Unknown virtual drive in my system

vbimport

#1

Hi all,

I have a strange virtual cd rom device in my device manager. The drive is called UBK 6N89A3S SCSI CdRom Device. I have tried to uninstall the drive through device manager, but it reappears after every system reboot. The virtual drive also occupies one drive letter.

I am using Deamon tools, but this UBK drive seemingly unrelated to Daemon (i cant remove it through it). Any idea what this could be and how to get rid of it?

Thanks


#2

Why do you thing it’s unrelated to Daemon, do you have any other virtual drive software installed?


#3

@molnart
Most diverse hardware can create virtual drives to install its drivers/software,
e.g. WD SmartWare or some UMTS USB sticks.

Do you have any new hardware ?


#4

The phantom virtual drive is not listed in daemon tools, furthermore when i uninstall daemon, this drive is still present. I do not have any new hardware, however i dont remember exactly when the phantom drive appeared. is there any possible way to determine which program can it belong to?


#5

What can you find under “SCSI controllers” in device manager?

Michael


#6

I have no SCSI controllers group in device manager, however under Storage controllers there is something called “A48QH4MP IDE controller”. I have a suspicion these two are somehow related. The controller points to A48QH4MP.SYS driver which claims to be from intel… A trojan maybe???


#7

What are the details of that file? Driver information etc. is needed.

For me, this looks somewhat related to Deamon Tools IDE emulation (available with the Pro variant?)

Michael


#8

@molnart
In addition, have you ever installed any KernSafe product (LINK) ?


#9

i never had any reason to install some SCSI relared stuff…

but now the strangest thing ever: the IDE controller suddenly changes its name to AANB02EX and the driver to AANB02EX.SYS. Device manager claims that the drive resides in the c:\Windows\System32\drivers directory, but no such file can be found there (nor anywhere else in the system, at least a search did not return anything)…

I am getting really confused…


#10

Download hijackthis and run it. Look at the files it throws up, the answer may be there.


#11

If it changes the name it indeed seems to be a leftover of DAEMON Tools.

DAEMON Tools is using its own access layer for the virtual drives (optional since version 4.40).
Please uninstall SPTD using the standalone installer from here: http://www.duplexsecure.com/downloads/


#12

thanks, problem solved by uninstalling SPTD… and i thought the recent versions were quite OK, but appareantly its still the buggy shit it was prior to versions 1.60 :frowning:


#13

In DT’s defense i like to add that this very problem seems to be very rare

  • at least according to its frequency of occurrence in the DT support forums.