Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

All File transfers hang. No virus!


  • Please log in to reply

#226
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

Installed it. Still speed warning.


  • 0

Advertisements


#227
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

Have you tried the Epson on another PC?


  • 0

#228
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

No, but the TableMike still shows the speed warning also.


  • 0

#229
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

If I read your specs correctly you have both front and back USB connections.  Do you see any difference between them?


  • 0

#230
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

No differences.


  • 0

#231
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

Hi I just did a Sophos Virus Removal scan and it showed the following:

2018-10-05 16:59:09.408    >>> Virus 'Mal/Generic-S' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2018-10-05 16:59:09.408    >>> Virus 'Mal/Generic-S' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2018-10-05 16:59:09.408    >>> Virus 'Mal/Generic-S' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2018-10-05 16:59:09.408    >>> Virus 'Mal/Generic-S' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

 

After backing up the keys above, I allowed Sophos to clean.

Upon restart, the speed warning still showed and my Micrsoft apps prompted me to enter my user name, crashed, hanged, warned they couldn't connect to registry etc. Also Homegroup, user folder and all sorts of standard windows shortcuts appeared, and I couldn't delete them.

System restore didn't help, so I ended up having to launch the backup keys to load them back into registry and the new problems were resolved.


  • 0

#232
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

Sounds like a false positive and they removed something you needed.

 

Have you run an ESET scan?

 

This is an old writeup so they may have changed things:

 

Use IE and go to https://www.eset.com...online-scanner/

  and click on SCAN NOW under ESET online Scanner.  Accept the terms then press Start (If you get a warning from your browser tell it you want to run it).  

IF you don't use IE it will still work but you must download a program and run it.

# Check Scan Archives
# Push the Start button.
# ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
# When the scan completes, push LIST OF THREATS FOUND
# Push EXPORT TO TEXT FILE , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
# Push the BACK button.
# Push Finish
# Once the scan is completed, you may close the window.
# Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
# Copy and paste that log as a reply.

 


  • 0

#233
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

Export

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\usbccgp

 

I was looking back to before you went on your trip and it seems strange that your

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci

 

should have an AMD reference.  On mine all three have the same "DriverPackageId"


  • 0

#234
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

Attached File  usbehci.reg   1.68KB   53 downloads

Attached File  usbccgp.reg   1.54KB   52 downloads


Edited by phickspc, 07 October 2018 - 06:53 AM.

  • 0

#235
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

I've asked for exports of these same reg keys.  Have to wait until I get them.  What seems strange is

 

"DriverPackageId"="usb.inf_amd64_neutral_e2b28ecac19a29af"

 

Do you have a folder of that name?  Probably stored at:

 

C:\Windows\System32\DriverStore\FileRepository\

 

What files are in it?
 


  • 0

Advertisements


#236
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

I've provided the exports in my last post, do you mean you're waiting for them from someone else?

Folder "usb.inf_amd64_neutral_e2b28ecac19a29af"

doesn't exist

in C:\Windows\System32\DriverStore\FileRepository\


  • 0

#237
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

Attached File  usb inf folders.zip   629.4KB   43 downloads

Here's a zip file of 3 similarly named folders I did find

in C:\Windows\System32\DriverStore\FileRepository\

 


  • 0

#238
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

Yes, I've asked on our internal forum for someone to export the keys for me so I can see what should be there.  Interesting that you do not have the folder the registry thinks you do but do have 3 others with similar names.


  • 0

#239
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,166 posts
  • MVP

No response yet from the girl who usually exports reg keys for me.

 

On my Win 7 64 I see that it refers to a non existent folder too and Win 10 no longer bothers with the key so it's probably not important.

 

 

Open an elevated command prompt (admin)

 

sc start   usbccgp

 

This is the service that your scanner probably uses.  Does it say it is already running?

 

How about

 

sc start usbohci

 

sc start usbuhci

 

Are either of them running?

 

sc start usbehci

 

is still running I assume?  This is supposed to be the 2.0 service.


  • 0

#240
phickspc

phickspc

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 478 posts

C:\Windows\system32>sc start   usbccgp
[SC] StartService FAILED 1056: An instance of the service is already running
C:\Windows\system32>sc start usbohci
[SC] StartService FAILED 1058: The service cannot be started, either because it is disabled or because it has n
o enabled devices associated with it.
C:\Windows\system32>sc start usbuhci 
[SC] StartService FAILED 1056: An instance of the service is already running.
C:\Windows\system32>sc start usbehci
[SC] StartService FAILED 1056: An instance of the service is already running.


Edited by phickspc, 10 October 2018 - 04:58 PM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP