devnulllore Posted August 6, 2019 Share Posted August 6, 2019 Hello, I have a second SSD that I have my games installed on and that's it. After some monitoring I noticed sometimes Windows accesses the drive for no reason that I can see. After some inspection I found that there is a hidden folder on the drive called "boot". Can this be malware? I have indexing turned off so there is no reason for the drive to be accessed without playing games is there? Malware scans turn up nothing but I do not know if the can scan hidden files and folders. Any ideas? Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 6, 2019 Supervisor Share Posted August 6, 2019 are you sure the SSD isn't legitely set as the boot drive? easiest way to rule that out would be to pull the SSD and try to boot up. my other thought is maybe Windows set a page file on the drive for some VRAM if in doubt I'd boot into a Anti-Virus recovery disc/usb to scan; I've used Kaspersky Rescue Disc in the past with good results Link to comment Share on other sites More sharing options...
devnulllore Posted August 6, 2019 Author Share Posted August 6, 2019 I read an article just now that said Windows can alot a folder on a secondary drive if a reinstall or restore is done. I just reinstalled Windows yesterday. Maybe that's it? Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 6, 2019 Supervisor Share Posted August 6, 2019 Just now, devnulllore said: I read an article just now that said Windows can alot a folder on a secondary drive if a reinstall or restore is done. I just reinstalled Windows yesterday. Maybe that's it? yes that's most likely exactly what happened. that is the reason a lot of techies will recommend removing all but the drive you're installing on when installing Windows as it doesn't always put the boot sector on the drive you're installing on for some reason; never understood why myself but it's a thing a1ien and ThaCrip 2 Share Link to comment Share on other sites More sharing options...
devnulllore Posted August 6, 2019 Author Share Posted August 6, 2019 So am I playing with fire if I delete that folder? Link to comment Share on other sites More sharing options...
Mindovermaster Moderator Posted August 6, 2019 Moderator Share Posted August 6, 2019 If it doesn't bother you, leave it... Link to comment Share on other sites More sharing options...
devnulllore Posted August 6, 2019 Author Share Posted August 6, 2019 Well the whole reason I started monitoring HD access is it seems whenever the system accesses the drive I get some hitching or pausing like a bottleneck from an old mechanical drive.. Very annoying. Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 6, 2019 Supervisor Share Posted August 6, 2019 9 minutes ago, devnulllore said: So am I playing with fire if I delete that folder? if you delete the folder you may not be able to boot into windows. you could either re-install windows again making sure the SSD is removed during the process or you could attempt to move the boot files though that's a little trickier. Here's a guide to move the boot files/partition to another drive using EasyBCD https://neosmart.net/wiki/easybcd/basics/changing-the-boot-partition/ Link to comment Share on other sites More sharing options...
Steven P. Administrators Posted August 6, 2019 Administrators Share Posted August 6, 2019 Right click on the start menu flag and click on Disk Management, there you should be able to see where Windows has put the Boot drive, because it will say it on one of the disks. This will tell you if Windows boots from C:\ D:\ or anyplace else Mine is C:\ Link to comment Share on other sites More sharing options...
devnulllore Posted August 6, 2019 Author Share Posted August 6, 2019 2 hours ago, Steven P. said: Right click on the start menu flag and click on Disk Management, there you should be able to see where Windows has put the Boot drive, because it will say it on one of the disks. This will tell you if Windows boots from C:\ D:\ or anyplace else Mine is C:\ yeah that's what it says on my C drive my G (game drive) just says healthy primary Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 6, 2019 Supervisor Share Posted August 6, 2019 Just now, devnulllore said: yeah that's what it says on my C drive my G (game drive) just says healthy primary hmm yeah then it could be something malicious. I'd scan it with the Kasperskiy bootable recovery disc I mentioned above to verify and then you shouldn't have an issue deleting the folder from that bootable media either. If for whatever reason your computer won't boot up after you delete that folder you can pop you installation disc/usb back in and run the boot repair Link to comment Share on other sites More sharing options...
goretsky Supervisor Posted August 6, 2019 Supervisor Share Posted August 6, 2019 Hello, What are the contents of the \boot folder on the secondary SSD? Is there anything noteworthy about the date(s) on the content(s) that might be associated with a specific activity, such as reinstalling the operating system, installing new software and so forth? Regards, Aryeh Goretsky Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 A couple of files called bootstrap.exe, emm386 and another sub-folder called booter that I cannot access. I can't see anyway to delete them. Link to comment Share on other sites More sharing options...
DPyro Posted August 7, 2019 Share Posted August 7, 2019 What software did you use to scan it? Malwarebytes is usually pretty good. Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 Malware bytes and Eset Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 7, 2019 Supervisor Share Posted August 7, 2019 2 hours ago, devnulllore said: A couple of files called bootstrap.exe, emm386 and another sub-folder called booter that I cannot access. I can't see anyway to delete them. that's why I said scan it with the Kaspersky rescue boot disk. you should be able to delete the folder from within that boot environment as well edit: it's always good to scan a suspected directory outside of your installed environment just to be sure it's not hiding itself from the installed scanner in some way Link to comment Share on other sites More sharing options...
Ve7878 Posted August 7, 2019 Share Posted August 7, 2019 Could you post a screenshot showing disk management? Windows Key + X > Disk Management Link to comment Share on other sites More sharing options...
Brandon H Supervisor Posted August 7, 2019 Supervisor Share Posted August 7, 2019 6 minutes ago, Vince800 said: Could you post a screenshot showing disk management? Windows Key + X > Disk Management he confirmed his matches steve's screenshot above already Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 I ran the rescue disk and deleted the boot folder but still accesses the drive and causes hitching (system pauses) when it does. Link to comment Share on other sites More sharing options...
Ve7878 Posted August 7, 2019 Share Posted August 7, 2019 2 hours ago, Brandon H said: he confirmed his matches steve's screenshot above already Yes but in my opinion it's worth checking just to make sure everything else looks okay. 2 hours ago, devnulllore said: I ran the rescue disk and deleted the boot folder but still accesses the drive and causes hitching (system pauses) when it does. Do you get a system pause every time you access the drive, even if you close it and go straight back into it. Although it's an SSD I wonder if it's some power saving option at play causing this issue. Brandon H 1 Share Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 I will check my power settings Link to comment Share on other sites More sharing options...
xrobwx71 Posted August 7, 2019 Share Posted August 7, 2019 Do you have a backup image of your c:\ boot drive and a plan for recovery if you experience failure? Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 1 hour ago, xrobwx said: Do you have a backup image of your c:\ boot drive and a plan for recovery if you experience failure? Yes always Link to comment Share on other sites More sharing options...
xrobwx71 Posted August 7, 2019 Share Posted August 7, 2019 1 hour ago, devnulllore said: Yes always Have you followed Brandon's advice and scanned the file outside the OS in the boot environment and deleted it? If you have a backup and it won't boot you can simply recover. Link to comment Share on other sites More sharing options...
devnulllore Posted August 7, 2019 Author Share Posted August 7, 2019 Just now, xrobwx said: Have you followed Brandon's advice and scanned the file outside the OS in the boot environment and deleted it? If you have a backup and it won't boot you can simply recover. Yes I did that with the Kaspersky rescue boot disk. Still happening Link to comment Share on other sites More sharing options...
Recommended Posts