Windows Secrets

Subscribers: Sign in

Enter your e-mail address to get a free subscription.
We guarantee your privacy
Skip to content
  • Home
  • Newsletter Archives
    • Current
    • LangaList Plus
    • Patch Watch
    • Wacky Web Week
    • Security Baseline
  • WinDeals
  • E-Books
  • Lounge
  • Polls
  • About us
    • Refunds
    • Privacy Policy
    • Advertise
  • Contact
  • Your Account
    • Upgrade
    • Preferences
    • Bonus Download
    • Unsubscribe
Home>How to prevent and remove 'phantom' devices

Windows Secrets Newsletter • Issue 102 • 2007-04-05 • Circulation: over 400,000


Table of contents 
  • LangaList Plus: How to prevent and remove ‘phantom’ devices
  • Wacky Web Week: Download gets a whole new meaning
  • LangaList Plus: Securing your wireless network with WPA2
  • Perimeter Scan: Don’t rule out third-party security patches
  • Patch Watch: Patch animated cursors, don’t install 2003 SP2

 
LangaList Plus

How to prevent and remove ‘phantom’ devices

Fred Langa 1 How to prevent and remove phantom devices By Fred Langa

A little ghostbusting is all it takes to free your system of nonexistent devices.

Windows sometimes displays USB drives and other removable devices that are no longer connected to your system. Here’s how to cure the problem and prevent it from happening again.

Keep phantom devices at bay

Have you ever had Windows show you a device — perhaps a USB drive or other removable device — that’s no longer connected to your system? When this happens, you can run into trouble if software tries to access the phantom device.

Or, because the nonexistent device is still consuming a drive letter assignment and/or other resources, you may have problems when you add additional devices that need the already-assigned resources. I’ve seen some cases where people were running out of drive letters because their systems were maintaining a whole flock of phantom drives!

Let’s begin with ways to prevent the phantom devices from appearing in the first place. Then, we’ll come back to removing any that may already be there.

Phantom devices can appear for any number of reasons. Perhaps the most common reason is a shutdown error with a removable drive. Most people don’t know this, but there are actually three different ways to disconnect a removable drive. Two are correct, and one isn’t.

Here’s the official word from Microsoft on the two correct ways of removing an external or hot-swappable disk (or other device), as described in the Windows XP Professional Resource Kit:
  • “If the Safely Remove Hardware icon appears in the taskbar notification area, you must use [it]. If the Safely Remove Hardware icon is not in the notification area, you must use Device Manager to uninstall the disk before you unplug it.”
The third, improper method is the one almost all of us use: We simply unplug the device. In fact, this usually works, as long as the device isn’t actively being written to or read from. You unplug the device, hear the audible "device unplugged" confirmation tones (a descending "ding-dong"), and that’s that.

But note Microsoft’s use of the word "must" in the above quote: You must use the Safely Remove Hardware method — if it’s available. It’s not a mere suggestion or recommendation. Microsoft says it’s a must.

That’s because simply unplugging a device (the way most of us do) runs the risk of losing data through a delayed write, or open file, or similar problem. You also risk leaving behind a phantom drive or other resource assignment, because the OS doesn’t realize the device is gone.

You can avoid these problems by using either the Safely Remove Hardware method or the Device Manager method. They ensure that all writes or other pending operations are completed, that any open files are closed, and that the OS knows it can free up whatever resource assignments the device was using.

To put it another way, go ahead and simply unplug your removable devices if you wish. Most times, it’ll work perfectly fine. But if it doesn’t and you end up with phantom drives or other problems, you’ll know why!

Of course, there are still are some pitfalls you need to watch out for — after all, this is Windows we’re talking about, and nothing is quite as simple as we might wish. Plus, there remains the question of what to do if your system is already carrying a flock of phantom drives. I’ll cover that in the items below.

Restoring the HotPlug Manager

OK, so know we know that we’re supposed to use the Safely Remove Hardware method to disconnect removable devices. But what happens if the Safely Remove Hardware icon goes AWOL on you? Or, what if you click it, but it doesn’t do anything? And what if you already have phantom drives on your system? How do you get rid of them?

The Safely Remove Hardware icon is actually a shortcut to Windows’ HotPlug Manager. This service normally launches automatically when you connect a recognized USB or Firewire device to your system.

langa 20070405 How to prevent and remove phantom devices
Figure 1. The HotPlug Manager can be accessed via the Safely Remove Hardware icon, which normally appears in the Notification Area by the clock.

But, as with all software, things sometimes go awry. The HotPlug Manager occasionally hangs or fails to launch, meaning that the Safely Remove Hardware icon won’t appear, even when you know it should. In this case, the simple fix is to manually launch the HotPlug Manager by opening the Start, Run dialog and typing the following:

RunDll32.exe shell32.dll,Control_RunDLL HotPlug.dll

Click OK, and the HotPlug Manager’s Safely Remove Hardware icon should appear. Its dialog box should open and display any connected devices. That’s all it takes!

If only it were so simple. Unfortunately, not all devices cooperate with the HotPlug Manager. If you connect an unrecognized device to your system and the Safely Remove Hardware icon doesn’t appear — and manually launching the HotPlug Manager doesn’t help — it may be that the device simply won’t work with the HotPlug Manager. (It’s not very common, but it happens.)

To safely remove such an unrecognized device, you’ll have to use Device Manager to uninstall the device prior to disconnecting. (One way to access Device Manager is via Control Panel, Performance & Maintenance, System, Hardware, Device Manager.)

You may sometimes encounter a separate problem, too: The Safely Remove Hardware icon may be present, but won’t do anything when you click it. This problem doesn’t affect many systems, but if it affects yours, Microsoft has a hotfix for you — KB 883517.

The techniques above will help you properly shut down and remove devices from your system and should keep phantom devices from populating your system in the future. But, if you already have such phantoms in your PC, here’s the quick-and-dirty method I use when I have to clean up any kind of ghost device in my system, or when a known-good device’s settings become hopelessly bollixed:

Open Device Manager and uninstall not only the offending device itself, but also (if possible) any device that directly controls the offending device. On reboot, Windows will rediscover and reinstall the hardware, freshly reconfiguring the devices that are present and ridding the system of ghost devices.

For example, if I’m having a problem with disk drives, I may uninstall the drives and the drive controllers in Device Manager. On reboot, Windows will rediscover the controllers first, and then set up the drives afresh.

Or, if I’m having a USB problem, I’ll uninstall the USB Root Hubs and Controllers in Device Manager. On reboot, Windows will sort things out from scratch, leaving behind a freshly-configured, phantom-free setup.

This brute-force approach surely isn’t elegant, but it’s fast and it works. And, if you have current and complete backups, there’s essentially no risk to it.

Free virtual CD-ROM drive from Microsoft

I recently rediscovered a nifty free tool from Microsoft. You may find it useful, too.

It’s the Microsoft Virtual CD-ROM Control Panel. The download is a self-extracting archive that contains three files: the front end (VCdControlTool.exe), the virtual CD driver (VCdRom.sys), and a readme file. The latter contains the basic instructions for using the tool.

To understand how it works, you need to know about ISO files — a kind of disk image of a standard CD. Many large downloadable software packages (including most Linux distributions) are packaged as ISO files. These files contain not only the data that’s on the original CD, but also information about how the CD is structured and formatted.

Normally, an ISO file has to be processed by special software to separate the stored data from the formatting information. The software then uses the formatting data in the ISO file to burn an exact duplicate of the original CD’s contents. Most normal CD-burning tools have a built-in way to do this. In Roxio’s Creator Classic, for example, it’s under the Record Disc From Image option on the File menu.

But sometimes, you don’t want the entire contents of a CD. You may instead just want to extract one file from the ISO image. Or, perhaps you’d like to test-drive software before committing it to a physical CD. Or, you may be in a situation (such as with a laptop computer) where you only have one CD drive but would like to be able to access two or more CDs simultaneously. Or, maybe you’re bogged down by having to process large amounts of data from a relatively slow CD, and you’d much prefer to access the data at hard-drive speeds.

That’s where the Virtual CD-ROM Control Panel comes in. It lets you mount an ISO file of a CD in one step, without having to burn it to an actual, physical CD first. You then have access to the full contents of the CD and can get at any or all of the data.

The Virtual CD-ROM Control Panel also lets you mount several images at once, each with its own drive letter. I don’t know what the upper limit is, but I’ve had as many as four ISOs mounted at once, in addition to the two real CD drives in my system. And, of course, because the ISO files actually reside on your hard drive, you can access them at normal hard-drive speeds, which are usually much, much faster than CD drives.

There are other, similar tools out there, but this one’s free, and works well. Very, very handy!

Another free tool — TCP/IP optimizer

Reader Wendell Britnell pointed out a nice addition to the information already presented in “Optimizing Your Network Connections” in the Mar. 15 issue. He visited Speedguide.net and was very impressed by its TCP/IP Analyzer and TCP/IP Optimizer.

For years, SpeedGuide.net lagged behind BroadbandReports.com. It seemed to remain focused primarily on dialup, even when cable, DSL, and other fast connections were becoming commonplace. After a while, I let the site fall off my radar.

But Wendell is right: Their current tools are up to date and very nice. What’s more, they’re even more automated than BroadbandReport’s. If you’re looking to get the most out of your online connections, Speedguide is back in business!

Thanks, Wendell!

Fred Langa edited the LangaList e-mail newsletter from 1997 to 2006, when it merged with Windows Secrets. Prior to that, he was editor of Byte Magazine and editorial director of CMP Media, overseeing Windows Magazine and others.

 
Wacky Web Week

Download gets a whole new meaning

W070405Google TiSP Download gets a whole new meaning If you think bathroom humor is limited to juveniles and mass media, think again. Just in time for April Fools’ Day comes Google’s announcement of TiSP — the Toilet Internet Service Provider. The gag service claims to offer free, ultra-high speed connectivity for your wireless-capable PC. The only catch is that you have to connect to their system via cables you run through your toilet and local sewers.

The Google TiSP pages include a press release (touting the trademarked GFlush system), an installation guide ("wash your hands before surfing"), and a FAQ page (explaining how DNA analysis of your, er, "personal output" helps Google send you highly targeted advertising). More info.


 
LangaList Plus

Securing your wireless network with WPA2

Mark Edwards 1 Securing your wireless network with WPA2 By Mark Joseph Edwards

Encryption isn’t any good if it can be easily cracked.

You need to use the best encryption available, which currently means using WPA2. This week, I explain WPA2 and why you should take a layered approach to security.


WPA2 secures wireless better than WEP or WPA

In the Mar. 8 newsletter, I talked about securing wireless routers. One of the suggestions I made was to enable encryption, if your router and wireless network cards support that feature. Doing so helps prevent someone from snooping in your network traffic and using your bandwidth.

There are three basic types of encryption for most wireless networks: Wired Equivalent Privacy (WEP), Wi-Fi Protected Access (WPA), and Wi-Fi Protected Access 2 (WPA2). When considering encryption, the basic thing you need to know is that encryption is accomplished using some type of cipher and some length of encryption key to scramble and unscramble the data.

WEP and WPA both use the RC4 stream cipher. WEP uses a 40-bit encryption key, while WPA uses a longer 128-bit key. Naturally, WPA provides stronger protection. WPA also uses dynamic keys, whereas WEP keys are static. Dynamic keys change at a interval, which adds to the strenth of WPA protection by making your keys a moving target.

WPA can also support 802.1X authentication. In very simplified terms, this is a logon mechanism that verifies who the user is. Without 802.1X in place, WPA isn´t as strong as it could be. In fact, some experts argue that without 802.1X, WPA isn´t much better than WEP.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.


 
Perimeter Scan

Don’t rule out third-party security patches

Ryan Russell 1 Dont rule out third party security patches By Ryan Russell

A new zero-day threat for Windows recently appeared on the Web in the form of animated cursors and other graphical objects that could silently infect your system.

This is yet another vulnerability that can compromise your PC if you simply view a Web page or read e-mail — and it even reportedly affects Firefox, as described by ZDNet blogger Ryan Naraine.


Microsoft’s patch didn’t come in time

According to the Microsoft Security Response Center blog, Microsoft was first notified about this vulnerability on Dec. 20, 2006, by a Determina security researcher. Microsoft also says it was made aware that the attack was being used in the wild on Mar. 28 by McAfee. The blog entry goes on to say that Determina is not to blame for leaking the flaw and speculates that it must have been discovered independently.

Microsoft released an emergency patch on Apr. 3, meaning that this exploit was being actively circulated for almost a week, if not longer.

I’m not going to blame Microsoft today for not predicting the future. What do you do when you’re aware that a zero-day attack is being used in the wild, but your vendor doesn’t have a patch. Do you sit back and take it, or do you craft your own mitigation strategy?

Microsoft doesn’t have a monopoly on patches

A third-party giving you a patch for someone else’s software is nothing new. After all, what was a floppy-disk copy-protection crack back in the ’80s but a special kind of binary patch? And, of course, small source patches are the norm in the open-source world.

But, in the recent past, there have been a handful of examples of binary patches to combat security holes in commercial software. I’m sure that if I looked hard, I could find examples of this from many years ago. The fact that people are doing it on a semi-regular basis now is what’s new.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.


 
Patch Watch

Patch animated cursors, don’t install 2003 SP2

Susan Bradley 1 Patch animated cursors, dont install 2003 SP2 By Susan Bradley

The first Tuesday of two Patch Tuesdays that are happening this month suddenly hit us this week.

It’s very important that you install Microsoft’s Apr. 3 patch to correct a serious security risk in Windows’ handling of icons and other images, but there are issues you need to know about.


MS07-017 (925902)
.Ani bug hits all Windows versions (yes, even Vista)

A threat is in the wild that affects everything from Windows 2000 all the way up to Windows Vista. In response, Microsoft released on Apr. 3 an out-of-cycle patch, MS07-017 (925902). This is an unusual patch that requires your immediate attention. (Microsoft’s usual, monthly batch of patches is expected to be released on Apr. 10, the second Tuesday of the month.)

Before you install the MS07-017 patch, be aware that Microsoft found an issue impacting Windows XP and 2003 machines. Knowledge Base article 935448 documents this issue, which prevents Realtek’s HD Audio Control Panel (see Figure 1, below) from running after the patch is installed. If this problem affects you, you’ll see the following error message after you apply the patch:

“Error on reboot: RTHDCPL.EXE IIlegal System Relocation. The System DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:Windowssystem32HHCTRL.OCX occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.”

Susan W070405 Realtek Patch animated cursors, dont install 2003 SP2
Figure 1: Microsoft found an issue with patch MS07-017 that prevents Realtek’s HD Audio Control Panel (shown above) from running after the patch is installed.

This article is part of our paid content. Subscribe.

Already a paid subscriber? Click here to login.


YOUR SUBSCRIPTION

The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets is a continuation of four merged publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008.

Publisher: WindowsSecrets.com, 1218 Third Ave., Suite 1515, Seattle, WA 98101 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine).

Editor in chief: Tracey Capen. Senior editors: Fred Langa, Woody Leonhard. Copyeditor: Roberta Scholz. Program director: Tony Johnston. Contributing editors: Yardena Arar, Susan Bradley, Scott Dunn, Michael Lasky, Scott Mace, Ryan Russell, Lincoln Spector, Robert Vamosi, Becky Waring. Product manager: Andy Boyd. Advertising director: Eric Gilley.

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com. All other marks are the trademarks or service marks of their respective owners.

HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page.

WE GUARANTEE YOUR PRIVACY:

1. We will never sell, rent, or give away your address to any outside party, ever.
2. We will never send you any unrequested e-mail, besides newsletter updates.
3. All unsubscribe requests are honored immediately, period.  Privacy policy

HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
  • Visit our Unsubscribe page.
Copyright © 2012 by WindowsSecrets.com. All rights reserved.

Table of contents

Top-scoring articles in the past 12 months
  • Leaving long cookie trails throughout the Web 5.00
  • Windows-like security for Android devices 5.00
  • Win7′s no-reformat, nondestructive reinstall 4.56
  • LizaMoon infection: a blow-by-blow account 4.46
  • RPV: Win7′s least-known data-protection system 4.35
  • Recovery: the last step in total data security 4.31
  • The sorry tale of the (un)Secure Sockets Layer 4.30
  • Time for a .NET update we can’t ignore 4.30
  • Getting the most from Windows Search — Part 1 4.25
  • Revising printing habits saves money and trees 4.25
  • Upgrades end in erratic, partial hangs 4.25
  • Get wired performance from your Wi-Fi network 4.24
  • Caution: Bumps in the road to IPv6 4.23
  • Patch Watch adds problem-patch update chart 4.23
  • ZeuS Trojan reinvents itself as bots rock on 4.22
  • Pros and cons of a ‘keyfile’ password 4.21
  • April brings showers of browser patches 4.20
  • Readers comment on the LizaMoon infection story 4.20
  • Office 2007 gets its final service pack 4.19
  • Putting Registry-/system-cleanup apps to the test 4.19
  • The advanced system-recover toolkit 4.18
  • One year and 99 security bulletins later 4.18
  • Don’t pay for software you don’t need — Part 3 4.17
  • What to do when Windows refuses to boot 4.17
  • Make the most of Windows 7′s Libraries 4.16
  • Keeping you up to date: say no to .NET — again 4.16
  • Internet Explorer gets another round of patches 4.15
  • Vacation’s over; it’s a big round of patches 4.15
  • Big-time Wi-Fi security for the small office 4.14
  • Office File Validation patch leads to problems 4.14
Connect with us Follow us on Twitter Connect with us on Facebook View our RSS Feeds
  • Home|
  • Newsletter|
  • About Windows Secrets|
  • Advertise with us|
  • Unsubscribe|
  • Sitemap|
  • Affiliates|
Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of iNET Interactive. All other marks are the trademarks or service marks of their respective owners.
iNET Interactive Copyright © 2011 iNET Interactive.
All rights reserved.
Terms of Use  |  Privacy Policy
Internet Services
  • Web Hosting Talk
  • HostingCon
  • Hosting Catalog
  • Host Voice
Web Development
  • Hot Scripts
  • DB Forums
Digital Marketing
  • ABestWeb
  • Search Marketing Standard
  • PayPerClickUniverse
  • SEMCompare
Consumer Tech
  • Windows Secrets
  • Overclockers
  • Mac Forums

Learn more about
advertising opportunities across the iNET Interactive Network.

LiquidWeb