Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Removing or Hiding Strange Drive / Partition


  • Please log in to reply
14 replies to this topic

#1 FishKnight

FishKnight

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:34 AM

Posted 21 June 2018 - 07:24 PM

Recently I have been having trouble with a 508MB drive called "Local Disk (E:)" that shows up in my "This PC" menu. The reason it is an issue is because windows notifies me once every hour or so that it is almost out of space, sometimes even shifting focus to the desktop and minimizing the program I am running. It is super annoying so I want to delete the drive somehow.

 

I have no idea what it is or how it got there (it is not a physical hard drive or USB), and I was unable to delete it with the disk management tool (right clicking the drive only pops up with the help option). Disk management states that it is an OEM partition, whatever that means.

According to File Explorer, it only has 39.3 MB of empty space on it. When I open it with file explorer it is empty (even with show hidden files enabled). Using WINDIRSTAT I was able to find a single file on the drive called desktop.ini

 

desktop.ini contents:

[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
 
When I google the contents of this file a ton of threads about Trojans pop up... articles like "Hiding Malicious Files in Windows".
I don't think I have a virus on my computer because it isn't super slow or anything.. but I guess it is possible. Could it be a Trojan?
 
What is this drive, and, most importantly, how do I delete/hide it so that windows stops notifying me that it is almost full?
 
 

I have a Dell XPS (it wasnt there when I first installed windows 10) and recently installed Autodesk Maya and a GTX 1070 graphics card if that helps narrow anything down.


Edited by FishKnight, 21 June 2018 - 07:25 PM.


BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 21 June 2018 - 07:29 PM

That is a bug in Windows 10 where the RE or EFI partition is given a drive letter. You will need to unassign the letter to the offending partition using diskpart. Make sure you select the correct partition. In the below post is a link. Use option 2.

 

https://www.bleepingcomputer.com/forums/t/678877/mysterious-local-disk/?p=4509774


Edited by JohnC_21, 21 June 2018 - 07:30 PM.


#3 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 01 July 2018 - 11:22 AM

I just joined this group so I'm not certain this is the proper place for my inquiry but here goes.

I just discovered some(4) partitions on my hard drive besides the C: drive. One of them in particular bothers me. it is \\?\Volume{8e6dacbe-461d-4f4f-af66-5667bc90d026}\. When I do a search on it, it comes up as 5 results, all related to Air France flight AF66.

Since I have never tried to log into Air France(that I remember), I don't understand why this should be a partition on my hard drive.



#4 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 01 July 2018 - 12:10 PM

That looks like a GUID partition table reference but I could not find that particular GUID when doing a search. Can you post an image of Disk Management showing the partitions?

 

https://en.wikipedia.org/wiki/GUID_Partition_Table



#5 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 02 July 2018 - 07:33 AM

I seem to be having a hard time attaching or sending anything but text on this forum. What format should I be sending a screen shot in?



#6 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 02 July 2018 - 07:51 AM

Click More Reply Options next to the Post Button. Attach a jpg file. You can use the Windows Snipping Tool.



#7 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 03 July 2018 - 09:05 AM

Still get this message....

 

You are not allowed to use that image extension on this community



#8 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 03 July 2018 - 10:08 AM

Use a image posting service like postimage.org. Copy the url it gives you then click on the icon that looks like a picture next to <>and copy the link.



#9 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 03 July 2018 - 01:25 PM

OK, here goes...

 

https://s26.postimg.cc/f2fsxq961/partition_scr_shot.jpg



#10 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 03 July 2018 - 02:36 PM

That image is too small and it doesn't look like Disk Management. 

 

Right click Computer > Manage > Disk Management. Use the snipping tool to capture a jpg. When you upload it to postimage it will give you a direct URL link. You then click on the picture image in the BC menu bar next to the <> and paste the link.

 

Capture.jpg



#11 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 03 July 2018 - 06:51 PM

That window is"Optimize drives". It's the only place that the "\\?\Volume{8e6dacbe-461d-4f4f-af66-5667bc90d026}\" drive appears.

 

What "Computer > Manage > Disk Management" do you want me to right click? What is the Windows snipping tool? Do you mean Ctrl+C, Ctrl+V, etc?



#12 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 03 July 2018 - 07:10 PM

That volume does not show up in Disk Management? Note: Disk Management is Right click Computer, Click Manage. Click Disk Management.

 

If it does not show in disk management open a command prompt and type the following commands

 

diskpart

list disk

select disk X    X being the disk where the volume is located

list volume

 

Post a screen shot.

 

Edit: I came across this Microsoft thread with a problem identical to yours.

 

https://answers.microsoft.com/en-us/windows/forum/windows8_1-hardware/strange-volume-listed-by-disk-defrag/00ea7a77-12b7-450b-a6b7-94dae520bcdd

 

It seems to be traced to the computer being connected to a network share. See the other replies.


Edited by JohnC_21, 03 July 2018 - 07:33 PM.


#13 flytyer96

flytyer96

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:34 AM

Posted 03 July 2018 - 08:28 PM

OK, one more time....

https://s26.postimg.cc/ddbb3lt6x/diskpart.jpg



#14 JohnC_21

JohnC_21

  • Members
  • 24,426 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:34 AM

Posted 03 July 2018 - 08:42 PM

In my previous post I posted a link to a Microsoft thread with a problem identical to yours. This orphan volume seems to be traced to a computer that was connected to a network share. 

 

From your diskpart command I don't see anything unusual except for the fact you have a drive letter assigned to the ESP partition. The ESP partition normally does not have a drive letter assigned to it. 

 

In your small image of Drive Optimization I think I see a C: partition, ESP, WinRETools, and PBR. That is 4 partitions and the one strange one.

 

In your diskpart image is a volume 3 which is not labeled and 511MB.

 

At the diskpart prompt type

 

list disk

select disk 0

list partition  and look for the number associated with the 511MB partition

list partition X  where X is the number of the 511MB partition

detail partition

 

post a screenshot



#15 medab1

medab1

  • Members
  • 844 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:earth
  • Local time:08:34 AM

Posted 16 July 2018 - 04:45 AM

Use a image posting service like postimage.org. Copy the url it gives you then click on the icon that looks like a picture next to <>and copy the link.

 

Some help with Postimage---

 

https://www.bleepingcomputer.com/forums/t/43088/how-to-capture-and-edit-a-screen-shot/#entry4532851


Learn to take screenshots & add them to your posts. :thumbup2:

https://www.bleepingcomputer.com/forums/t/43088/how-to-capture-and-edit-a-screen-shot/#entry4532851

Learn to use Google Search.  :busy:

Make full system images to restore to if your computer goes bonkers.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users