Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory.

What exactly does this mean?


I also see $MapAttributeValue, which looks unfamiliar as well.

share|improve this question

1 Answer 1

Update: I researched this issue further (since I've noticed the same behavior on my own computer, and was worried that this is some kind of malware), and now I believe my original answer was in fact incorrect. Here's what I found now:

  1. Several different procesess read from this file, and from different offsets, but with the same length: 4K (exactly one memory page).
  2. There are ReadFile operations, but no opening of the file, which makes little sense.
  3. Looking at the stack trace, I see that all requests include a page fault in the trace, e.g. this file read is inside IoPageRead(), kernel function that reads pages from the paging file into memory.
  4. These reads happen on C:\$Directory and V:\$Directory on my system, the two drives that hold paging files on them, and nowhere else.

Based on this research, I strongly believe that this "file read" is some kind of Process Monitor artifact, and the real read happens in the paging file. I have no idea why ProcMon lists the path as C:\$Directory.

I don't think now that this C:\$Directory is a real NTFS metafile. I don't think now that this could be some illegitimate activity (virus or other malware).

share|improve this answer
I'm pretty sure it's not #3 or #2. So it's probably #1. It doesn't really tell me anything, though... –  Mehrdad Nov 11 '11 at 23:30
normally this is assigned to the explorer.exe. So, I also guess, it isn`t #2 or #3. –  Diskilla Nov 11 '11 at 23:48
I changed my answer completely, sorry. –  haimg Nov 12 '11 at 3:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.