What is \\.\C:\ ?

FranzB · 31 Aug 2011

A misunderstanding. I should have stated: virus definitions 1.111.1162.0
Windows Update gives no updates.

Anak · 31 Aug 2011

Okay. Hmmm, by this account it looks like I am a little behind.

$What is \.\C:\ ?-1mse.jpg$

EDIT:
Just got it, 1162

G1LLY · 01 Sep 2011

I've noticed this \\.\C:\ entry on my MSE quick scan's which take a while to scan, I initially thought it was due to me partitioning my drive & using Active@ Kill Disk to wipe it, but maybe it was due to a new MSE anti-malware engine upgrade, not sure?

At least I'm not the only one getting it, thought my MSE was messed up.

FranzB · 01 Sep 2011

See my last post above (permalink #19): since the virus definition update of MSE mentioned there it has disappeared again mysteriously and is not seen any longer.

dmex · 02 Sep 2011

marsmimar said:

are these malware scans scanning my C: drive twice? Once by going through the file system and once by not going through the file system?

Not really, By directly accessing the disk through the Win32 Device namespace it allows MSE to bypass device filters also device drivers and any COM based Namespace Extensions that may be filtering filesystem output or showing virtual folders such as e.g. 'C:\Windows\assembly' which is a COM Namespace Extension that shows file output differently to the actual disk directory layout

I think the output of MSE is just showing C:\ when internally it's actually using \\?\C:\ the entire time which would make sense using the disk directly via \\?\C:\ as there are many layers where this output could be hooked or filtered to hide files otherwise.