[Lex Computer & Tech Group/LCTG] USB drive

Wed Sep 28 06:34:36 PDT 2022

 Grace -- 
It appears the data on the USB flash drive is not gone. Norton is simply refusing to allow the device to be seen and accessed by Windows 11. This happens when security programs interact with TPM2 security and what Microsoft calls Layered Group Policies, which Norton could have configured when it was installed.
The good news is, any PC not protected by Norton under Windows 11 will be able to download the data from the USB flash drives. The bad news is, to reset the Norton USB blocking behavior, you will need to reinstall Windows 11. Without Norton Antivirus. This should reset all the Group Policies and TPM keys. 
I am not aware of any default behavior of Windows 11 or TPM2 which blocks access to USB drives or devices without the layered Group Policies being configured by the user. Or by a third-party security program like Norton.  
But a technician colleague of mine insists that TPM2 does block USB devices from Windows 11, and that you must enter a specific TPM security key every time you plug in any USB device, regardless of Group Policies. I think my technician colleague is incorrect, and I don't know where he got this misinformation. He claims TPM always sets itself up this way, and if it didn't, it would not be offering any security at all. Again, I don't know where he got this misinformation. 
Norton isn't evil or malicious -- it is simply being overprotective. And there is no easy for an end user to reconfigure Norton not to block USB devices by default. 
I concur with Adam and with Drew -- install Windows 11 with only Windows Defender (built in) and maybe add Malwarebytes Premium with its Browser Guard as additional security. Malwarebytes Premium costs money, but it is good security which will not make you think it's eating up your data on USB devices. 
-- Bob Primak

    On Tuesday, September 27, 2022 at 10:59:48 PM EDT, Grace Poon <impression.gk at hotmail.com> wrote:  

 #yiv4289686800 P {margin-top:0;margin-bottom:0;}
Bob,  Adam, Drew et althank you all for the informationthe USB virus scanning message is from Norton SecurityI purchased the computer from Toshiba via amazon, it is nothing fancy,I have a good number of scientific journals kept on my USB, just about to download them onto my remote hard drive for storage,it is just very annoying losing those items, and now when I inserted the damaged USB, the computer does not 'see' itI really appreciate all your helpI did try the program Recoverit, it manages to find the c drive deleted files and superb easy to use, but it cannot detect the 'remote' device
Best Regards and thank you all once againGrace
Toshiba Dynabook Tecra A40-G School & Business 60Hz Laptop (Intel Celeron 5205U 2-Core, 4GB RAM, 128GB SSD, Intel UHD, 14.0" Full HD 1920x1080, WiFi 6, Bluetooth, Webcam, 1xHDMI, Win 10 Pro) with Hub

From: Robert Primak <bobprimak at yahoo.com>
Sent: Tuesday, September 27, 2022 1:47 PM
To: Grace Poon <impression.gk at hotmail.com>; Lex Computer Group <lctg at lists.toku.us>
Subject: Re: [Lex Computer & Tech Group/LCTG] USB drive The message you show in the image you attached is not a legitimate Windows message. 
Where did you buy this new PC, and what brand and model is it?
Someone has included some non-Windows program which is messing with your files and uploading them somewhere. This is not a legitimate application. You may need to wipe the system drive of this PC and install a legitimate copy of Windows 10 or Windows 11. At the very least, wipe the drive (reformat it) and reinstall Windows from actual Microsoft Windows retail install media -- NOT anything the seller or the manufacturer may have provided as "recovery media" or a "recovery partition". You do not want to use the computer with this rogue software installed on it. Continuing to use a computer with rogue software on it will lead to more lost data or worse.
The entire message is cut off in your attached image. I'd like to see the entire message box, as it has a brand name (which I suspect is a third party security product) at the bottom of the message, to the left of the Yes/No selection ovals. 
You can use another computer (without any rogue program on it) to download and create Windows install media using the Microsoft Media Creation Tool. You would then need to start up the new computer with the install media USB as the boot device, NOT your main system drive. This means getting into your EFI or BIOS and resetting the boot order. 
If this is too advanced for you to do for yourself, you can ask group members for help guiding you through the steps.
My concern is that I want you to have a clean install of genuine Microsoft Windows, not the setup you have now, which has at least one rogue program installed and is destroying your data. Preinstalled third party security programs can sometimes do more harm than good. And they are very difficult to remove. 
To the Group -- I am including the original attachment with this reply, as well as the quoted original message from Grace.
-- Bob Primak 
On Tuesday, September 27, 2022 at 12:07:43 PM EDT, Grace Poon <impression.gk at hotmail.com> wrote:

Whenever I insert a USB drive on my new PC,this message comes upfirst time when I said Yes,it removes all my files Since then I click Nothe second time it comes up with a message that one of the file 'fails to upload', and then all the files 'disappeared'!!
Thank you & Best RegardsGrace

From: Robert Primak <bobprimak at yahoo.com>
Sent: Monday, September 26, 2022 4:26 PM
To: Lex Computer Group <lctg at lists.toku.us>; Grace Poon <impression.gk at hotmail.com>
Subject: Re: [Lex Computer & Tech Group/LCTG] USB drive I'd be curious to know how a new Windows PC wiped the data from a USB drive without user intervention. 
Have you tired Recuva, from the makers of CCleaner?
https://www.ccleaner.com/recuva

-- Bob Primak 
On Sunday, September 25, 2022 at 11:34:04 AM EDT, Grace Poon <impression.gk at hotmail.com> wrote:

All

I have a new PC 

and it has wiped off all the files from 2 USB drives

There are programs on the internet for recovering USB files,

Please any suggestions which one will be good to try?

Thank you

Grace

===============================================
::The Lexington Computer and Technology Group Mailing List::
Reply goes to sender only; Reply All to send to list.
Send to the list: LCTG at lists.toku.us      Message archives: http://lists.toku.us/private.cgi/lctg-toku.us
To subscribe: email lctg-subscribe at toku.us  To unsubscribe: email lctg-unsubscribe at toku.us
Future and Past meeting information: http://LCTG.toku.us
List information: http://lists.toku.us/listinfo.cgi/lctg-toku.us
This message was sent to bobprimak at yahoo.com.
Set your list options: http://lists.toku.us/options.cgi/lctg-toku.us/bobprimak@yahoo.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.toku.us/pipermail/lctg-toku.us/attachments/20220928/d9c4e20f/attachment.htm>