Eject USB shows UAC message

[GR3YL0TU5]

Hi,
Whenever I eject a USB from my computer I get a UAC message.
If I click yes, the USB is removed. If I click no, or cancel the UAC message, the USB is still removed.
I have tried different USBs and different USB ports and I get the same result.

---

The message reads:
Do you want to allow this app to make changes to your device?

Windows host process (Rundll32)

Verified publisher: Microsoft Windows

Location: "C:\WINDOWS\System32\RunDll32.exe" C:\WINDOWS\System32\hotplug.dll,HotPlugSafeRemovalDriveNotification

---

I haven't noticed any other odd behaviour on my system, and I can't see any unidentified apps running on the task manager.

Could this be due to some kind of virus?
How can I find out more?
How can I stop this UAC popup without disabling all UACs on my system?

Thanks in advance to anyone who can shed some light on this.

 

[Colif]

I tried to follow this on my USB but I don't have a security tab: https://www.eightforums.com/general-support/23704-how-stop-administrator-permission-prompts-usb-device.html

see if this helps
right click start button
choose command prompt (admin)
type SFC /scannow and press enter

this scans system files and may fix this behaviour

could turn the function on/off - go to settings/Personalisation/Taskbar
scroll right column to bottom and choose Select which icons appear on the taskbar
choice you want is Windows explorer - Safely remove hardware and eject media
I don't think this is right menu, think it just shows them on taskbar and not in the hidden area... i know its in here somewhere... or at least, it used to be. I found it before??

 

[GR3YL0TU5]

Hi Colif,
Thanks for your reply.
I tried following the instructions in the thread, I also tried the scan. No luck 🙁
I also tried to find the option you were talking about. Again no luck.

The UAC still pops up when I eject USB.

Any other ideas? Do you think I have a virus?

 

[Colif]

it wouldn't hurt to scan for them anyway (Virus I mean)

there used to be another option that added removed the icons in the hidden area, but its been removed which makes me sad.

you could try making a local account and see if it suffers the same problem. It seems a little excessive to have to make a new user, but will tell us if its a user setting of some kind...

 

[GR3YL0TU5]

Scan with Malwarebytes didn't show up anything suspicious.
I created a local account and it did indeed suffer the same problem. UAC popup, only prompting me to enter the admin password.

What could that indicate?

 

[GR3YL0TU5]

I have just noticed that I also get a similar UAC, "Windows host process (Rundll32)", when I try to access the user controls for Playback devices, Recording devices or Sounds.

 

[Colif]

if local account wasn't an admin, then you would get the UAC password pop up. Try making it admin (I forgot about that detail)

 

[GR3YL0TU5]

Ah ok, yep. Tried changing it to admin. Same result.
What does it all mean? 🙁

 

[Colif]

I am not sure

SFC found nothing, new user is the same... i just ejected one from mine to see if it was normal but i just got as notification saying its ready to remove...

try setting up a homegroup, it sounds like it could be a permissions problem maybe as admins shouldn't get uac warnings for most of these things

Could try running DISM
right click start button
choose command prompt (admin)
copy/paste this next command into window - needs to be exact
DISM /Online /Cleanup-Image /RestoreHealth and press enter

DISM cleans the files SFC uses to compare system files, so it might help to run SFC /scannow after DISM, it might find things to fix this time. restart PC once its run.

I have my doubts this will work but I am not sure what will now.

You could try the System maintenance troubleshooter
search cortana for troubleshoot - choose the control panel best match
in next window, click View all in the left menu
If you sort the list by name, you will see System Maintenance towards bottom. I would run the tests until it finds no changes, if it asks for a restart, do it and run them again.

You can turn UAC off but I wouldn't feel safe that way: http://winaero.com/blog/how-to-turn-off-and-disable-uac-in-windows-10/

 

[GR3YL0TU5]

Ran DISM and SFC. No luck.

When I opened troubleshoot the UAC came up for rundll32 again... So that's UAC for USB eject, sound options and now troubleshoot!
System Maintainance Troubleshoot says no changes or updates necessary.

The only thing left on your list now is the homegroup. I'll try that next.

 

[Colif]

this might help: https://answers.microsoft.com/en-us/windows/forum/windows_10-hardware/uac-when-opening-the-sound-window/11689830-797f-4472-87da-f28981f85168 << might not work

seems to be something to do with anything control panel related, i found others having same problems but no solutions 🙁

 

[GR3YL0TU5]

I set up the homegroup but it doesn't seem to affect anything. Still the same issues with UACs all over the place.
I really don't want to turn off UACs all together as I definitely wouldn't feel secure.

Any other ideas?
Anybody?

Update* Just looking at this latest post... it seems to describe my problem. I'll report if it turns out to be my fix.

 

[GR3YL0TU5]

Right, so I followed the instructions, and like the OP in the thread, I fell at the first hurdle as both gpedit.msc and secpol.msc could not be found.
My UAC settings (the slider) is on the second option down, default.

The UAC screenshot in that thread is the same as the ones I am getting.. so it seems we're on to something at least.

By the way, I also get a UAC when running Command Prompt (Admin). Is that normal?

 

[Colif]

whatever is cause only started happening in last few months. I can't think of any easy answers that I haven't tried... you could ask on https://www.tenforums.com/user-accounts-family-safety/ as they might have an answer I haven't thought of. They more likely to than say asking Microsoft themselves.

hard answer would be a fresh install as I don't know where the problem lies, it might be the users are bugged out somewhere, so just doing a reset might not be enough. Either way its a lot of preparation and work just to fix a little bug.

your last UAC pop up is normal for opening cmd admin

 

[GR3YL0TU5]

I have to thank you for your time and effort.
Although we didn't manage to fix the problem, I feel more confident that it's probably some kind of corruption with the user settings as opposed to a virus.
I'll just ignore it for a while and see if it goes away following a windows update or whatever. - Like you say, it's a relatively minor bug.

Thanks again.

 

[Colif]

Try steps 3 & 4: http://ccm.net/faq/293-how-to-fix-a-rundll-error#solution-3-locate-the-error-with-system-configuration

not sure i trust the online tools though.

 

[GR3YL0TU5]

Oh no!
I just followed the instruction to boot in selective startup. My system is now totally stuck on selective startup and refuses to boot with "load system services" option checked. If I try to select "normal startup" it automatically reverts to selective startup.

I just managed to get the network connection working again (although I don't really know how). For a while I couldn't even get online to post here.
Windows defender won't start at boot either and shows an error message.
(Microsoft Security Client: an error has occured... Error code 0x80070426)

Time for a clean Windows reinstall me thinks.

 

[Colif]

I think clean install would be sanest as there is something wrong with the way your system was creating users. Its possible you had a virus as we threw everything at it and it still acted strange.

is there anything on C drive you want to rescue? try making this on another PC: http://www.howtogeek.com/howto/windows-vista/use-ubuntu-live-cd-to-backup-files-from-your-dead-windows-computer/

Also, on another PC, download the Windows 10 media creation tool and use it to make a win 10 installer on USB


change boot order in BIOS so USB is first, hdd second
boot from installer
follow this guide: http://www.tenforums.com/tutorials/1950-windows-10-clean-install.html

when you reach screen asking for licence, click "I don't have a key" and win 10 will continue to install and reactivate once finished

On the screen where you choose where to install win 10, if it gives you an error about GPT drives, delete all the partitions on the hdd and press next. If it still gives error, cancel out of the installer and restart PC and start installer again, it will accept next on that screen this time (some PC just need a restart here)

 

[GR3YL0TU5]

After a Windows 10 repair install, the problem seems to be gone. I needed to connect to Microsoft support, and they guided me through the process as whatever was causing the bug was also stopping Win10 install media from being created. In the end, it was done from an ISO via my desktop.

Case closed.

Until next time...

Again, many thanks for your help Colif.

 

[Colif]

hmm, why didn't i think of a repair install. We tried everything else ... glad its fixed now