I tried going through my C drive (SSD) to clean up files as I was running out of storage on it, and I found a folder called SYSTEM.SAV. It's a hidden folder in full caps.
In there I found logs about amazon shopping, netflix watching, registry "flushing" as well as a file called PostFBI.bcmd with this contents:
@Echo off
IF EXIST X:\HideScrn.flg (del /f /q X:\HideScrn.flg)
IF EXIST c:\CTOERROR.flg ( CALL C:\system.sav\ExitProc\util\CTOPanic.cmd
) ELSE ( IF EXIST C:\system.sav\Flags\Win7.flg CALL C:\system.sav\ExitProc\Util\rmshowfinish.cmd
)
@Echo onThis looks very suspicious to me. I looked at the dates of the logs and most are from two years ago. I can recall having been bombed by virusses and restoring my pc. So I suppose that's what they're here from.
Can I delete these files/the whole folder?
72 Answers
Some Google searches found that this is used by the HP Recovery Manager (see versions: Windows Vista, Windows 7, Windows 8, Windows 10). The Netflix/Amazon/etc. files may actually refer to the out-of-the-box "bloatware" that the system shipped with. The oldest of my laptops, an HP Pavilion dv6z-3000, had this folder at one point (and IIRC was created when I ran recovery on it).
From what I can tell, the recovery software uses a recovery partition, and this folder is created during the recovery process. It is probably not malicious, though you might want to scan it to make sure it hasn't been infected. I'm not sure if deleting it will break the recovery, but you can try compressing it into an archive and removing the folder to save space.
3These files were placed by HP either while the computer was in for repair or during the recovery process if you were using their recovery flash drive.
HP repair placed them on my new laptop, which I had reformatted prior to sending it in, and left them on my computer when they returned it to me.
Being curious, I then ran a system report to see what occurred during the time it was in for repair, and it shows 2,217 files were installed on my computer while in their possession, including all the system.sav files.
HP denied ever having heard of these files and stated they only replaced my screen so therefore were not responsible, but couldn't answer how they got on there as I had reformatted it to factory settings before sending it in for repair.
Furthermore, after HP replaced the motherboard and hard drive in my computer (I kept the original hard drive as evidence), they sent me 2 duplicate flash drives to reinstall the OS, and during the install a block appeared on screen that said the installation wass occurring under something called "FBI DEBUG MODE", before disappeared and the install process continued.
However, once the installation was done the system.sav files were back, as were all the other files that HP has maintained they have no knowledge of.
A quick check shows the files are on both flash drives that they sent me so any doubt as to where they came from is now moot.
I'm going to give HP one more chance to own up to this before deciding what to do since the resulting virus has devastated my network infecting everything it touches.
