Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: EagleGhost on January 17, 2011, 03:08:48 PM

Title: Can't remove external USB hard drive safely after 5.1.889
Post by: EagleGhost on January 17, 2011, 03:08:48 PM
After I installed the 5.1.889 (free) version I can't remove my USB hard drive safely. I was able to remove it safely with 5.0.x. Before I installed the 5.1.889 I ran the Removal Tool in safe mode. How can I remove the USB hard drive safely now? I tried to disable all the protections, but I still can't remove it safely. I also tried to kill Avast process, but it gives me an error. I'm using Windows 7 Home Premium x64.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 17, 2011, 03:33:01 PM
To remove it safely? Turn off the computer. Or you can uninstall the behavior shield by going to programs and features/avast/uninstall change.

It's a known issue. I mentioned that in your other post. http://forum.avast.com/index.php?topic=69405.msg583093#msg583093

@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.

http://forum.avast.com/index.php?topic=69367.0
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: EagleGhost on January 17, 2011, 05:15:32 PM
After I uninstalled Avast I can remove safely again. I installed AVG after I uninstalled Avast, but I will go back to Avast, when this issue (and the corrupted browser downloads issue too http://forum.avast.com/index.php?topic=69484.0) is fixed.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: gentle4ug on January 17, 2011, 09:34:26 PM
To remove it safely? Turn off the computer. Or you can uninstall the behavior shield by going to programs and features/avast/uninstall change.

It's a known issue. I mentioned that in your other post. http://forum.avast.com/index.php?topic=69405.msg583093#msg583093

@MikeRepairs, thanks for your report. Actually, it took some time to get a USB Flash Drive with hardware r/w locking to verify this issue (even for IT company :)). But finally, we can confirm that and it's currently under investigation...

@GaAs, you can't use user-mode tools for that. I got into the same situation as you, unable to safe remove my USB HDD or USB flash drive. It hasn't happened before. I think it might be still a problem with antirootkit.

http://forum.avast.com/index.php?topic=69367.0

Does uninstalling the Behavior Shield provide a viable work around?  I've got several external drives with extensive music/movie collections, can't afford to corrupt them and shutting down and rebooting is a pain.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: =SKY= on January 18, 2011, 02:09:16 AM
After I installed the 5.1.889 (free) version I can't remove my USB hard drive safely.

Hi EagleGhost,

same problem here: http://forum.avast.com/index.php?topic=69367.0 (http://forum.avast.com/index.php?topic=69367.0)

Edit:
Sorry gentle4ug, I've seen your comment to late... :-X
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: chandragor on January 18, 2011, 10:51:47 AM
To remove it safely? Turn off the computer.
??? ??? ???

I guess you were just joking. Or do you mean that just in order to remove my USB key I have to reboot my PC every time ?

And yes, I have this issue with every USB device I connect to my PCs (2 with XP SP3 PRO and one with XP SP3 HOME), since I upgraded directly from 5.0.667 to 5.1.889.

I use Avast Antivirus Free, and I never had this issue before (not even with previous version 4.xxx).

By now the only working workarounds are, as suggested:

1) Uninstall AVAST and replace it wit another antivirus (I won't even consider this !!!)

or

2) Uninstall AVAST 5.1.889 and revert to previous version 5.0.667 (which can be downloaded from sites like FileHippo)

or

3) Uninstall Behavior Shield, as you clearly suggested in your post.

I personally chose option 3, even if I'm not sure which one of 2 or 3 is better. Any suggestion ?

EDIT: No, not even option 3 is working  >:(  At first it seems to work, but if you leave your USB key inserted for a while, it becomes locked again.
I had to revert to version 5.0.667 (option 2).

I really hope they solve this problem soon...
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 04:06:18 PM
Joking and frustrated. Maybe try uninstalling the computer from the USB? Sarcasm this time coupled with frustration. I don't know any way to get it to eject safely with the exception of turning the computer off. Instead of using the windows tool to eject USB I downloaded a couple of programs which did not help one bit. It does happen after a certain period of time. Between 5 and 10 minutes so I think pk is on to the cause of it (anti-rootkit).
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: gentle4ug on January 18, 2011, 04:20:04 PM
Joking and frustrated. Maybe try uninstalling the computer from the USB? Sarcasm this time coupled with frustration. I don't know any way to get it to eject safely with the exception of turning the computer off. Instead of using the windows tool to eject USB I downloaded a couple of programs which did not help one bit. It does happen after a certain period of time. Between 5 and 10 minutes so I think pk is on to the cause of it (anti-rootkit).

I got the same results last night.  A quick insert, read, removal worked fine.  After a period of time (several minutes) no joy.  Had to reboot to remove safely.  My devices don't have any locks, just standard portable HDs and thumb drives.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: YoKenny on January 18, 2011, 04:34:27 PM
I am going to watch this topic with intrest as I have not had problems with removal of my Flash sticks nor my external USB hard drive on both my XP Pro or my Windows 7 systems.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 04:39:31 PM
YoKenny, could you try leaving a USB drive in for about 10 minutes and see if it happens to you? I don't know if just plugging it in creates a problem or read/write access.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: nmb on January 18, 2011, 04:42:19 PM
This thing happens to me if I install anything from the usb, especially portable hdd.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: jwall on January 18, 2011, 04:44:40 PM
This is very strange.  I had no problem, but I have never left a jump drive in for very long.  After reading this, I inserted my jump drive, accessed it, and left it in for almost 15 minutes.
Safely Remove Hardware worked ok.  I did have to click the icon a couple of times though before it went away.
FYI:  I use file, network, and web shields.

Frankly, I've always just pulled it off, but I know you should use Safely Remove Hardware.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: YoKenny on January 18, 2011, 04:57:34 PM
YoKenny, could you try leaving a USB drive in for about 10 minutes and see if it happens to you? I don't know if just plugging it in creates a problem or read/write access.
I inserted a Flash card on my XP Pro system then did a quick browse and did the same on my USB external drive on my Windows 7 and left them in for at least 10 minutes and was able to remove them.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: EagleGhost on January 18, 2011, 05:05:32 PM
I really hope, that this problem will be solved soon, because I don't want to wait 10-15 minutes to remove the USB hard drive safely.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: nmb on January 18, 2011, 05:16:42 PM
If I remember rightly, pk some where mentioned that it was related to avast anti-rootkit. So lets hope it will be fixed soon.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 05:40:12 PM
nmb, this is where pk mentioned it. http://forum.avast.com/index.php?topic=69367.0

I disabled the rootkit scan at startup and was able to eject properly (see attachment). Only tried once so far. I will keep testing this to see if it continues to work.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: nmb on January 18, 2011, 05:43:49 PM
@charyb,

Thanks for the link. But, I don't prefer to disable the anti-rootkit at startup, though.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Lisandro on January 18, 2011, 05:46:21 PM
I don't prefer to disable the anti-rootkit at startup, though.
Nobody wants. Just a workaround... Does it work for it?
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: nmb on January 18, 2011, 05:47:39 PM
Does it work for it?
I disabled the rootkit scan at startup and was able to eject properly (see attachment). Only tried once so far. I will keep testing this to see if it continues to work.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: dansorin on January 18, 2011, 06:05:20 PM
A quick insert, read, removal worked fine.  After a period of time (several minutes) no joy. 
same problem here, it's frustrating. happens on XP SP3 pro and W7  pro.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Lisandro on January 18, 2011, 06:08:38 PM
nmb, but does it work for you?
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: nmb on January 18, 2011, 06:19:45 PM
nmb, but does it work for you?

Haven't tried it. For that I have to setup things first. Will try and let you know.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 06:23:47 PM
Tech, I tried it 3 times now and it ejected each time (with rootkit scan disabled at start). I'm going to restart and come back to it later to see what happens.

edit: about an hour later now and still able to eject. seems like a workaround for now.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Lisandro on January 18, 2011, 08:37:59 PM
Thanks. Hope they consider this as only a workaround and find a definitive solution.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 10:44:28 PM
I'm almost thinking that if the USB drive is plugged in during the rootkit scan that there is a problem. Log doesn't show any problems though. The rootkit scan seems to start about 8 minutes after the computer is rebooted and it's duration is less than a minute (on my computer). I will keep testing this. Though my testing this doesn't fix a thing. Just helps to understand what is going on.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Lisandro on January 18, 2011, 10:58:47 PM
Yes, the scanning is run on demand 8 minutes after logon.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 11:02:09 PM
So it seems that if the USB is plugged in during this scan that it causes a problem with ejecting later. So don't plug it in until after the rootkit scan is complete (appr. 10 minutes after reboot). Kind of a pain for now.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Lisandro on January 18, 2011, 11:05:07 PM
So it seems that if the USB is plugged in during this scan that it causes a problem with ejecting later. So don't plug it in until after the rootkit scan is complete (appr. 10 minutes after reboot). Kind of a pain for now.
Yes. Same problem in my computer.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 11:11:32 PM
At least I now have some sort of clue as to what is going on which makes me feel a little bit better about things. I now know not to have my USB plugged in between (approximately) the 7th and 10th minute after reboot or start up.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: gentle4ug on January 18, 2011, 11:29:35 PM
Question?  Does the rootkit scan run 8 minutes after bootup or 8 minutes after user log in?  I have multiple user accounts on my machine.

I'll try some testing tonight.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Charyb on January 18, 2011, 11:32:05 PM
Question?  Does the rootkit scan run 8 minutes after bootup or 8 minutes after user log in?  I have multiple user accounts on my machine.

I'll try some testing tonight.

I'm not certain if it is reboot/startup or logon though because I logon on immediately. I will test this to find out.

EDIT: Appears to be bootup.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: =SKY= on January 19, 2011, 12:42:09 AM
I really hope, that this problem will be solved soon, because I don't want to wait 10-15 minutes to remove the USB hard drive safely.
+1
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: DavidR on January 19, 2011, 12:46:40 AM
Question?  Does the rootkit scan run 8 minutes after bootup or 8 minutes after user log in?  I have multiple user accounts on my machine.

I'll try some testing tonight.

I'm almost certain it is 8 minutes after boot not 8 minutes after user log in, many rootkits aren't reliant on a specific user so waiting for a user log in would seem to be wasting time.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: DavidR on January 19, 2011, 12:57:11 AM
I really hope, that this problem will be solved soon, because I don't want to wait 10-15 minutes to remove the USB hard drive safely.

The anti-rootkit takes seconds to complete rather than minutes, so it isn't the need to wait for it to be completed that is the issue.

So what is it that you need to have this USB disk plugged in on boot or shortly after for ?
If you are going to be removing it after 10-15 minutes, presumably it isn't needed all of the time.

What is wrong with the temporary work around until they have this problem tracked down and fixed, disabling the anti-rootkit scan, avastUI, Settings, Troubleshooting, and uncheck the 'Enable rootkit scan on system startup' option. That wording should also confirm it relates to system startup/boot and not user log in.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: gentle4ug on January 19, 2011, 05:12:39 PM
With multiple users, it is the first computer rule of the house to reboot when you are finished with your session.  That way, it is assured the sandbox(es) are empty and the next user does not stumble on the trash you left behind.

Frequently, the next user in line wants to use the computer to transfer pictures/music/whatever to/from their phone/ipods.  Or, maybe I want to run an unscheduled backup to protect irreplacable data.

No one should need a checklist and an egg timer to safely use a USB device.  Nor should we need to disable an important part of security software.

If we had some input as to the priority of getting this fixed, it would be very beneficial. 
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: mikeyhd on January 20, 2011, 03:55:07 AM
I am going to watch this topic with intrest as I have not had problems with removal of my Flash sticks nor my external USB hard drive on both my XP Pro or my Windows 7 systems.

I have the same problem, with just one minor twist.  I have two USB HDDs, both made by WD.  One is a 500G Passport USB 2.0 while the other is a 1TB Passport SE USB2.0/3.0.  I only have problems stopping (ejecting) the 1TB drive.  I have the problem on my WIN7 64bit laptop and my WINXP 32bit desktop.  I can have both drives plugged in at the same time and still eject the 500G and not the 1TB.

Just some more info, hope it helps.   BTW, I do use AVAST free on both machines, and have just finished spending a few hours going through my WIN7 with a fine tooth comb killing all indexing, searching services I could find.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Caki on January 23, 2011, 10:58:07 PM
I have the latest version 5.1.889 Avast free
Same problem on my pc XP PRO SP3, can not safely remove the USB flash memory problem occurs with the latest version of Avast

Windows 7 does not these problems with usb safely remove option I checked

This windows XP show when I try to safely remove usb flash memory in XP Pro SP3 (see picture)
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: vim rossi on January 26, 2011, 07:01:54 PM
when is this going to be fixed or should we skip this build coz rebooting to just remove an usb is getting frustrating
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: =SKY= on January 27, 2011, 01:38:35 AM
when is this going to be fixed or should we skip this build coz rebooting to just remove an usb is getting frustrating

Here is the answer: http://forum.avast.com/index.php?topic=69367.msg587480#msg587480 (http://forum.avast.com/index.php?topic=69367.msg587480#msg587480)
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: MattyD on March 14, 2011, 02:59:27 PM
My external USB drives can't be ejected even with current version 6.0.1000, as of March 2011.

First, I don't connect the drive until **hours** after my computer has been started and I've logged on (so the 8-minute root kit scan shouldn't be a factor).

Second, all other precautions have been accounted for:
recycle bin disabled for drive,
indexing disabled,
drive optimized for quick removal.

Today, I've found the only solution to ejected a drive SAFELY (even when I disable all Avast shields and ensure that no processes are currently accessing the drive, unplugging it causes Windows Vista to dump all physical memory and shutdown/reboot/restart...this is really annoying...before I could unplug USB drives that WERE NOT safely removed, but the worst that would happen is that Seagate would warn me that a drive was corrupted (not true, verified by a full chckdsk scan).

Here's MY workaround for ensuring that a drive can be ejected:
1. Before ***even connecting the USB drive*** do the following:
----freeagentGOnextSERVICE---stop the service, using TaskMgr's Services tab (if it even exists)
----disable **all* avast shields (I just choose "1 hour" since my drives are only connected for 5 minutes)
----avast! antivirus--- stop the service, using TaskMgr's Services tab (not the avastGUI service, it doesn't really matter)

2. Connect the USB drive
3. When you are ready to eject the USB drive:
----run processexplorer, search / "Find" all processes that start with "F:" or whatever your drive letter is
----Close / kill the 4 metadata processes
 -----then SAFELY REMOVE three times in a row (first 2 times, I get "drive in use / still in use" warning, but the 3rd time I got the all clear.

4. RESTART avast!antivirus service (using taskmgr, Services tab)
5. Enable / restart all avast shields again.

Does anyone think there is an easier workaround?
It would be nice to only have to, for example, disable the BEHAVIOR SHIELD **before** connecting the USB drive (even if computer has already been on for hours), in order to be able to safely remove the drive later, instead of having to completed stop ALL avast shields AND stopping the avast service in TaskMgr.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: biscuit19 on April 22, 2011, 08:31:07 PM
I have the exact system config as Matty D with avast 6- I need my hd to be connected for some time.

process explorer does not show any activity in my usb drive and i cant disable freeagent from task manager.  I have no idea how to log on as an administrator on task manager.

This has never happened with my vista or xp before.
Title: Re: Can't remove external USB hard drive safely after 5.1.889
Post by: Para-Noid on April 22, 2011, 09:06:49 PM
I have been following this thread since it started. One thing I've noticed is that no one has said (except for one) if they upgraded to 6.0.1091 and tried to remove the USB. See  http://forum.avast.com/index.php?topic=76488.msg633066#msg633066

5.1.889 is by now old history. I highly recommend 6.0.1091. If you remember 5.1 had a ton of bugs which 6.0.1091 resolved.

Also you should run a "removable media" scan before using the USB.  :)