Results 1 to 9 of 9

Thread: Ideas as to what \\?\ might be doing at the start of a path

  1. #1
    Triple Platinum Member wumply's Avatar
    Join Date
    Oct 2002
    Location
    Belmont, NH
    Posts
    785

    Ideas as to what \\?\ might be doing at the start of a path

    When I tried to clone my HD with CasperXP, it cloned OK...except there was this message:

    Copying Disk 1 to Disk 2.
    ERROR; GetWriterMetadataCount returned VSS_E_BAD_STATE (80042301)
    WARNING: volume snapshot failed (error=80042301)
    COPY SOURCE ERROR 32: Could not safely access file: "\\?\C:\WINDOWS\system32\lqfoe89kr.lwp". The following processes are using this file.
    Process Name: aaksrv.exe
    Path: C:\Windows\system32\aaksrv.exe.
    Services registered in process:
    aaksrv [aaksrv]
    Copy completed successfully.

    Except that it did not copy the lqfoe89kr.lwp file in question!!!

    That lqfoe89kf.lwp is a file from my anti keylogger and it contains a record of all the programs that I have told anti keylogger that it may permit to function even though they do read keys or try to take a snapshot. Without that file (for I removed it to find out what it did and then replaced it) anti keylogger asks me if it can allow each and every program that was on the list. I say "OK"; it then asks for my PW which, when entered, results in my being informed I need to type the correct PW.

    So there's the background! My question is what do you make of \\?\ preceding the start of the path to the file? I've never seen anything like it; is it possibly part of the path or does it likely represent a corrupted bit of code?

    IF UNINSTALL/REINSTALL DOES NOT REMOVE \\?\ AFTER A NEW CLONE ATTEMPT, ANY WAY TO GET RID OF THAT \\?\ SHORT OF A REFORMAT OF MY HD? (I will note that Norton Ghost 2003 got nowhere when I tried to clone with it.)

    The anti keylogger people tell me to uninstall and reinstall and reboot which I will, of course, do--just haven't done it yet. In spite of that \\?\ the anti keylogger program works just fine and I can access the file easily by following the path.
    I've created my own website...a collection of moving, sad and happy and humorous poems which I would like to share with others. They come from stories my dad used to tell me when I was a kid. If you could glance at my site and if you know of others who might enjoy it and perhaps tell them of it, I would be most appreciative. Thank you. The address is www.metrocast.net/~wumply/exper-1.html

  2. #2
    Triple Platinum Member Curio's Avatar
    Join Date
    Nov 2004
    Location
    London
    Posts
    899
    I believe that the \\?\ represents a top level drive and c:\ the volume, I don't think it's anything to worry about.
    I'm using Windows 7 - you got a problem with that?

  3. #3
    Triple Platinum Member wumply's Avatar
    Join Date
    Oct 2002
    Location
    Belmont, NH
    Posts
    785
    What's top level drive?

  4. #4
    Triple Platinum Member Curio's Avatar
    Join Date
    Nov 2004
    Location
    London
    Posts
    899
    A physical drive/disk - a volume is a partition (usually) on the drive although when it is part of a RAID array then it is slightly different.
    I'm using Windows 7 - you got a problem with that?

  5. #5
    Security Intelligence TZ Veteran cash_site's Avatar
    Join Date
    Jul 2002
    Location
    Software Paradise
    Posts
    3,735
    Yeah, the anti-keylogger is prolly loaded to access at a higher (err, lower) level (simialar to rootkits - i would think).... The app prolly didnt clone correctly, because it references the old drive )not just c:\ ...

    You might have to do a manual uninstall and delete all reg-keys...

    --- 0wN3D by 3gG ---

  6. #6
    Triple Platinum Member wumply's Avatar
    Join Date
    Oct 2002
    Location
    Belmont, NH
    Posts
    785
    Cash. I've not run into "prolly" before. Does it mean "probably"...an Australianism?

  7. #7
    Old and Cranky Super Moderator rik's Avatar
    Join Date
    Aug 2003
    Location
    Watching Your every move...
    Posts
    4,638
    Me thinks is prolly mo of a "Lazyism"

  8. #8
    Triple Platinum Member wumply's Avatar
    Join Date
    Oct 2002
    Location
    Belmont, NH
    Posts
    785
    Does me know?

  9. #9
    Security Intelligence TZ Veteran cash_site's Avatar
    Join Date
    Jul 2002
    Location
    Software Paradise
    Posts
    3,735
    yeah, just lazy... Rik knows me too well

    --- 0wN3D by 3gG ---

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •