Solved What is \\.\C:\ ?

[FranzB]

A misunderstanding. I should have stated: virus definitions 1.111.1162.0
Windows Update gives no updates.

 

[Anak]

Okay. Hmmm, by this account it looks like I am a little behind. :shock:



EDIT:
Just got it, 1162

 

[G1LLY]

I've noticed this \\.\C:\ entry on my MSE quick scan's which take a while to scan, I initially thought it was due to me partitioning my drive & using Active@ Kill Disk to wipe it, but maybe it was due to a new MSE anti-malware engine upgrade, not sure?

At least I'm not the only one getting it, thought my MSE was messed up.

 

[FranzB]

See my last post above (permalink #19): since the virus definition update of MSE mentioned there it has disappeared again mysteriously and is not seen any longer.

 

[dmex]

are these malware scans scanning my C: drive twice? Once by going through the file system and once by not going through the file system?

Not really, By directly accessing the disk through the Win32 Device namespace it allows MSE to bypass device filters also device drivers and any COM based Namespace Extensions that may be filtering filesystem output or showing virtual folders such as e.g. 'C:\Windows\assembly' which is a COM Namespace Extension that shows file output differently to the actual disk directory layout

I think the output of MSE is just showing C:\ when internally it's actually using \\?\C:\ the entire time which would make sense using the disk directly via \\?\C:\ as there are many layers where this output could be hooked or filtered to hide files otherwise.