Drive location \??\C:\



SRGriffin
07-10-2005, 12:44 AM
"fresh" build of XP Home (meaning wiped disk w/ ghost first), installed XP
from notebook image CD (compaq notebook). Installed SP2 from CD and
installed Trend Micro virus software. Installed Office professional 2003.
Connected to network and installed updates.

Mostly just looking to find out what this notation is:
\??\C:\windows\blahblah

Is this a mount point? Why would I have csrss.exe and ntsd.exe running from
\??\C:\windows\system32\?

Also curious if anyone can tell me if "active directory" and Sharepoint
files are installed with XP Home or Office 2003?

Jonybrv
07-10-2005, 12:44 AM
Where do you find this entry \??\C:\windows\blahblah ?

--
Jonybrv


"SRGriffin" wrote:

> "fresh" build of XP Home (meaning wiped disk w/ ghost first), installed XP
> from notebook image CD (compaq notebook). Installed SP2 from CD and
> installed Trend Micro virus software. Installed Office professional 2003.
> Connected to network and installed updates.
>
> Mostly just looking to find out what this notation is:
> \??\C:\windows\blahblah
>
> Is this a mount point? Why would I have csrss.exe and ntsd.exe running from
> \??\C:\windows\system32\?
>
> Also curious if anyone can tell me if "active directory" and Sharepoint
> files are installed with XP Home or Office 2003?

SRGriffin
07-10-2005, 12:44 AM
Sorry, should have been clear, no "blah blah" just meant all following
directories.

So what I see exactly is:

\??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
processes.

Also see:
\??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}

and seven more of these with various GUIDs in the registry under
HKLM\System\MountedDevices

Presumably for each partition..? But I don't have that many partitions.

Jonybrv
07-10-2005, 12:44 AM
If spybot shows only these entries starting with \??\, then it should have
some special meaning. Probably spybot is detecting them incorrectly has
spywares.

Lets not jump to conclusion here. I am running test to find if i get any
entries similar to this.

Let see if any experts here, are aware of this.

--
Jonybrv


"SRGriffin" wrote:

> Sorry, should have been clear, no "blah blah" just meant all following
> directories.
>
> So what I see exactly is:
>
> \??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
> processes.
>
> Also see:
> \??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}
>
> and seven more of these with various GUIDs in the registry under
> HKLM\System\MountedDevices
>
> Presumably for each partition..? But I don't have that many partitions.

Bob I
07-10-2005, 12:45 AM
R-click My Computer, Properties, Computer Name. What is the computer
name? Nothing? Give it one. It should replace those ?? for you.

SRGriffin wrote:

> Sorry, should have been clear, no "blah blah" just meant all following
> directories.
>
> So what I see exactly is:
>
> \??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
> processes.
>
> Also see:
> \??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}
>
> and seven more of these with various GUIDs in the registry under
> HKLM\System\MountedDevices
>
> Presumably for each partition..? But I don't have that many partitions.

SRGriffin
07-10-2005, 12:48 AM
Yes, it did have a name. Even renamed it and rebooted, but still comes up
the same.

In fact, it's the same on a number of my PCs, but haven't been able to find
ANY documentation on this syntax.



"Bob I" wrote:

> R-click My Computer, Properties, Computer Name. What is the computer
> name? Nothing? Give it one. It should replace those ?? for you.
>
> SRGriffin wrote:
>
> > Sorry, should have been clear, no "blah blah" just meant all following
> > directories.
> >
> > So what I see exactly is:
> >
> > \??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
> > processes.
> >
> > Also see:
> > \??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}
> >
> > and seven more of these with various GUIDs in the registry under
> > HKLM\System\MountedDevices
> >
> > Presumably for each partition..? But I don't have that many partitions.
>
>

Jonybrv
07-10-2005, 12:52 AM
I posted this question to Spybot tech support and yet to receive an answer.

Lets see.
--
Jonybrv


"SRGriffin" wrote:

> Yes, it did have a name. Even renamed it and rebooted, but still comes up
> the same.
>
> In fact, it's the same on a number of my PCs, but haven't been able to find
> ANY documentation on this syntax.
>
>
>
> "Bob I" wrote:
>
> > R-click My Computer, Properties, Computer Name. What is the computer
> > name? Nothing? Give it one. It should replace those ?? for you.
> >
> > SRGriffin wrote:
> >
> > > Sorry, should have been clear, no "blah blah" just meant all following
> > > directories.
> > >
> > > So what I see exactly is:
> > >
> > > \??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
> > > processes.
> > >
> > > Also see:
> > > \??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}
> > >
> > > and seven more of these with various GUIDs in the registry under
> > > HKLM\System\MountedDevices
> > >
> > > Presumably for each partition..? But I don't have that many partitions.
> >
> >

SRGriffin
07-10-2005, 12:58 AM
Thanks Jon. Let me know if you hear anything.



"Jonybrv" wrote:

> I posted this question to Spybot tech support and yet to receive an answer.
>
> Lets see.
> --
> Jonybrv
>
>
> "SRGriffin" wrote:
>
> > Yes, it did have a name. Even renamed it and rebooted, but still comes up
> > the same.
> >
> > In fact, it's the same on a number of my PCs, but haven't been able to find
> > ANY documentation on this syntax.
> >
> >
> >
> > "Bob I" wrote:
> >
> > > R-click My Computer, Properties, Computer Name. What is the computer
> > > name? Nothing? Give it one. It should replace those ?? for you.
> > >
> > > SRGriffin wrote:
> > >
> > > > Sorry, should have been clear, no "blah blah" just meant all following
> > > > directories.
> > > >
> > > > So what I see exactly is:
> > > >
> > > > \??\C:\windows\system32\ for csrss.exe and ntsd.exe in "Sbybot" as running
> > > > processes.
> > > >
> > > > Also see:
> > > > \??\Volume{49cdd646-c0b5-11d9-aaef-0008027c1dda}
> > > >
> > > > and seven more of these with various GUIDs in the registry under
> > > > HKLM\System\MountedDevices
> > > >
> > > > Presumably for each partition..? But I don't have that many partitions.
> > >
> > >


Drive location \??\C:\