Pendrive lock down

General Discussion (off topic) Anything and everyt
1

I have got a problem…
whenever i connect a pendrive to my pc and try to safely remove it, i get"device cannot be removed right now"window…so i tried to find out which process is locking down my pendrive…

I used unlocker for this purpose and found two processess and they are the same—cisvc.exe
so now i have to unlock this processess using unlocker before removing my pendrive safely??

I found that cisvc is a legitimate process but why is it locking the device bugs me???

If it was a virus then usually the explorer would lock it but in this case no explorer.exe.

2

hmm, are you sure the cisvc.exe is legit? 88)

There are two common items that use this name. One is the indexing service that XP runs in the background to speed the search function in Windows Explorer. It's normally unnoticed as it operates when the computer is doing nothing else. You can learn how to set it up (or disable it, if you prefer) in Help and Support (search for Index).

The other one is a keylogger and may be introduced as part of the Family Keylogger program (it spies on other users of your computer) or as part of a Trojan or other spyware.


from here

the site also offer cisvc (keylogger) removal tool,but not sure if it’s legit 88)

3

I think so because i did a search in google and i found this:

4

Now i remember i enable the indexing option a few days back to make search engine faster…

5

I disabled the indexing and wow no cisvc.exe running in the background…so does that mean its the same process that does the indexing…

6
I disabled the indexing and wow no cisvc.exe running in the background.....so does that mean its the same process that does the indexing....
Hi arjunpa,

If you disabled MS Indexing Service and you don’t see the process running that is indeed the one

Sure, you have to check/re-check again if you want, because as Ganda said the file under the same name reported as being malicious that was found in the past.

If the file itself is in \system32\ it’s most likely legit. Look at the properties.

I am never using MS Indexing Service – it is always disabled (amongst other unneeded system 70 Services)

You may find many complaints about the thing including 100% CPU usage and so on…
Anyway that’s useless service. MS search is slow anyway.

If I would enable the said service though I somehow never experienced the locking of external media with symptoms you described.

Its is most unlikely being the keylogger though, as the later will not do such thing as you described by any means
… but again that is your decision as for rechecking things there.

My regards

P.S. almost !ot!

If your format is NTFS - try this, for example http://www.voidtools.com/

The search is instant practically no matter how big all your drives are in combination because of the method used.
It doesn’t search by context, but there are other Utilities for that.

7

Comodo Backup would do the same thing to me. I would have to go and stop all its processes to be able to remove my external USB harddrive (one just for storage and backups).

I don’t use Comodo Backup now though so…

8

The problem is gone for good now after i disabled indexing…
By the way is there a comodo process manager or something like that???
Ya i know there is task manager but still its difficult to understand from where the process is orginating… :-\

9

Hi arjunpa

Visit this site Sysinternals - Sysinternals | Microsoft Learn

and get ProcessExplorer; ProcMonitor; Autoruns
and other essential and valuable Utilities by Mark Russinovich

Cheers!

10

I had the same problem with the indexing service on an external usb hard drive. Always locked by MS Index. I uninstalled indexing and search. No problems since.

11

Hi theantagonizer ,

Since you mentioned external usb hard drive
that reminded me another few things regarding external media that has to be done in this respect and anyway:

1) it is beneficial to set permanent drive letters to your external media (optional but very helpful);

2) “must do” - disable System Restore management on external media.

That is a bug by MS that they are setting that automatically
1st that is just waste of space (sometimes substantial) but most importantly

  • that is misleading and could be harmful if used since that does not reflect the real situation with the information stored there when you moving/attaching externals to other computers
    … and yes most likely that management can influence the “locking” as well

Unfortunately I gotta run now meaning that I should’ve posted the links to the manuals “how to”.
Please Google the above 2 points and if you will not be able to find I will post those refs later

My regards

12

Thank you syberlynch…

13

“syberlynch” >:-D… brilliant! :smiley:

That was some funny way to interpret my nickname ;D

I’ve seen some but this one is the best so far.

“syber” all of us are there… but “Siber” with the same pronunciation (therefore chosen) - means “Siberian”

Lynx is an animal (wild cat) as in avatar. The cat lives in Siberia (although there are other types in the family and they look a bit different)

“lynch” that’s when a group of people kill someone for an alleged offense without a legal trial, especially by hanging. That is cruel and unlawful.

Lynx is a hunter and it has to be cruel “sometimes” - that is how the Nature created those creatures…

…but only humans as creatures (created by … hmmm… let’s say diplomatically again …
… by Nature…) are unreasonably disgusting and cruel as they are

Have you found the links I mentioned? If not - please let me know

Cheers!

14

;D ;D ;D ;D ;D ;D
ya i downloaded process explorer but i have to download the rest of them…
And thanks for the links it will take a while to download them(My internet bandwidth just sucks, i get 27kb\s for torrent downloads and for direct download it is around 7kb\s >:( >:()
Again thank you syberlynx(This time i have spelled it right… ;D)