Security and privacy

We successfully upgraded to 1.9.5 and are now busy tweaking any security issues.

the issue I can't get rid of is -
"Your site configuration might not be secure. Please make sure that your dataroot directory (K:\/moodledata) is not directly accessible via web."
This is also in the security report.
Our set up is WIMP and our folders are

C:\Inetpub\wwwroot\web sites\default web site\ moodle(Virtual directory pointing to K:\moodle)

K:\moodle
K:\moodledata

So moodledata is not accessible via the web, I've also tested it by uploading a HTML file which I can't access unless Im logged on.
Is it becuase the folder structure is the same for moodle and moodledata that is producing the warning?

thanks in advance

Jackie

PS though OT with this forum when logged on as admin its very very slow?