After reviewing your thread and all the data, I figured out that a better way to resolve this.
Your machine has, what I can best determine, a false positive malware detection. It is only detected by Windows Defender(WD), the suspect file is in the HP OEM Recovery partition, and false positives by WD for this threat have been reported for a few years (always seems to be related to Wild Tangent games-distributed with many OEM machines).
Our discussion and analysis thus far centered around manually saving and then deleting the OEM recovery partition. Rather than using a brute force method, it dawned on me to try using the HP Recovery Manager to create the HP install media and to delete the partition.
Try is the operative word - I don't know if the HP Recovery Manager still knows about the OEM recovery partition because your machine was upgraded to Win10. I think it should, but you'll only know if you are able to successfully launch it.
There are two operations that the utility offers
1) Create the OEM Recovery media (which is Win8 - as the machine originally had out-of-the-box)
This is really only useful if you want to restore the machine to the original factory condition for resale
If you want plain vanilla Win8 (preferred by techies) you can grab the ISO from Microsoft using the Win8 Media Creation Tool.
What you lose is all the HP OEM
bloatware - HP utilities, games, and some software packaged with the machine.
Review the software sections - you might use some of the software, but most of it is unnecessary - hence bloatware
HP ENVY dv7 Product Specifications
The model might not match your model, but probably contains the same bloatware - you can visit the HP for your model to double check.
If you really want the software after re-installing plain vanilla Win8, you can download the software from HP. The only difficulty I had was with some CyberLink software - there are OEM registry entries that are only created by the HP Install media. These entries determine your eligibility to use the CyberLink software. If you don't use the CyberLink software, this is a moot point.
2) Remove the OEM Recovery Partition
This has been the intent of the thread because that is where the suspicious file lives
You'll have to make the decision to create the HP OEM Recovery media or create plain vanilla Win8 install media.
The HP Recovery partition is 35 GBs, so you'll probably need a 64 GB Thumb drive to store it. I don't recommend trying to put it on DVDs - 35 GBs would require 7 or 8 discs. It's a pain to create and a pain to re-install with that many.
Plain vanilla Win8 install media fits on a 4GB Thumb drive or one DVD.
Since we're talking about Win8 recovery media and your machine is now Win10, neither Win8 re-install mechanisms are technically necessary. Your machine has a Digital Entitlement to Win10, so you can re-install that any time without having to re-install Win8 and do the upgrade.
What do I do on my machines? I create the OEM recovery media when I first open the box and then Clean install with the plain vanilla install media. A clean install does not have the OEM Recovery partition, so I don't have to make any decisions about it ... but your situation is a bit different.
The question is: Does the HP Recovery Manager still work on Win10
Let's see -> From the Start screen, type recovery, and then select HP Recovery Manager.
If the HP Recovery Manager still works
You decide ...
create the OEM Recovery on a Thumb drive
-- or --
delete the OEM Recovery partition
If the HP Recovery Manager does NOT work, then the decision is still the same. Make a copy of the OEM Recovery partition or just delete the OEM Recovery partition.
The preferred method is to use the HP Recovery Manager: Delete OEM Recovery partition since it also tells the system to not look for it
My recommendation is to delete the OEM Recovery partition. You really don't need the Win8 HP OEM Recovery media.
Bill
.
Quote
). A 3rd category are those pgms that were migrated to Win10 Apps, some got new names - but they won't appear n Programs & Features. And finally some pgms were not carried over in the upgrade.