5

I tried going through my C drive (SSD) to clean up files as I was running out of storage on it, and I found a folder called SYSTEM.SAV. It's a hidden folder in full caps.

In there I found logs about amazon shopping, netflix watching, registry "flushing" as well as a file called PostFBI.bcmd with this contents:

@Echo off
IF EXIST X:\HideScrn.flg (del /f /q X:\HideScrn.flg)
IF EXIST c:\CTOERROR.flg (
    CALL C:\system.sav\ExitProc\util\CTOPanic.cmd
) ELSE (
    IF EXIST C:\system.sav\Flags\Win7.flg CALL C:\system.sav\ExitProc\Util\rmshowfinish.cmd
)
@Echo on

This looks very suspicious to me. I looked at the dates of the logs and most are from two years ago. I can recall having been bombed by virusses and restoring my pc. So I suppose that's what they're here from.

Can I delete these files/the whole folder?

  • 1
    The file is not a Microsoft system file. It was not created by Windows either. The contents were generated by software you placed on the system. – Ramhound Feb 14 '18 at 19:23
  • But can I safely delete the folder? @Ramhound – Tvde1 Feb 14 '18 at 20:05
  • Rename it. If anything blows up name it back. – headkase Feb 14 '18 at 20:10
  • 1
    If you're unsure about the integrity of your system, you should format and start from scratch. The added bonus will be that you now have plenty of space, which was your original problem. – Michael Frank Feb 14 '18 at 20:47
  • @Tvde1 - I have indicated it is not used by Windows, it was not created by Windows, and was created by a user process. The existence of the file won't affect the ability to boot the system, even if it was used by software, it would just break that specific software. – Ramhound Feb 14 '18 at 21:09
3

Some Google searches found that this is used by the HP Recovery Manager (see versions: Windows Vista, Windows 7, Windows 8, Windows 10). The Netflix/Amazon/etc. files may actually refer to the out-of-the-box "bloatware" that the system shipped with. The oldest of my laptops, an HP Pavilion dv6z-3000, had this folder at one point (and IIRC was created when I ran recovery on it).

From what I can tell, the recovery software uses a recovery partition, and this folder is created during the recovery process. It is probably not malicious, though you might want to scan it to make sure it hasn't been infected. I'm not sure if deleting it will break the recovery, but you can try compressing it into an archive and removing the folder to save space.

  • It's weird, I do have a HP Laptop and have used HP Recovery Manager before, but it's only ran Windows 10. – Tvde1 Feb 14 '18 at 21:31
  • 1
    @Tvde1 - What was your resolution? I have the same suspicious folder. Any chance you also have a folder elsewhere called BROWNY02, if you search all folders? – ashleedawg May 8 '18 at 9:00
  • 1
    @ashleedawg 1920x1080 and I wiped all my files – Tvde1 May 8 '18 at 9:26
1

These files were placed by HP either while the computer was in for repair or during the recovery process if you were using their recovery flash drive.

HP repair placed them on my new laptop, which I had reformatted prior to sending it in, and left them on my computer when they returned it to me.

Being curious, I then ran a system report to see what occurred during the time it was in for repair, and it shows 2,217 files were installed on my computer while in their possession, including all the system.sav files.

HP denied ever having heard of these files and stated they only replaced my screen so therefore were not responsible, but couldn't answer how they got on there as I had reformatted it to factory settings before sending it in for repair.

Furthermore, after HP replaced the motherboard and hard drive in my computer (I kept the original hard drive as evidence), they sent me 2 duplicate flash drives to reinstall the OS, and during the install a block appeared on screen that said the installation wass occurring under something called "FBI DEBUG MODE", before disappeared and the install process continued.

However, once the installation was done the system.sav files were back, as were all the other files that HP has maintained they have no knowledge of.

A quick check shows the files are on both flash drives that they sent me so any doubt as to where they came from is now moot.

I'm going to give HP one more chance to own up to this before deciding what to do since the resulting virus has devastated my network infecting everything it touches.

protected by Ramhound Jun 14 at 0:48

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.