ghost partition appearing at every boot

[zsero]

I don't know why, but I have a partition appearing at every bootup, called Q:\. Using mountvol.exe I can delete it, but it reappears. Mountvol /D works, /P doesn't. Do you know how to find that which volume id is connected to which hardware?

BTW, before you ask, it's not a card reader, it's a fixed disk device, which I cannot see in diskmgmt.msc.

Edited February 9, 2010 by zsero

[jaclaz]

Partitions usually don't come out of thin air.

If Mountvol adssigns to it letter Q: it means it is accessible in Explorer

Which size is it?

Which filesystem it uses?

What does it contain?

If you click on properties of the volume, and then Hardware, which hardware is listed? (There will be several entries, and possibly you can spot the one that "should not" be there).

Is it by any chance 100 Mb or 200 mb in size?

jaclaz

Edited February 9, 2010 by jaclaz

[MrJinje]

Open Powershell and run this snippet. Should tell us the basic details of the Q: drive.

Get-WmiObject -class Win32_Volume | where-object {$_.Caption -eq "Q:\"}

Edited February 9, 2010 by MrJinje

[zsero]

It comes out of thin air! It has no size, no owner I cannot change owner nor security permissions, it has no hardware tab on the properties pane and I cannot see it in disk management console. I cannot open it nor get any information about it.

This is the output of the powershell script:

__GENUS					  : 2
__CLASS					  : Win32_Volume
__SUPERCLASS				 : CIM_StorageVolume
__DYNASTY					: CIM_ManagedSystemElement
__RELPATH					: Win32_Volume.DeviceID="\\\\?\\Volume{cdc5925c-0e
							   db-11df-a765-001d60dd8569}\\"
__PROPERTY_COUNT			 : 44
__DERIVATION				 : {CIM_StorageVolume, CIM_StorageExtent, CIM_Logic
							   alDevice, CIM_LogicalElement...}
__SERVER					 : ZS-PC
__NAMESPACE				  : root\cimv2
__PATH					   : \\ZS-PC\root\cimv2:Win32_Volume.DeviceID="\\\\?\
							   \Volume{cdc5925c-0edb-11df-a765-001d60dd8569}\\"
Access					   : 
Automount					: True
Availability				 : 
BlockSize					: 
BootVolume				   : 
Capacity					 : 
Caption					  : Q:\
Compressed				   : 
ConfigManagerErrorCode	   : 
ConfigManagerUserConfig	  : 
CreationClassName			: 
Description				  : 
DeviceID					 : \\?\Volume{cdc5925c-0edb-11df-a765-001d60dd8569}
							   \
DirtyBitSet				  : 
DriveLetter				  : Q:
DriveType					: 3
ErrorCleared				 : 
ErrorDescription			 : 
ErrorMethodology			 : 
FileSystem				   : 
FreeSpace					: 
IndexingEnabled			  : 
InstallDate				  : 
Label						: 
LastErrorCode				: 
MaximumFileNameLength		: 
Name						 : Q:\
NumberOfBlocks			   : 
PageFilePresent			  : 
PNPDeviceID				  : 
PowerManagementCapabilities  : 
PowerManagementSupported	 : 
Purpose					  : 
QuotasEnabled				: 
QuotasIncomplete			 : 
QuotasRebuilding			 : 
SerialNumber				 : 
Status					   : 
StatusInfo				   : 
SupportsDiskQuotas		   : 
SupportsFileBasedCompression : 
SystemCreationClassName	  : 
SystemName				   : ZS-PC
SystemVolume				 :

Edited February 10, 2010 by zsero

[cluberti]

Hmmm - a fixed drive, set to automount, with no filesystem (at least not to WMI, anyway). The second question - if you boot from a recovery disc or WinPE disc, does the partition show up in diskpart or any other disk management tools there? It almost sounds like some recovery or tools partition that the BIOS has set up.

[jaclaz]

Well, this:

Automount					: True

http://msdn.microsoft.com/en-us/library/aa394515(VS.85).aspx

explains why it gets a drive letter.

As a reference, this is how a similar command behaves on a "real" volume:

http://blogs.technet.com/heyscriptingguy/a...mi-methods.aspx

You can try doing a dismount:

http://msdn.microsoft.com/en-us/library/aa390368(VS.85).aspx

it seems like it resets Automount to False.

It is not clear the actual usage, it seems you need first to unmount the volume through Mountvol, and then run something *like*:

http://www.vistax64.com/powershell/156842-...ount-drive.html

which cannot work as the device has not anymore a drive letter it seems like there is no reference around for a tested working method.

There is this one, but it ONLY works on Server 2003, seemingly:

http://gallery.technet.microsoft.com/Scrip...2e-4104f12c6e72

jaclaz

[e-t-c]

Just FYI: Maybe not for Windows 7.

STORY: Some weeks ago, i had a ghost drive but on my XP - and i explore trough the Registry and found

misc MountPoints2 Keys - and I delete the others and the underkeys of the following ...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

And after reboot i have no Ghostdrive again.

Some Times later I found this Article ...

More on Autorun http://blogs.technet.com/steriley/archive/...on-autorun.aspx

cheers

[jaclaz]

Clearing MountPoints2 is a good idea , since at the worst it won't produce any adverse effect (and one can anyway back it up before clearing).

jaclaz