| Event Id | 135 |
| Source | Removable Storage Service |
| Description | Received a device interface REMOVAL notification for device: \\?\IDE#DiskWDC_AC38400L__..etc.. |
| Event Information | This is an event generated by MM (Mount Manager) of windows 2000. MM is a kernel service to assign names to the volumes attached to the system. It will identify a volume with a unique name and store that name. You can find a list of volume names under registry key "HKLM\SYSTEM\MountedDevices" The driver calls IoRegisterPlugPlayNotification which generates events 134 at an interface arrival and event 135 at a removal. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.