From: Sérgio Dias (stdiaspuol.com.br)
Date: Tue May 09 2006 - 11:53:53 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

And you can use eventcombMT to collect them.

Maybe have anything in the Script Center to Help against this feature. I
think you will use one time once. I will talk with a friend that works with
Scripts to verify if it's possible to be automatic.

Regards,

Sérgio Dias, MVP Security
MCSE: Security, Security+, MCT

----- Original Message -----
From: "Detection Services - IS Security" <secdetnwa.com>
To: <riccics.ust.hk>; <focus-mssecurityfocus.com>
Sent: Tuesday, May 09, 2006 11:44 AM
Subject: RE: USB device installation problem

System Event log,
Source = "Removable Storage"
Event IDs = 134 - insertion.
135 - removal

The Description field includes device specifics:

Received a device interface ARRIVAL notification for device:

\\?\USBSTOR#Disk&Ven_&Prod_&Rev_1.89#254F11FE40F7437B&0#{53f56307-b6bf-1
1d0-94f2-00a0c91efb8b}

This seems to be specific to the device.

Q: can anyone shed light on tracing this back to a specific USB hardware
device?

> -----Original Message-----
> From: riccics.ust.hk [mailto:riccics.ust.hk]
> Sent: Monday, May 08, 2006 5:43 PM
> To: focus-mssecurityfocus.com
> Subject: USB device installation problem
>
>
> Hello All,
>
> Currently, USB usage becomes one of the most important part
> in Windows systems. If I would like to check how many USB
> external storage has been inserted to the computer before and
> when is they have been inserted and removed, is there any way
> I can check that from registry? or is there any other
> location I can find that?
>
> Please advise.
>
> Thx.
>
> Ricci
>
>
> --------------------------------------------------------------
> -------------
> --------------------------------------------------------------
> -------------
>
>

---------------------------------------------------------------------------
---------------------------------------------------------------------------

---------------------------------------------------------------------------
---------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]