Hard drive loosing space

[Weyoun]

Hello all,

 

Maybe I'm just being a bit paranoid here (I usually am), but I wanted to ask to see if this is something I should worry about. I noticed that my hard drive had 436 Gigs of free space, then a few minutes later, 435, then 434, now 433. Me being the paranoid that I am, put a clean image on the hard drive, and the hard drive again had 436 Gigs free after that. Then again, down to 433 within 2 minutes. I checked and System restore is not making any restore points, and I used CCleaner to clean out all temp and junk files, but I don't get the space back. I put the clean image back on a third time to see if it would happen again, and sure enough it did within 5 minutes again. I have not downloaded or installed anything, I checked and system restore is not making any restore points, and Windows update isn't doing it because it hasn't checked for updates in a while. Is this anything to worry about, or am I just being overly worried and this is just a normal thing for Windows? Running Windows 7 Ultimate x64. I'm extremely paranoid when it comes to security .

 

Thanks for the help!

[AdvancedSetup]

It very well could just be normal Windows operations.  Please see if the following links help or not.
 
How to address disk space issues that are caused by a large Windows component store (WinSxS) directory

Engineering Windows 7 - Disk Space

Clean Up the WinSxS Folder

The Winsxs Folder Explained

 
 
You can also run the following scan and post the logs and we can review it and see if we can find anything out of the ordinary or not.
 
Please run the following scanner and send back the logs.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt

• Save both reports to your desktop
• Please include the following logs in your next reply as an attachment: DDS.txt and Attach.txt
• You can ignore the note about zipping the Attach.txt file and just post it or attach it.

[David H. Lipman]

Weyoun:
 
You can run the "Disk Cleanup" utility [ cleanmgr.exe ]
 
If will list various resources and the space they consume and give you the option to purge them if you desire as seen below.  This way you will have an idea what in the OS may have "cached" a large amount of data and thus consume more space.
 

[daledoc1]

Hi, Weyoun:

 

Please do follow the suggestions of DHL and AdvancedSetup, as they are the experts.

 

One quick question, though: Are you running KIS or KAV for your anti-virus, by any chance?

 

daledoc1

[Weyoun]

Hi AS & Mr. David & daledoc1,

Thank you all for your assistance!

 

I read up those articles, I didn't really understand them very well though, lol. I ran the dds tool; here are the logs:

I ran cleanmgr.exe and it cleared 1.5 MB of space.

Daledoc1, NIS v 21.0.2.1 is my A-V and firewall.

 

Thanks all!

 

Weyoun

[daledoc1]

Daledoc1, NIS v 21.0.2.1 is my A-V and firewall.

 

 

Ah, OK.

My reason for asking is that folks running KIS/KAV sometimes inadvertently enable "traces" in the program, and that causes massive GB of hard drive space to be consumed by the accumulating files.

Since you run NIS, that's not the problem.

 

Well, with any luck the gurus will see something in yout DDS logs to help you out.

 

Cheers,

 

daledoc1

[AdvancedSetup]

Well you need to disable your Norton antivirus to run the DDS scanner as it blocked many of the scans it was attempting to do.

When done then re-enable your antivirus.

 

I do see that you have Acronis TrueImage installed and that has a scheduler running so perhaps you have it scheduled to be doing data backups ?

[David H. Lipman]

"I ran cleanmgr.exe and it cleared 1.5 MB of space."

 

Was that 1.5 MB or did you mean 1.5 GB ?

[Weyoun]

Hi AS,

I thought I had disabled Norton, I apologize for that. I tried again:

Hope Norton didn't block it this time. Acronis is not running scheduled backups, because the version I use doesn't have that ability. I use the True Image free "WD Edition" that came with my WD external hard drive I bought 2 years ago. This version only does full backup images and only manually when I have the external hard drive plugged in, it doesn't even give me the option to do scheduled backups.

 

Mr. David, yes, that is 1.5 MB as in Megabytes.

 

Daledoc1, thanks for the reply, : )

 

Thanks again all!

Weyoun

[AdvancedSetup]

Nope the log was still blocked.

 

I don't think you're necessarily infected but in order to run some other tools we'll need to move over into the malware removal forum.  Please follow the advice below.

 

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.


Thanks

[Weyoun]

Hi AS,

 

Okay, I'll do that. Should I reference this thread when I start a new topic there?

 

Thanks for your assistance!

Weyoun

[AdvancedSetup]

Yes, referencing this topic would be good.

 

Cheers

[Weyoun]

Hi AS,

 

I posted the new topic and referenced this one with a link.

 

Thanks again and cheers!

Weyoun

[AdvancedSetup]

The scans and logs do not appear to show any signs of real malware.
Now as to what or why you think drive space is disappearing out of the blue is another matter.

What you can try is starting NOTEPAD and then copy/paste the contents of the code box below into the new Notepad document.
Then do a File Save-As and save the file where you can easily find it and name it something like "GetDiskSpace.bat"
Make sure you enclose the name in quote marks as shown so that it will save it as .bat and not as .txt
 
 

pushd "%~dp0"cd /d "%~dp0"cls@echo off:checkspaceset Log="%USERPROFILE%\Desktop\MyDiskSpace.txt"echo/@echo off&SETLOCALFOR /f "tokens=1-4 delims=/-. " %%G IN ('date /t') DO (call :GetDate %%G %%H %%I %%J)goto SetDate:GetDateif "%1:~0,1%" GTR "9" shiftFOR /f "skip=1 tokens=2-4 delims=(-)" %%G IN ('echo.^|date') DO (    Set %%G=%1&set %%H=%2&Set %%I=%3)exit /b:SetDateEndlocal&(Echo.|date|find "JJ">nulIf errorlevel 1 (  SET yy=%yy%&SET mm=%mm%&SET dd=%dd%) Else (  SET yy=%JJ%&Set mm=%MM%&SET dd=%TT%))SET DV=%yy%-%mm%-%dd%For /f "tokens=1-3 delims=1234567890 " %%a in ("%time%") Do set "delims=%%a%%b%%c"For /f "tokens=1-4 delims=%delims%" %%G in ("%time%") Do (  Set _hh=%%G  Set _min=%%H  Set _ss=%%I  Set _ms=%%J)Set _hh=%_hh: =%if 1%_hh% LSS 20 Set _hh=0%_hh%ENDLOCAL&Set DT=%_hh%%_min%%_ss%%_ms%SET CDT=%DV%_%DT%echo/ >>%Log%echo Space Check Ran on: %CDT% >>%Log%echo/ >>%Log%dir c:\ >>%Log%goto eof)@echo on:EOFset Log=set OEMCP=set Folder=SET yy=SET DV=SET _hh=SET _min=SET _ss=SET _ms=SET DT=rem Code ideas from SS64

Then double-click on the new batch file it should create a new file on your desktop named: MyDiskSpace.txt
As long as it does create the file then you can now setup a scheduled task to run it every so often and see how much the disk space is changing.

Create a new scheduled task that runs with highest privileges as shown in the link below using your new batch file GetDiskSpace.bat

Set it to run say every 30 minutes and let it run for an hour to make sure it's working and creating and appending data to the file. Then after it's run for say 24 hours you can then post back that log file so we can check on the disk space and see if it really is changing much.

 

Don't forget the system also automatically makes System Restore Points which can take a lot of space as well.

How to schedule a Batch File to run automatically in Windows 7 | 8

 

 

I would also recommend installing and using this software to get a better handle on where your data is stored.

TreeSize Free, Hard Drive Storage Allocation Analyzer

Every hard disk is too small if you just wait long enough. TreeSize Free tells you where precious disk space has gone
TreeSize Free
 

[Weyoun]

Hi AS,

That's great! I saw your post in the other thread and I'll respond to both of your posts here, that way I don't bump up my thread in the Malware removal section. I uninstalled ComboFix using the command you posted and it worked. When I tried to make the .bat file though, it came up with a black command prompt for a second, then disappeared but never created the text document on the desktop. The hard drive seems to be hovering around 434/433 now, I haven't noticed any big drops, it just fluctuates now between those two sizes. I'll try again with the .bat file and see if it works so we can monitor that. *sigh of relief* great to know that I don't have any actual malware : )

Thanks for all your help and time!

 

Cheers and have a great day!

Weyoun

[AdvancedSetup]

Make sure you have your system set to show extensions.  Do you see the extensions of files like .exe, .doc, .pdf, .bat, .txt etc.... ?
 
Please review this again.  How to see hidden files in Windows
 
Then make sure to save the file as shown here
 

 

I've had a couple other users run it and they say it works for them.

[Weyoun]

Hi AS,

I know how to show the hidden files, I did that and saved the file exactly as you said, but it still doesn't make anything on my desktop, just a command prompt box for a second then nothing. Am I doing something wrong?

[David H. Lipman]

BAT file located in ZIP file. GetDiskSpace.zip

 

You can execute it from the ZIP file.

 

It does create "MyDiskSpace.txt" on my Windows desktop.

[Weyoun]

Hi Mr. David,

I downloaded, extracted and executed it, but still nothing on my desktop. Could it be Norton blocking it?

[David H. Lipman]

It's just Dave or David.

 

Maybe its Norton but I can't see why it would block execution and not provide a Pop-Up warning or something.  You can try disabling Norton.

[Weyoun]

Okay, I'll call you Dave then.

Completely disabled Norton, executed it again, but still nothing.

[David H. Lipman]

I just did it on my XP PC

 

"C:\Documents and Settings\Lipman\Desktop\MyDiskSpace.txt"
 

[Weyoun]

I'm running Win 7 x64. I checked C:\Users\Weyoun\Desktop and nothing there except the Internet Explorer icon.

[David H. Lipman]

XP/32

"C:\Documents and Settings\Lipman\Desktop\MyDiskSpace.txt"

 

Win7/64
C:\Users\dlipman\Desktop\MyDiskSpace.txt

Win8.1/32
C:\Users\admin\Desktop\MyDiskSpace.txt

Vista/32
C:\Users\Admin\Desktop\MyDiskSpace.txt

[AdvancedSetup]

Try opening an elevated command prompt by clicking START and then type in CMD.EXE and when it shows on the menu right click over it and choose "Run as administrator"

 

Then type the following.

 

cd %USERPROFILE%\Desktop

 

Then type the name of the batch file.  GetDiskSpace.bat and press the Enter key.

That should run it and possibly provide you with some error message.