Inspiron 3891, Event Viewer error - Usbupdate.exe fails

I just found these 2, also containing embedded url's for Entrust.net.

Files dated 5/27 10:36pm
Associated with dell update
c:\program files(x86)\dell\update\service\Storage.Principal.dll
c:\program siles(x86)\dell\update\service\WindowsManagement.Principal.dll

Dave

I have a Dell Inspiron 5584 running Win 10 Pro v21H2 and I am having a similar issue where I see these errors related to UsbUpdate.exe logged in Event Viewer and can't eject my removable USB thumb drive after I run a portable app like SUMo Free Portable v5.15.1 (i.e., after unzipping and running the bundled .exe executable) from that USB.

I just found this thread today and still haven't read all 12 pages of comments yet so apologies if this has already been mentioned, but my problem ejecting my USB thumb drive seemed to start about the same time that I updated to Malwarebytes Premium v4.5.9.198-1.0.1689 (Component Package 1.0.1689 released 26-May-2022).  I also discovered that I don't seem to have any problem ejecting my USB thumb drive if I prevent Malwarebytes Premium from loading at boot-up (i.e., if Settings | Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts Up is OFF and I re-boot).

I've posted details about the Event Viewer errors (Source = Application Error; EventID = 1000; Faulting Application Path = C:\WINDOWS\TEMP\inv3253_tmp\Executables\UsbUpdate.exe) in juantho's 24-May-2022 thread Malware and PUP PROTECTION Does not allow me to eject my USB after Run .exe in the Malwarebytes forum.  For now I'm assuming my UsbUpdate.exe errors and problem ejecting my USB thumb drive after running a portable app are related.

Does anyone else having these UsbUpdate.exe errors logged in their Event Viewer (and/or who can't eject their USB after running a portable app from their USB stick) have Malwarebytes installed on their system?
--------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Dell SupportAssist v3.10.4.18 * Dell Update for Windows Universal v4.5.0 * Dell SupportAssist Remediation v5.5.2.16157 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

I have a Dell Alienware Aurora Ryzen Edition R10 on which, until 2022-05-29, I was running Windows 10 Pro.  Then I installed Microsoft Windows 11 Pro, Version 10.0.22000, Build 22000.

Your article caught my attention when, in the 1st paragraph, you stated "and can't eject my removable USB thumb drive after I run a portable app...".  I experienced the same symptom after running an app named "TLPD (Too Long Path Detector)" from my 256GN removable drive.  "TLPD scans the directory tree, looking for files and folders with full path name longer than a specified threshold" and saves a report of the results to a destination of your choice.  I chose to save the report to my removable drive.

Before shutting down my computer, I closed all applications and attempted to "Eject" my removable drive.  

This failure to eject a removable drive is an old problem peculiar to Windows 10 Pro and apparently was not corrected in Windows 11 Pro. 

With Windows 10 Pro, I would shut down every application that I could think of that may still have its pointer aimed at my removable drive, but the ejection still failed. I also waited 15 minutes with no known applications running and tried ejection again, but that failed. Then I discovered that if I signed out of my Windows 10 Pro Desktop and then logged back into it, the ejection of my removable drive succeeded!

Windows 11 Pro has the same problem, except for one minor difference. 

As long as I the following conditions are met, the removable drive would eject successfully:

1. Close all instances of File Explorer,
2. ensure no files located on the removable drive were open by any application,
3. no applications located on the removable drive are open or running, 
4. wait at least 15 minutes without touching the keyboard or mouse,
5. and THEN REPEAT YOUR ATTEMPT TO DISMOUNT THE REMOVABLE DRIVE!

Windows 11 Pro is still creating event logs about  UsbUpdate.exe, version: 1.1.0.1 and I am still working on that error.

---

@Augured wrote:

... This failure to eject a removable drive is an old problem peculiar to Windows 10 Pro and apparently was not corrected in Windows 11 Pro ...Windows 11 Pro is still creating event logs about  UsbUpdate.exe, version: 1.1.0.1 and I am still working on that error.

---

Hi Augured:

As I noted <above>, I have no problem ejecting my USB removable thumb drive after running a portable app as long as Malwarebytes Premium is not running in real-time protection mode (i.e., if I change Settings | Security | Windows Startup | Launch Malwarebytes in the Background When Windows Starts Up to OFF and re-boot). One of the Malwarebytes employees confirmed today that can reproduce the USB ejection problem on their non-Dell computer without generating a UsbUpdate.exe error in their Event Viewer so for now I'm assuming that Malwarebytes is the cause of the USB ejection problem.

At the moment Malwarebytes also believes it's just a coincidence that the USB ejection problem and UsbUpdate.exe errors appeared about the same time on my Inspiron 5584 (see employee AdvancedSetup's comment <here> about a "red herring") and they suspect that the UsbUpdate.exe errors are likely restricted to Dell computers.
--------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Dell SupportAssist v3.10.4.18 * Dell Update for Windows Universal v4.5.0 * Dell SupportAssist Remediation v5.5.2.16157 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

I believe I have a solution. I was having this exact same issue. 

The triggering application in my case was “Dell OS Recovery Tool”.  Or if you have an Alienware, it is called “Alienware OS Recovery Tool.”  And if you have an older computer, it is called “Dell USB Recovery Tool.”  Regardless of title, the only function of this application is to allow the user to create a bootable USB recovery flash drive.  More information is available here: https://www.dell.com/support/kbdoc/en-us/000123667/how-to-download-and-use-the-dell-os-recovery-image-in-microsoft-windows

I suspect the “USB” in the faulting application (USBIEupdate service) is referring to the purpose of the app (to create a USB recovery drive).  It doesn’t appear to me to have anything to do with the USB Host Controller or anything connected to it. 

The solution to this is simple.  Use an uninstaller like Windows Add/Remove Programs, or Revo Uninstaller (free), or your choice.  Scroll/search down the list for the name of the program:  

• Dell OS Recovery Tool (for a newer Dell PC)
• Alienware OS Recovery Tool (for an Alienware)
• Dell USB Recovery Tool (for an older Dell PC)
• [Edit 6/8/22:   Based on the comments below, it might also be called the "OS Recovery" add-on, plugin or extension so maybe just search for "OS Recovery" in the removal program.]

Then uninstall the program listed above.  This at least worked for me.

In the future, if you ever want to create a bootable USB flash drive for your Dell system, you can reinstall the OS Recovery Tool here:  https://www.dell.com/support/home/en-us/drivers/OSISO/recoverytool?tfcid=gen_1180504

Here is a picture of the faulting application path:

 Here is a picture of removal of said application:

Here is a picture of the errors this causes:

Errors

I have this exact error on my AW17 R3, but not on my Dell XPS l501x. Both have dell support assist installed but not “Dell OS Recovery Tool” or "Alienware OS Recovery Tool", I have seen that the error is triggered when SA looks for drivers and downloads and if there are any available. On my AW17 there is two drivers SA wants to download. On my XPS 15 there is none (its from 2010 so as expected). And here is the interesting part. Only the AW17 have the Event Viewer error - Usbupdate.exe.

To sum up. The error seems to be linked to SA and available updates or not, not OS recover tool. On my end at least. 

I don't/didn't have the "OS Recovery Plugin," (mine was "OS Recovery Tool") but what I listed above has worked for me so far so it might possibly be related in whole or part to the "OS recovery" addon/plugin/extension program in the Support Assist package. Not sure. Maybe I just have to wait longer to verify it doesn't come back. I was getting the errors every day basically since around memorial day. I use my computer every day.  I will come back to report in a few more days if the errors return.  If they do not, I might suggest again uninstalling that the "OS Recovery" extension of Support Assist like I did. 

That's interesting. I'm still at 3.10.4.18 for support assist, and have this problem with support assist and with dell update. I did manage to catch the failing task in task manager - usbieuptate. Properties for it show that it's something from Entrust.net - Entrust Extended Validation Code Signing CA - EVCS2
Digitally signed by Dell on 5/17/2022. In several of support assist and dell update dll's  there are embedded url;s for entrust.net. Maybe to download and execute code?

Since I had dell support escalate this to their L3 team last friday, there has been no progress on this. On last night's discussion with dell tech support, I'm told there is no way to expedite a solution from L3. They did take event log data that they claimed was needed by L3 support - would have nice if they had asked for that earlier. So now it's another period of waiting. This issue is very easy to recreate, I have no idea why they can't just try this themselves. Very disappointed with their support.

I wonder if the recent signing date means that entrust.net changed their code for support assist 3.11, breaking support assist and dell update in the process???

Dave

---

@dlgabry wrote:

That's interesting. I'm still at 3.10.4.18 for support assist, and have this problem with support assist and with dell update. I did manage to catch the failing task in task manager - usbieuptate. Properties for it show that it's something from Entrust.net - Entrust Extended Validation Code Signing CA - EVCS2 Digitally signed by Dell on 5/17/2022. In several of support assist and dell update dll's  there are embedded url;s for entrust.net. Maybe to download and execute code?...

---

Hi dlgabry:

Again, I don't know if it's relevant, but see crimsom's 06-Jun-2022 image in 17 R5, Dell SupportAssist x64 v3.11.2.143 Installation Failed of the digital certificate for their failing SupportAssistx64-3.11.2.143.msi installer. The certificate uses a SHA-512 hash (not the SHA-256 hash I was expecting) and the issuer appears to be Entrust Code Signing CA (the full name is not shown), but that seems to be the case now for all SupportAssist installers.  See my 06-Jun-2022 image <here> in crimsom's thread for the SupportAssistInstaller.exe file I downloaded (but did not run) yesterday from the main SupportAssist for Home PCs download page that lists the issuer as Entrust Code Signing CA - OVCS2. I suspect that Dell is likely using Entrust as the issuer for all their digital certificates these days.

Also note that some users who are currently seeing their SupportAssist v3.11.x installation fail due to a file validation error have reported seeing the following error logged in the SupportAssistAgent.log in the hidden C:\ProgramData\SupportAssist\Client\Agent\logs\ApplicationLogs\ folder:

Dell.SupportAssist.Client.SupportAssistInstaller.AutoUpgradeHelper.SupportAssistInstallerPackage - msi Hash validation failed
--------------
64-bit Win 10 Pro v21H2 build 19044.1706 * Firefox v101.0.0 * Microsoft Defender v4.18.2203.5-1.1.19200.5 * Malwarebytes Premium v4.5.9.198-1.0.1689 * Macrium Reflect Free v8.0.6758 * Dell SupportAssist v3.10.4.18 * Dell Update for Windows Universal v4.5.0 * Dell SupportAssist Remediation v5.5.2.16157 * Inspiron 5583/5584 BIOS v1.18.0
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, 256 GB Toshiba KBG40ZNS256G NVMe SSD, Intel UHD Graphics 620

I thought this was a fluke, so I checked it on 2 machines that were failing for almost 2 weeks.  I ran Alienware Update and did not receive any usbieupdate errors or any errors in my Reliability Monitor.  Has this now been fixed?  Same app I've had installed since the beginning of this issue. 

Could someone else confirm?  Thanks.................

That's odd. I just tried dell update, watched it go through it's checks on the progress bar and complete without a failure.

I also received an email from dell tech support stating that tey are waiting for a response from their product engineers. I also do not see any updates applied to support assist or dell update before or during these failures. I did notice that if support assist or dell update showed visible activity on their progress indicator it would fail; and if it completed immediately there would be no failure. Also, if I run dell update immediately a second time it would declare success without checking and without changing the time stamp of the last time it ran. I'm going to try this again in another hour or so.

I'm beginning to think this bug is due to some third party code called by support assist and dell update. 

Dave

Yes, same here, as I posted at 12:43.  Good to see, I hope, that it's fixed.  I'm not holding my breath for any official word from Dell, although that would be nice. 

Problem solved für Dell XPS 8940: 

This morning there was an Biosupdate for the Dell XPS 8940 (Bios 2.7.0, 9.6.2022). No more errors in event viewer regarding USBUpdate.exe.

This BIOS update says: "- Firmware updates to address security vulnerabilities including (Common Vulnerabilities and Exposures - CVE) such as CVE-2022-21166."

There is no information about this CVE yet, I don't think Dell is very transparent here.

I found a headline from June 2021: "Dell SupportAssist bugs put over 30 million PCs at risk".

https://www.bleepingcomputer.com/news/security/dell-supportassist-bugs-put-over-30-million-pcs-at-risk/

"Security researchers have found four major security vulnerabilities in the BIOSConnect feature of Dell SupportAssist, allowing attackers to remotely execute code within the BIOS of impacted devices."

I hope my concerns are unfounded.