Also, did you ever
>> >> encrypt the USB drive, either before or after reformatting it?
>> >
>> > That's what caught my eye as well. Probably one of the PCs is using
>> > BitLocker and the other one is not. If the USB memory-stick is BitLocker
>> > encrypted, the non-BitLocker machine won't understand it and therefor
>> > not show it in File Manager.
>> >
>> > But I could be wrong. Just learned about BitLocker creeping up on you,
>> > myself (see the Windows 11 group).
>> >
>> > [...]
>> >
>>
>> But the non-reading machine is Windows 7. Why would it
>> not recognize Bitlocker ? It might not recognize it, if
>> a Windows 10 prepared the stick (no Elephant Diffuser).
>> I would expect forward compatibility, a Windows 7 BL
>> stick would be readable on a Windows 10. But a
>> Windows 10 BL stick might not be readable on a
>> Windows 7.
>
> That was indeed the kind of scenario i was thinking of. What's the
>Windows version of his wife's PC and on which PC was the stick (force,
>not quick) formatted? I don't remember seeing that information in these
>umpteen responses.

Both machines are running Win7 Ultimate.

I tried an experiment on my machine by turning Bitlocker Service on
and rebooting but the file manager still would not find the USB. When
Windows tries to install the drive, it gives a sound that I have not
heard at any other time. Just a different kind of beep-bloop!

>
>> Still, the header should declare things
>> in a way that make these determinations possible, and
>> result in an appropriate dialog.
>
> Why would Windows 7 understand a Windows 10 formatted header?
>
> When the relevant Windows 7 code was written, Windows 10 - and hence
>the Windows 10 header format - did not exist yet. Yes, we expect
>old-to-new compatibility, but not new-to-old [1].
>
>[...]
>
>[1] I intentionally don't use upward and downward compatibility, because
>those terms depend too much on what you're looking at and where you're
>looking from.

>>>>>>>>>>jetjock<<<<<<<<<<

On 11/8/2022 12:22 PM, jetjock wrote:
> On 7 Nov 2022 18:50:33 GMT, Frank Slootweg <this@ddress.is.invalid>
> wrote:
>
>> Java Jive <java@evij.com.invalid> wrote:
>>> On 07/11/2022 17:37, jetjock wrote:
>> [...]
>>
>>> AFAICR, this is the first mention of BitLocker, so are you running it on
>>> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>>> a guess that your, the problem, PC is running it, but your wife's, which
>>> is reading the drive with no problem, is not? Also, did you ever
>>> encrypt the USB drive, either before or after reformatting it?
>>
>> That's what caught my eye as well. Probably one of the PCs is using
>> BitLocker and the other one is not. If the USB memory-stick is BitLocker
>> encrypted, the non-BitLocker machine won't understand it and therefor
>> not show it in File Manager.
>>
>> But I could be wrong. Just learned about BitLocker creeping up on you,
>> myself (see the Windows 11 group).
>
> Drive has never been encrypted (intentionally, anyway) by me. I have
> checked "Services" on both computers and Bitlocker is either stopped
> or disabled on both.
>
> >>>>>>>>>>jetjock<<<<<<<<<<

And the weird thing is, this is Windows 7.

Which should have poor support for "shenanigans".

Paul

On 08/11/2022 17:22, jetjock wrote:
>
> Drive has never been encrypted (intentionally, anyway) by me. I have
> checked "Services" on both computers and Bitlocker is either stopped
> or disabled on both.

So the startup settings on the BitLocker service are different on the
two machines, the one that works and the one that doesn't? I'll hazard
a guess, disabled on the one that works, automatic or manual on the one
that doesn't? Please tell us the exact settings on both.

More generally, the means of curing this is to compare the two machines,
the one that works against the one that doesn't. Upthread, at the end
of my mail of 7/11 14:24, I suggested that you compared the processes
running on both, and gave some instructions for doing so, labelled 'D'
to distinguish them from other sets of instructions in the same mail.
Did you ever get around to doing this?

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Mon, 07 Nov 2022 20:00:33 -0600, Char Jackson <none@none.invalid>
wrote:

>On Mon, 07 Nov 2022 16:39:50 -0700, Ken Blake <Ken@invalid.news.com>
>wrote:
>
>>On Mon, 07 Nov 2022 15:46:30 -0600, Char Jackson <none@none.invalid>
>>wrote:
>>
>>>On Mon, 7 Nov 2022 08:55:21 -0800, "David E. Ross"
>>><nobody@notme.invalid> wrote:
>>>
>>>>On 11/6/2022 10:43 PM, Char Jackson wrote:
>>>>> On Sun, 6 Nov 2022 21:38:55 -0800, "David E. Ross"
>>>>> <nobody@notme.invalid> wrote:
>>>>>
>>>>>> On 11/6/2022 6:49 PM, Paul wrote:
>>>>>>> On 11/6/2022 12:46 PM, jetjock wrote:
>>>>>>>
>>>>>>>> I did a search for oem.inf files in the Windows INF folder. There were
>>>>>>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>>>>>>> .inf files in total in that folder. I neither have the time nor the
>>>>>>>> inclination to inspect that many files for "SanDisk". Even if I found
>>>>>>>> one, I wouldn't know a good one from an abnormal one.
>>>>>>>
>>>>>>> But this is easy-peasy :-)
>>>>>>>
>>>>>>> Agent Ransack allows searching for all files ending in .inf
>>>>>>>
>>>>>>> File name: (Regular expression mode) inf$ # anything ending in INF
>>>>>>>
>>>>>>> Containing Text: SanDisk # search on the "realname" stored inside the INF
>>>>>>>
>>>>>>> Search area: Select custom single folder, set to C:\Windows\INF
>>>>>>>
>>>>>>> The tool is here. It'll tell you which files
>>>>>>> meet the criterion, in maybe five seconds in this
>>>>>>> case. This is how I solve the problem of looking inside oemXX.inf
>>>>>>> files.
>>>>>>>
>>>>>>> https://www.mythicsoft.com/agentransack/
>>>>>>>
>>>>>>> When doing text searches, it will start as many threads
>>>>>>> of execution, as you have CPU cores. It's not a slouch :-)
>>>>>>>
>>>>>>> Paul
>>>>>>>
>>>>>>
>>>>>> Agent Ransack is great for searching for a given string within files.
>>>>>> For searching files by their names or fragments of names, however, it is
>>>>>> slow. For that latter search, I use the Everything search engine from
>>>>>> <http://www.voidtools.com/>. Since Everything does not have the
>>>>>> capability to search for a string within a file, I also have Agent
>>>>>> Ransack. Thus, I have two different search tools for two different
>>>>>> types of searches.
>>>>>
>>>>> ***
>>>>> https://www.voidtools.com/faq/#does_everything_search_file_contents
>>>>>
>>>>> Does Everything search file contents?
>>>>>
>>>>> Yes, "Everything" can search file content with the content: search
>>>>> function. File content is not indexed, searching content is slow.
>>>>> ***
>>>>>
>>>>> Not saying it's going to replace Agent Ransack, but it can probably work
>>>>> in a pinch.
>>>>>
>>>>
>>>>Windows 7 Ultimate SP1 x64
>>>>Everything 1.4.1.1022
>>>>
>>>>I cannot find "content" as an option. How do I do that?
>>>
>>>From the Everything help file (Menu item Help>Search Syntax)
>>
>>
>>One of the reasons I prefer to use Agent Ransack for content is that I
>>can never remember that.
>
>I almost never need to search for content,

I rarely do, but every now and then...

>but I frequently search on
>partial filename, or no filename at all. One of my most frequent
>searches is with Agent Ransack with a blank search to 'find' everything
>in a specific folder and its subfolders. I could use Everything for
>that, but AR seems easier, for some reason.

OK, I don't find it easier, but we're all different.

On 11/8/2022 3:07 PM, Ken Blake wrote:
> On Mon, 07 Nov 2022 20:00:33 -0600, Char Jackson <none@none.invalid>
> wrote:
>
>> On Mon, 07 Nov 2022 16:39:50 -0700, Ken Blake <Ken@invalid.news.com>
>> wrote:
>>
>>> On Mon, 07 Nov 2022 15:46:30 -0600, Char Jackson <none@none.invalid>
>>> wrote:
>>>
>>>> On Mon, 7 Nov 2022 08:55:21 -0800, "David E. Ross"
>>>> <nobody@notme.invalid> wrote:
>>>>
>>>>> On 11/6/2022 10:43 PM, Char Jackson wrote:
>>>>>> On Sun, 6 Nov 2022 21:38:55 -0800, "David E. Ross"
>>>>>> <nobody@notme.invalid> wrote:
>>>>>>
>>>>>>> On 11/6/2022 6:49 PM, Paul wrote:
>>>>>>>> On 11/6/2022 12:46 PM, jetjock wrote:
>>>>>>>>
>>>>>>>>> I did a search for oem.inf files in the Windows INF folder. There were
>>>>>>>>> 96, none of which had "SanDisk" in them. There were a total of 2300+
>>>>>>>>> .inf files in total in that folder. I neither have the time nor the
>>>>>>>>> inclination to inspect that many files for "SanDisk". Even if I found
>>>>>>>>> one, I wouldn't know a good one from an abnormal one.
>>>>>>>>
>>>>>>>> But this is easy-peasy :-)
>>>>>>>>
>>>>>>>> Agent Ransack allows searching for all files ending in .inf
>>>>>>>>
>>>>>>>> File name: (Regular expression mode) inf$ # anything ending in INF
>>>>>>>>
>>>>>>>> Containing Text: SanDisk # search on the "realname" stored inside the INF
>>>>>>>>
>>>>>>>> Search area: Select custom single folder, set to C:\Windows\INF
>>>>>>>>
>>>>>>>> The tool is here. It'll tell you which files
>>>>>>>> meet the criterion, in maybe five seconds in this
>>>>>>>> case. This is how I solve the problem of looking inside oemXX.inf
>>>>>>>> files.
>>>>>>>>
>>>>>>>> https://www.mythicsoft.com/agentransack/
>>>>>>>>
>>>>>>>> When doing text searches, it will start as many threads
>>>>>>>> of execution, as you have CPU cores. It's not a slouch :-)
>>>>>>>>
>>>>>>>> Paul
>>>>>>>>
>>>>>>>
>>>>>>> Agent Ransack is great for searching for a given string within files.
>>>>>>> For searching files by their names or fragments of names, however, it is
>>>>>>> slow. For that latter search, I use the Everything search engine from
>>>>>>> <http://www.voidtools.com/>. Since Everything does not have the
>>>>>>> capability to search for a string within a file, I also have Agent
>>>>>>> Ransack. Thus, I have two different search tools for two different
>>>>>>> types of searches.
>>>>>>
>>>>>> ***
>>>>>> https://www.voidtools.com/faq/#does_everything_search_file_contents
>>>>>>
>>>>>> Does Everything search file contents?
>>>>>>
>>>>>> Yes, "Everything" can search file content with the content: search
>>>>>> function. File content is not indexed, searching content is slow.
>>>>>> ***
>>>>>>
>>>>>> Not saying it's going to replace Agent Ransack, but it can probably work
>>>>>> in a pinch.
>>>>>>
>>>>>
>>>>> Windows 7 Ultimate SP1 x64
>>>>> Everything 1.4.1.1022
>>>>>
>>>>> I cannot find "content" as an option. How do I do that?
>>>>
>>> >From the Everything help file (Menu item Help>Search Syntax)
>>>
>>>
>>> One of the reasons I prefer to use Agent Ransack for content is that I
>>> can never remember that.
>>
>> I almost never need to search for content,
>
> I rarely do, but every now and then...
>
>> but I frequently search on
>> partial filename, or no filename at all. One of my most frequent
>> searches is with Agent Ransack with a blank search to 'find' everything
>> in a specific folder and its subfolders. I could use Everything for
>> that, but AR seems easier, for some reason.
>
>
> OK, I don't find it easier, but we're all different.
>

I use Agent Ransack that way too.

Blank filename field, do a search.

Usually I sort by date, so the most recently
changed files are at the top.

If I were to use federated search, requesting the output window
to re-sort the results, causes a fresh search to be done, as if
the search was being done for the first time. Which is, um, stupid.

Everything.exe should be relatively fast at this, because
at least part of what it does, is read the $MFT directly.
It might take 2 seconds to read the $MFT, 14 seconds to
fill in some of the other metadata by tree crawling. Agent
Ransack would take a lot longer than that (on the first search
at least).

Everything.exe -create-filelist filelist.txt "C:"

And by the way, Everything.exe does not list everything.

When you compare utilities that list things, you will
find in some cases, large differences in the listing.
It does not build confidence to investigate this issue.
I have zero utilities I can recommend for this. nfi.exe
does not list everything either.

Paul

On Tue, 8 Nov 2022 12:01:53 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 07/11/2022 23:22, jetjock wrote:
>>
>> On Mon, 7 Nov 2022 18:22:00 +0000, Java Jive <java@evij.com.invalid>
>> wrote:
>>
>>> On 07/11/2022 17:37, jetjock wrote:
>>>>
>>>> On Mon, 7 Nov 2022 14:24:37 +0000, Java Jive <java@evij.com.invalid>
>>>> wrote:
>>>>>
>>>>> First, briefly skimming back through the initial first replies, I didn't
>>>>> spot anyone - including, I'm sorry, myself - suggesting that you
>>>>> should do the obvious thing and look at the Event Viewer, which is the
>>>>> first thing that should have been done for an issue like this!
>>>>>
>>>>> A 1 <Rt-Click> 'My Computer'
>>>>> 2 Choose 'Manage'
>>>>> 3 In the console, choose, ie expand:
>>>>> Computer Management (local)
>>>>> System Tools
>>>>> Event Viewer
>>>>> Windows Logs
>>>>> 4 Click on 'System'
>>>>>
>>>>> There should be some warning or error messages relating to an issue like
>>>>> this. Warnings are an exclamation mark in a yellow triangle. Errors
>>>>> are an exclamation mark in a red circle. Can you see any errors or
>>>>> warnings related to the problem? If there are any of either seeming
>>>>> relevant, <double-click> them, click the Details tab, choose XML View,
>>>>> and copy and paste the entire message into a reply here.
>>>>
>>>> The first time I plugged it in, this is what I got:
>>>>
>>>> - <Event
>>>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>>>> - <System>
>>>> <Provider Name="Disk" />
>>>> <EventID Qualifiers="49156">11</EventID>
>>>> <Level>2</Level>
>>>> <Task>0</Task>
>>>> <Keywords>0x80000000000000</Keywords>
>>>> <TimeCreated SystemTime="2022-11-07T15:45:18.223414900Z" />
>>>> <EventRecordID>1650156</EventRecordID>
>>>> <Channel>System</Channel>
>>>> <Computer>MikesDesktop</Computer>
>>>> <Security />
>>>> </System>
>>>> - <EventData>
>>>> <Data>\Device\Harddisk4\DR4</Data>
>>>>
>>>> <Binary>0E00800001000000000000000B0004C003010000000000000000000000082D000000000000000000C1DE480000000000FFFFFFFF0600000058000000000000000000061208000010000000003C0000000000000000000000402BC90F80FAFFFF00000000000000007042620E80FAFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
>>>> </EventData>
>>>> </Event>
>>>>
>>>> Now when I plug it in, this is what I get:
>>>>
>>>> - <Event
>>>> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>>>> - <System>
>>>> <Provider Name="Microsoft-Windows-BitLocker-Driver"
>>>> Guid="{651DF93B-5053-4D1E-94C5-F6E6D25908D0}" />
>>>> <EventID>24620</EventID>
>>>> <Version>0</Version>
>>>> <Level>2</Level>
>>>> <Task>0</Task>
>>>> <Opcode>0</Opcode>
>>>> <Keywords>0x8000000000000000</Keywords>
>>>> <TimeCreated SystemTime="2022-11-07T16:12:57.736444800Z" />
>>>> <EventRecordID>1650171</EventRecordID>
>>>> <Correlation />
>>>> <Execution ProcessID="4" ThreadID="84" />
>>>> <Channel>System</Channel>
>>>> <Computer>MikesDesktop</Computer>
>>>> <Security UserID="S-1-5-18" />
>>>> </System>
>>>> - <EventData>
>>>> <Data Name="ErrorCode">0x80000010</Data>
>>>> <Data Name="Volume" />
>>>> <Data Name="WritePhase">0x0</Data>
>>>> </EventData>
>>>> </Event>
>>>
>>> AFAICR, this is the first mention of BitLocker, so are you running it on
>>> either your or your wife's PCs? If so, which? OOTTOMH, I would hazard
>>> a guess that your, the problem, PC is running it, but your wife's, which
>>> is reading the drive with no problem, is not? Also, did you ever
>>> encrypt the USB drive, either before or after reformatting it?
>>
>> I have never encrypted any drive, ever! It may have indexed, but
>> formatting should have taken care of that. BDESVC (Bitlocker
>> Encryption Service) is "Stopped" in Services, so it should not have
>> done anything to the SanDisk drive.
>
>Then seemingly we need to find out why BitLocker is getting involved
>when it shouldn't be.
>
>Can you post here what event, presumably a normal event rather than a
>warning or an error, is caused when you plug the SanDisk into the PC on
>which it works, I think it was your wife's? Ditto next section for the
>drivers?

I'm not sure this is what you are asking for, but when I plugged the
drive into my computer (doesn't work), Event Viewer showed three
entries: The first was the red Error which I have already posted.
Second was an Information entry "Virtual Disk Service ID 4" listed as
"Stopped" in the General tab and the xml entry listed here:

- <Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Virtual Disk Service" />
<EventID Qualifiers="16896">4</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2022-11-08T17:34:21.000000000Z" />
<EventRecordID>1651617</EventRecordID>
<Channel>System</Channel>
<Computer>MikesDesktop</Computer>
<Security />
</System>
- <EventData>
<Data>@2010001</Data>
</EventData>
</Event>

The third Information entry was "Service Control Manager ID 7036" that
said: "The Virtual Disk service entered the stopped state" in the
General tab, and the xml entry is here:

- <Event
xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager"
Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2022-11-08T17:34:21.484787100Z" />
<EventRecordID>1651618</EventRecordID>
<Correlation />
<Execution ProcessID="404" ThreadID="10696" />
<Channel>System</Channel>
<Computer>MikesDesktop</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">Virtual Disk</Data>
<Data Name="param2">stopped</Data>
<Binary>7600640073002F0031000000</Binary>
</EventData>
</Event>

When I plug the drive into my wife's computer, there is no entry in
the Event Viewer because there is no "event"! Stick works fine.

Here is a link to the driver details when I select "Properties,
Hardware" for the SanDisk Ultra drive. Top right is for the first
hardware entry, then bottom left for second, bottom right is for
third.

https://www.sendspace.com/file/qawl58

I don't know if this will mean anything or not, but after checking the
drive in my wife's computer when I plugged it into mine for the first
time, instead of being listed as "WPD FileSystem Volume Driver" as the
first enty for "Hardware", it said "Unknown device". I had it search
for a driver and it found "WPD FileSystem Driver" but gave a code 10
error saying it couldn't be installed because device wouldn't start.
Now when I plug it in it has the "WPD FileSystem Volume Driver" as the
first enty for "Hardware" again.
>
>This is what I get plugging in a FAT32 USB Stick which works:
>
>- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>- <System>
> <Provider Name="Service Control Manager"
>Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
>Control Manager" />
> <EventID Qualifiers="16384">7036</EventID>
> <Version>0</Version>
> <Level>4</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8080000000000000</Keywords>
> <TimeCreated SystemTime="2022-11-08T11:53:31.476503800Z" />
> <EventRecordID>111229</EventRecordID>
> <Correlation />
> <Execution ProcessID="684" ThreadID="4700" />
> <Channel>System</Channel>
> <Computer>Charles-I</Computer>
> <Security />
> </System>
>- <EventData>
> <Data Name="param1">Portable Device Enumerator Service</Data>
> <Data Name="param2">running</Data>
> <Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
> </EventData>
> </Event>
>
>>>>> Secondly, I've been looking again at the properties pages you provided
>>>>> for us. I have a working EasyDisk USB storage stick in this W7 PC at
>>>>> the moment ...
>>>>>
>>>>> B 1 In Device Manager, I <rt-click> it and choose Properties
>>>>>
>>>>> 2 I select the Driver tab. I have ...
>>>>> Microsoft
>>>>> 21/06/2006
>>>>> 6.1.7601.19133
>>>>> Microsoft Windows
>>>>> ... and clicking Driver Details gives me ...
>>>>> disk.sys
>>>>> partmgr.sys
>>>>> ... both in %WinDir%\System32\Drivers.
>>>>>
>>>>> What do you have?
>>>>
>>>> I have the same for the first part. Driver details gives me:
>>>>
>>>> C:Windows\system32\drivers\UMDF\WpdFs.dll
>>>> C:\Windows\system32\Drivers\WUDFRd.sys
>
>As described above, please repeat this for when the SanDisk is plugged
>into the PC on which it works.

On 08/11/2022 23:03, jetjock wrote:
>
> On Tue, 8 Nov 2022 12:01:53 +0000, Java Jive <java@evij.com.invalid>
> wrote:
>>
>> Then seemingly we need to find out why BitLocker is getting involved
>> when it shouldn't be.
>>
>> Can you post here what event, presumably a normal event rather than a
>> warning or an error, is caused when you plug the SanDisk into the PC on
>> which it works, I think it was your wife's? Ditto next section for the
>> drivers?
>
> I'm not sure this is what you are asking for, but when I plugged the
> drive into my computer (doesn't work), Event Viewer showed three
> entries: The first was the red Error which I have already posted.

[snip]

No, you've already posted the most important info from your PC.

> When I plug the drive into my wife's computer, there is no entry in
> the Event Viewer because there is no "event"! Stick works fine.

I suspect actually there is, as in my example from my previous post
still quoted immediately below, though it will be a normal event for
which the icon is an 'i' inside a grey circle, not a warning or an
error with exclamation mark icons as previously described. Also, the
event viewer doesn't auto-update, so you will have click elsewhere and
then click back on System to show it. By default, events are shown most
recent first, so examine the topmost one after you've clicked back on
System.

>> This is what I get plugging in a FAT32 USB Stick which works:
>>
>> - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>> - <System>
>> <Provider Name="Service Control Manager"
>> Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service
>> Control Manager" />
>> <EventID Qualifiers="16384">7036</EventID>
>> <Version>0</Version>
>> <Level>4</Level>
>> <Task>0</Task>
>> <Opcode>0</Opcode>
>> <Keywords>0x8080000000000000</Keywords>
>> <TimeCreated SystemTime="2022-11-08T11:53:31.476503800Z" />
>> <EventRecordID>111229</EventRecordID>
>> <Correlation />
>> <Execution ProcessID="684" ThreadID="4700" />
>> <Channel>System</Channel>
>> <Computer>Charles-I</Computer>
>> <Security />
>> </System>
>> - <EventData>
>> <Data Name="param1">Portable Device Enumerator Service</Data>
>> <Data Name="param2">running</Data>
>> <Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
>> </EventData>
>> </Event>
>
> Here is a link to the driver details when I select "Properties,
> Hardware" for the SanDisk Ultra drive. Top right is for the first
> hardware entry, then bottom left for second, bottom right is for
> third.
>
> https://www.sendspace.com/file/qawl58

The picture is somewhat unclear from being over compressed, but bottom
LH corner is the one that matters. I only have disk.sys and partmgr.sys
there, so you seem to have some extras.

While I can see some reason for the first of the extras, the Avast one,
and perhaps the second extra, fltsrv.sys, which apparently is an Acronis
driver, what is the third, vidsft.sys? What information do you see in
the bottom of the dialog box when you highlight it?

I need to see this same info for your wife's computer as well.

Also, there are still some outstanding questions from other posts:

One of your posts seems to imply that the startup settings on the
BitLocker service are different on the two machines. Please tell us the
exact settings on both.

More generally, the means of curing this is to compare the two machines,
the one that works against the one that doesn't. Upthread, at the end
of my mail of 7/11 14:24, I suggested that you compared the processes
running on both, and gave some instructions for doing so, labelled 'D'
to distinguish them from other sets of instructions in the same mail.
Did you ever get around to doing this?

--

Fake news kills!

I may be contacted via the contact address given on my website:
www.macfh.co.uk

On Tue, 8 Nov 2022 19:26:36 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 08/11/2022 17:22, jetjock wrote:
>>
>> Drive has never been encrypted (intentionally, anyway) by me. I have
>> checked "Services" on both computers and Bitlocker is either stopped
>> or disabled on both.
>
>So the startup settings on the BitLocker service are different on the
>two machines, the one that works and the one that doesn't? I'll hazard
>a guess, disabled on the one that works, automatic or manual on the one
>that doesn't? Please tell us the exact settings on both.

BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
"Stopped" and "Manual" on wife's (works) machine. Neither has ever
been turned on except yesterday when I turned mine on just to see if
that would make a difference...it didn't. It's "Stopped" now.
>
>More generally, the means of curing this is to compare the two machines,
>the one that works against the one that doesn't. Upthread, at the end
>of my mail of 7/11 14:24, I suggested that you compared the processes
>running on both, and gave some instructions for doing so, labelled 'D'
>to distinguish them from other sets of instructions in the same mail.
>Did you ever get around to doing this?

Sorry yesterday was a busy day and I must have missed that part,
Anyway, I did a side-by-side comparison and here is what I found:

On my computer, but not wife's:

01.anti_ransomware_service.exe *32 Acronis Active Protection Service
02.atkexComSvc.exe *32 Asus
03.BrStMonW.exe *32 Brother Staus Monitor
04.CS5Service Manager.exe *32 Adobe CS5 Service Mgr.
05.GoogleCrashHandler.exe *32 Google Crash Handler
06.GoogleCrashHandler.exe *64 Google Crash Handler
07.igfxCUIService.exe Intel Graphics Properties
08.igfxHK.exe Graphics Related Hotkeys
09.IntuitUpdateService.exe Self Explanatory
10.IPROSetMonitor.exe (See note at bottom)
11.iusb3mon.exe (See note at bottom)
12.nusb3mon *32 Renesas USB3 Card
13.OSPPSVC.EXE MS Office Protection Svc
14.ss_conn_service.exe (See note at bottom)
15.StkCSrv.exe No idea what this is! Says it's Syntek
Hardware Snapshot Launch Application. No
Clue what that is!

Note for 10. https://www.file.net/process/iprosetmonitor.exe.html
Note for 11. https://www.file.net/process/iusb3mon.exe.html
Note for 14.
https://www.freefixer.com/library/file/ss_conn_service.exe-149546/

There are a few other things on my machine not on wife's, but they are
self explanatory to me and not associated with the problem.

Here are a couple things on wife's processes that aren't on mine, but
I can't see either of them being applicable:

1.syncagentsrv.exe True Image Sync Agt. Serv.
2.wmpnetwk.exe Win Media Play Net Shar. Svc.

Sorry it took so long, but this was very time consuming. I hope some
of it is helpful! I have tried to add links and explanations where I
could using good old DuckDuckGo search.

>>>>>>>>>>jetjock<<<<<<<<<<

On Wed, 09 Nov 2022 14:41:15 -0600, jetjock <jetjock@unkown.com>
wrote:

>On Tue, 8 Nov 2022 19:26:36 +0000, Java Jive <java@evij.com.invalid>
>wrote:
>
>>On 08/11/2022 17:22, jetjock wrote:

This info didn't make it from the draft to the post.

You had asked:

> "While I can see some reason for the first of the extras, the Avast one,
> and perhaps the second extra, fltsrv.sys, which apparently is an Acronis driver,
> what is the third, vidsft.sys? What information do you see in the bottom of the
>dialog box when you highlight it?"

More strange happenings! I disabled Avast temporarily to see if that
might fix anything...it didn't, but when I enabled it again
\vidsflt.sys was gone and \iaStorF.sys Dialog says that the Provider
is Intel Corporation, File version 14.8.18.1066. Copyright Intel and
Digital Signer: Microsoft Windows Hardware Compatibility.

vidsflt.sys's description is "Acronis Virtual Disk Storage Filter"

iastorf.sys's description is "Intel Rapid Storage Technology Filter
driver - x64" Both of these were found doing a DuckDuckGo search at
Freefixer.com

Since the photos were very hard to read, it's not surprising you
missed the "l" in vidsflt.sys.
>>>
>>> Drive has never been encrypted (intentionally, anyway) by me. I have
>>> checked "Services" on both computers and Bitlocker is either stopped
>>> or disabled on both.
>>
>>So the startup settings on the BitLocker service are different on the
>>two machines, the one that works and the one that doesn't? I'll hazard
>>a guess, disabled on the one that works, automatic or manual on the one
>>that doesn't? Please tell us the exact settings on both.
>
>BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
>"Stopped" and "Manual" on wife's (works) machine. Neither has ever
>been turned on except yesterday when I turned mine on just to see if
>that would make a difference...it didn't. It's "Stopped" now.
>>
>>More generally, the means of curing this is to compare the two machines,
>>the one that works against the one that doesn't. Upthread, at the end
>>of my mail of 7/11 14:24, I suggested that you compared the processes
>>running on both, and gave some instructions for doing so, labelled 'D'
>>to distinguish them from other sets of instructions in the same mail.
>>Did you ever get around to doing this?
>
>Sorry yesterday was a busy day and I must have missed that part,
>Anyway, I did a side-by-side comparison and here is what I found:
>
>On my computer, but not wife's:
>
>01.anti_ransomware_service.exe *32 Acronis Active Protection Service
>02.atkexComSvc.exe *32 Asus
>03.BrStMonW.exe *32 Brother Staus Monitor
>04.CS5Service Manager.exe *32 Adobe CS5 Service Mgr.
>05.GoogleCrashHandler.exe *32 Google Crash Handler
>06.GoogleCrashHandler.exe *64 Google Crash Handler
>07.igfxCUIService.exe Intel Graphics Properties
>08.igfxHK.exe Graphics Related Hotkeys
>09.IntuitUpdateService.exe Self Explanatory
>10.IPROSetMonitor.exe (See note at bottom)
>11.iusb3mon.exe (See note at bottom)
>12.nusb3mon *32 Renesas USB3 Card
>13.OSPPSVC.EXE MS Office Protection Svc
>14.ss_conn_service.exe (See note at bottom)
>15.StkCSrv.exe No idea what this is! Says it's Syntek
> Hardware Snapshot Launch Application. No
> Clue what that is!
>
>Note for 10. https://www.file.net/process/iprosetmonitor.exe.html
>Note for 11. https://www.file.net/process/iusb3mon.exe.html
>Note for 14.
>https://www.freefixer.com/library/file/ss_conn_service.exe-149546/
>
>There are a few other things on my machine not on wife's, but they are
>self explanatory to me and not associated with the problem.
>
>Here are a couple things on wife's processes that aren't on mine, but
>I can't see either of them being applicable:
>
>1.syncagentsrv.exe True Image Sync Agt. Serv.
>2.wmpnetwk.exe Win Media Play Net Shar. Svc.
>
>Sorry it took so long, but this was very time consuming. I hope some
>of it is helpful! I have tried to add links and explanations where I
>could using good old DuckDuckGo search.
>
>
> >>>>>>>>>>jetjock<<<<<<<<<<

>>>>>>>>>>jetjock<<<<<<<<<<

On 10/11/2022 15:59, jetjock wrote:
>
> On Wed, 09 Nov 2022 14:41:15 -0600, jetjock <jetjock@unkown.com>
> wrote:
>>
>> On Tue, 8 Nov 2022 19:26:36 +0000, Java Jive <java@evij.com.invalid>
>> wrote:
>>
>>> On 08/11/2022 17:22, jetjock wrote:
>
> This info didn't make it from the draft to the post.
>
> You had asked:
>
>> "While I can see some reason for the first of the extras, the Avast one,
>> and perhaps the second extra, fltsrv.sys, which apparently is an Acronis driver,
>> what is the third, vidsft.sys? What information do you see in the bottom of the
>> dialog box when you highlight it?"
>
> More strange happenings! I disabled Avast temporarily to see if that
> might fix anything...it didn't, but when I enabled it again
> \vidsflt.sys was gone and \iaStorF.sys Dialog says that the Provider
> is Intel Corporation, File version 14.8.18.1066. Copyright Intel and
> Digital Signer: Microsoft Windows Hardware Compatibility.

Should be fine.

> vidsflt.sys's description is "Acronis Virtual Disk Storage Filter"

Sounds like either a driver for imaging disks, or one for making the
resulting files of disk images to appear as virtual disks. As I don't
use Acronis, I'm not sure which, but others may be able to help.

> iastorf.sys's description is "Intel Rapid Storage Technology Filter
> driver - x64" Both of these were found doing a DuckDuckGo search at
> Freefixer.com

Fine.

We know that the above is different from my machine, but the best
comparison to make here would be with your wife's machine, as that is
using the same SanDisk, so, as previously requested, I'd like to see
this same driver information from your wife's computer as well.

However, I'll stick my neck out now and say that this is beginning to
look like some sort of obscure and unwanted interaction between one or
more of these extra drivers/processes. Particularly, it sometimes
happens that running two AV or similar services at the same time can
cause unwanted interactions between the two, so one thing you could try
is temporarily ...

1 Disable both Avast and Acronis, reboot, and try the SanDisk again;

2 Re-enable only, say, Avast, reboot, and try again;

3 Disable the first and re-enable only the second, reboot, and try again;

4 Re-enable both, reboot and try again.

>>>> Drive has never been encrypted (intentionally, anyway) by me. I have
>>>> checked "Services" on both computers and Bitlocker is either stopped
>>>> or disabled on both.
>>>
>>> So the startup settings on the BitLocker service are different on the
>>> two machines, the one that works and the one that doesn't? I'll hazard
>>> a guess, disabled on the one that works, automatic or manual on the one
>>> that doesn't? Please tell us the exact settings on both.
>>
>> BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
>> "Stopped" and "Manual" on wife's (works) machine. Neither has ever
>> been turned on except yesterday when I turned mine on just to see if
>> that would make a difference...it didn't. It's "Stopped" now.

That's another thing you could try: copy the BitLocker settings from
your wife's PC to your own, reboot, and try again.

>>> More generally, the means of curing this is to compare the two machines,
>>> the one that works against the one that doesn't. Upthread, at the end
>>> of my mail of 7/11 14:24, I suggested that you compared the processes
>>> running on both, and gave some instructions for doing so, labelled 'D'
>>> to distinguish them from other sets of instructions in the same mail.
>>> Did you ever get around to doing this?
>>
>> Sorry yesterday was a busy day and I must have missed that part,
>> Anyway, I did a side-by-side comparison and here is what I found:
>>
>> On my computer, but not wife's:
>>
>> 01.anti_ransomware_service.exe *32 Acronis Active Protection Service

May be involved in some sort of interaction, as described above.

>> 02.atkexComSvc.exe *32 Asus

Should be fine.

>> 03.BrStMonW.exe *32 Brother Staus Monitor

Should be fine, though see note below.

>> 04.CS5Service Manager.exe *32 Adobe CS5 Service Mgr.

See note below.

>> 05.GoogleCrashHandler.exe *32 Google Crash Handler
>> 06.GoogleCrashHandler.exe *64 Google Crash Handler

I uninstalled Chrome when an update to it hi-jacked all my browser
settings to make it the default browser without so much as a
by-your-leave, and it took re-imaging the PC from a back-up to put
things back to how they were before. Even then, ISTR that it still left
some shit rather like this behind which I had to uninstall manually. Do
you use Chrome, or any other Google software? If not, certainly disable
these. If you do, I suspect that it shouldn't be loading both 64 and
32-bit versions - one or the other perhaps, but not both, but anyway,
IIRC, all it's doing is hanging around waiting to report any crashes to
Google, so see note below.

>> 07.igfxCUIService.exe Intel Graphics Properties
>> 08.igfxHK.exe Graphics Related Hotkeys
Fine.

>> 09.IntuitUpdateService.exe Self Explanatory

Probably fine, but see note below.

>> 10.IPROSetMonitor.exe (See note at bottom)

Wifi configuration, should be fine.

>> 11.iusb3mon.exe (See note at bottom)

Fine.

>> 12.nusb3mon *32 Renesas USB3 Card

Should be fine.

>> 13.OSPPSVC.EXE MS Office Protection Svc

Fine, but you can set this one to Manual, see note below

>> 14.ss_conn_service.exe (See note at bottom)

Samsung USB phone driver. Fine.

>> 15.StkCSrv.exe No idea what this is! Says it's Syntek
>> Hardware Snapshot Launch Application. No
>> Clue what that is!

Seems to handle taking snapshots from webcam. Probably fine.

>> There are a few other things on my machine not on wife's, but they are
>> self explanatory to me and not associated with the problem.
>>
>> Here are a couple things on wife's processes that aren't on mine, but
>> I can't see either of them being applicable:
>>
>> 1.syncagentsrv.exe True Image Sync Agt. Serv.

Image backup service. See note below.

>> 2.wmpnetwk.exe Win Media Play Net Shar. Svc.

Running when windows media player is or has been running. Fine.

Note: Generally, you have a great deal of bloatware running, by which I
mean things constantly running in the background that don't really need
to be.

So-called 'quick launch services' are the classic examples of these.
Adobe used to install a service whose sole purpose was to load all the
necessary DLLs for its reader on the off-chance that you might want to
read a PDF, but, if you didn't, and all the time until you did, it was
sitting in the background consuming system resources such as page file
space, just so that if you happened to double-click a PDF the reader
would appear to load more quickly than otherwise it would have.
Effectively all quick launchers achieve is to make particular software
appear faster than it really is by making its host machine genuinely
slower than it really needs to be.

Software updaters are another. There is no need to be constantly
monitoring websites for updates, for non-security software, a
half-daily, daily, weekly, or monthly Task Scheduler job should be able
to launch a one-off check that exits once completed.

Another is control and status monitors for hardware such as printers.
These only need to be loaded when you are actually using the hardware
such as printing something. There may be something in its settings that
you can change to make this to happen.

Your wife's machine has one too, the imaging backup service. Most
machines don't change often enough that a constantly running image back
up needs to be made, something like a weekly or monthly image is
adequate for most people, and, at least in principle, this could be done
either manually or by Task Scheduler. However, as I backup my PCs
manually using Ghost, I can't comment on how best to set up True Image.

By such bloatware, a perfectly specced machine is made to seem slow and
outdated, and you are persuaded to upgrade it to a newer one! A further
complication is that the more such bloatware you have running, the more
likely it will be that you have some unanticipated and obscure
interaction, such as may be happening here.

I always recommended disabling such bloatware, either by disabling the
service in the case of quick launchers, or by setting the startup mode
of the service from Automatic to Manual in the case of things like
status monitors, etc. You may care to experiment along these lines, but
make careful and accurate notes of from what to what you change while
doing so, so that if you break something it can easily be restored.

On 11/10/2022 1:14 PM, Java Jive wrote:
> On 10/11/2022 15:59, jetjock wrote:
>
>> vidsflt.sys's description is "Acronis Virtual Disk Storage Filter"
>
> Sounds like either a driver for imaging disks, or one for making the resulting
> files of disk images to appear as virtual disks.  As I don't use Acronis,
> I'm not sure which, but others may be able to help.

Acronis are the Kings Of Services. They add multiple services
to a product, as a kind of "architecture statement". Not out of
any practical point.

The one in question, is likely installed for every product
Acronis makes.

There was one service Acronis made, where Acronis did not know
how to remove it. So if you used the uninstaller, it stayed
behind. It took a comment in their forum, from a user, to
fix that. The user explained the operation order needed to
remove their service. Acronis then added that to their product
so future installs worked better.

I only ran into an issue with that, when a test install I'd done
of something Acronis two years before, was preventing something
else Acronis from being installed. And it might well have been
that service, and I had to track down the removal recipe to fix up
my OS. I went back two years in backups, to find an OS where the
new Acronis product *did* install, and then I started looking at
possible root causes. Like maybe it was the Seagate version of
TIH or something.

Paul

On Thu, 10 Nov 2022 18:14:34 +0000, Java Jive <java@evij.com.invalid>
wrote:

>On 10/11/2022 15:59, jetjock wrote:
>>
>> On Wed, 09 Nov 2022 14:41:15 -0600, jetjock <jetjock@unkown.com>
>> wrote:
>>>
>>> On Tue, 8 Nov 2022 19:26:36 +0000, Java Jive <java@evij.com.invalid>
>>> wrote:
>>>
>>>> On 08/11/2022 17:22, jetjock wrote:
>>
>> This info didn't make it from the draft to the post.
>>
>> You had asked:
>>
>>> "While I can see some reason for the first of the extras, the Avast one,
>>> and perhaps the second extra, fltsrv.sys, which apparently is an Acronis driver,
>>> what is the third, vidsft.sys? What information do you see in the bottom of the
>>> dialog box when you highlight it?"
>>
>> More strange happenings! I disabled Avast temporarily to see if that
>> might fix anything...it didn't, but when I enabled it again
>> \vidsflt.sys was gone and \iaStorF.sys Dialog says that the Provider
>> is Intel Corporation, File version 14.8.18.1066. Copyright Intel and
>> Digital Signer: Microsoft Windows Hardware Compatibility.
>
>Should be fine.
>
>> vidsflt.sys's description is "Acronis Virtual Disk Storage Filter"
>
>Sounds like either a driver for imaging disks, or one for making the
>resulting files of disk images to appear as virtual disks. As I don't
>use Acronis, I'm not sure which, but others may be able to help.
>
>> iastorf.sys's description is "Intel Rapid Storage Technology Filter
>> driver - x64" Both of these were found doing a DuckDuckGo search at
>> Freefixer.com
>
>Fine.
>
>We know that the above is different from my machine, but the best
>comparison to make here would be with your wife's machine, as that is
>using the same SanDisk, so, as previously requested, I'd like to see
>this same driver information from your wife's computer as well.
>
>However, I'll stick my neck out now and say that this is beginning to
>look like some sort of obscure and unwanted interaction between one or
>more of these extra drivers/processes. Particularly, it sometimes
>happens that running two AV or similar services at the same time can
>cause unwanted interactions between the two, so one thing you could try
>is temporarily ...
>
>1 Disable both Avast and Acronis, reboot, and try the SanDisk again;

Not possible. I can disable Acronis but the only way to shut down
Avast is to un-install it. Whenever I try to stop the process it
throws an access denied.

I am officially throwing in the towel! I can't tell you much I
appreciate all the help you have provided. I'm just sorry we weren't
able to solve the mystery. I guess I'll just have to use that drive on
other computers. It will be interesting to see what happens when the
new drive gets here later today. If my machine won't recognize it, I
guess it's time for a Windows re-install. :-( Thanks again!!
>
>2 Re-enable only, say, Avast, reboot, and try again;
>
>3 Disable the first and re-enable only the second, reboot, and try again;
>
>4 Re-enable both, reboot and try again.
>
>>>>> Drive has never been encrypted (intentionally, anyway) by me. I have
>>>>> checked "Services" on both computers and Bitlocker is either stopped
>>>>> or disabled on both.
>>>>
>>>> So the startup settings on the BitLocker service are different on the
>>>> two machines, the one that works and the one that doesn't? I'll hazard
>>>> a guess, disabled on the one that works, automatic or manual on the one
>>>> that doesn't? Please tell us the exact settings on both.
>>>
>>> BDESVC is "Stopped" & "Disabled on my (doesn't work) computer and
>>> "Stopped" and "Manual" on wife's (works) machine. Neither has ever
>>> been turned on except yesterday when I turned mine on just to see if
>>> that would make a difference...it didn't. It's "Stopped" now.
>
>That's another thing you could try: copy the BitLocker settings from
>your wife's PC to your own, reboot, and try again.
>
>>>> More generally, the means of curing this is to compare the two machines,
>>>> the one that works against the one that doesn't. Upthread, at the end
>>>> of my mail of 7/11 14:24, I suggested that you compared the processes
>>>> running on both, and gave some instructions for doing so, labelled 'D'
>>>> to distinguish them from other sets of instructions in the same mail.
>>>> Did you ever get around to doing this?
>>>
>>> Sorry yesterday was a busy day and I must have missed that part,
>>> Anyway, I did a side-by-side comparison and here is what I found:
>>>
>>> On my computer, but not wife's:
>>>
>>> 01.anti_ransomware_service.exe *32 Acronis Active Protection Service
>
>May be involved in some sort of interaction, as described above.
>
>>> 02.atkexComSvc.exe *32 Asus
>
>Should be fine.
>
>>> 03.BrStMonW.exe *32 Brother Staus Monitor
>
>Should be fine, though see note below.
>
>>> 04.CS5Service Manager.exe *32 Adobe CS5 Service Mgr.
>
>See note below.
>
>>> 05.GoogleCrashHandler.exe *32 Google Crash Handler
>>> 06.GoogleCrashHandler.exe *64 Google Crash Handler
>
>I uninstalled Chrome when an update to it hi-jacked all my browser
>settings to make it the default browser without so much as a
>by-your-leave, and it took re-imaging the PC from a back-up to put
>things back to how they were before. Even then, ISTR that it still left
>some shit rather like this behind which I had to uninstall manually. Do
>you use Chrome, or any other Google software? If not, certainly disable
>these. If you do, I suspect that it shouldn't be loading both 64 and
>32-bit versions - one or the other perhaps, but not both, but anyway,
>IIRC, all it's doing is hanging around waiting to report any crashes to
>Google, so see note below.
>
>>> 07.igfxCUIService.exe Intel Graphics Properties
>>> 08.igfxHK.exe Graphics Related Hotkeys
>Fine.
>
>>> 09.IntuitUpdateService.exe Self Explanatory
>
>Probably fine, but see note below.
>
>>> 10.IPROSetMonitor.exe (See note at bottom)
>
>Wifi configuration, should be fine.
>
>>> 11.iusb3mon.exe (See note at bottom)
>
>Fine.
>
>>> 12.nusb3mon *32 Renesas USB3 Card
>
>Should be fine.
>
>>> 13.OSPPSVC.EXE MS Office Protection Svc
>
>Fine, but you can set this one to Manual, see note below
>
>>> 14.ss_conn_service.exe (See note at bottom)
>
>Samsung USB phone driver. Fine.
>
>>> 15.StkCSrv.exe No idea what this is! Says it's Syntek
>>> Hardware Snapshot Launch Application. No
>>> Clue what that is!
>
>Seems to handle taking snapshots from webcam. Probably fine.
>
>>> There are a few other things on my machine not on wife's, but they are
>>> self explanatory to me and not associated with the problem.
>>>
>>> Here are a couple things on wife's processes that aren't on mine, but
>>> I can't see either of them being applicable:
>>>
>>> 1.syncagentsrv.exe True Image Sync Agt. Serv.
>
>Image backup service. See note below.
>
>>> 2.wmpnetwk.exe Win Media Play Net Shar. Svc.
>
>Running when windows media player is or has been running. Fine.
>
>Note: Generally, you have a great deal of bloatware running, by which I
>mean things constantly running in the background that don't really need
>to be.
>
>So-called 'quick launch services' are the classic examples of these.
>Adobe used to install a service whose sole purpose was to load all the
>necessary DLLs for its reader on the off-chance that you might want to
>read a PDF, but, if you didn't, and all the time until you did, it was
>sitting in the background consuming system resources such as page file
>space, just so that if you happened to double-click a PDF the reader
>would appear to load more quickly than otherwise it would have.
>Effectively all quick launchers achieve is to make particular software
>appear faster than it really is by making its host machine genuinely
>slower than it really needs to be.
>
>Software updaters are another. There is no need to be constantly
>monitoring websites for updates, for non-security software, a
>half-daily, daily, weekly, or monthly Task Scheduler job should be able
>to launch a one-off check that exits once completed.
>
>Another is control and status monitors for hardware such as printers.
>These only need to be loaded when you are actually using the hardware
>such as printing something. There may be something in its settings that
>you can change to make this to happen.
>
>Your wife's machine has one too, the imaging backup service. Most
>machines don't change often enough that a constantly running image back
>up needs to be made, something like a weekly or monthly image is
>adequate for most people, and, at least in principle, this could be done
>either manually or by Task Scheduler. However, as I backup my PCs
>manually using Ghost, I can't comment on how best to set up True Image.
>
>By such bloatware, a perfectly specced machine is made to seem slow and
>outdated, and you are persuaded to upgrade it to a newer one! A further
>complication is that the more such bloatware you have running, the more
>likely it will be that you have some unanticipated and obscure
>interaction, such as may be happening here.
>
>I always recommended disabling such bloatware, either by disabling the
>service in the case of quick launchers, or by setting the startup mode
>of the service from Automatic to Manual in the case of things like
>status monitors, etc. You may care to experiment along these lines, but
>make careful and accurate notes of from what to what you change while
>doing so, so that if you break something it can easily be restored.