Thread: Low Disc Space?

Can anyone suggest anything?

On my home PC the disc drive is 40GB, only used 10-12GB about week ago, now it keeps saying low disc space.

When I click properties of C drive it shows 39.9GB used, & only 100MB free. However when I select all folders on the C drive in windows explorer (Inc hidden + system) the total number of files etc only comes to ~ 11GB. So there is a discrepancy between the 2 numbers.

I have run a virus scan, my files are all up to date, all OK, done a defrag etc.

The defrag was very slow compared to normal as though there is actually 40GB of data there, but I have no way created an extra 30GB of data myself in a week. Also there's no sign of what these files are in windows explorer

Has anyone any clue as to what might have happened or how to correct it?

Your assistance would be appreciated

Hi,

I see you did a virus scan, what about a malware scan because it does sound like something a virus/malware would do, and have I heard of this happening before

Follow these steps
(hopfully you have the disk space for this) download ewido http://www.ewido.net/en/ it comes with a free version, install it ,run it and select update do update the software.

Now turn of your system restore
start>settings>control panel>system>system restore - turn off system restore (please note this will lose all your restore points, but will stop any trojans or viruses returning)

Next reboot your pc into safe mode
1. Shut down Windows, and then turn off the power, then back on again
2. Start tapping the F8 key.
3. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message.
To resolve this, restart the computer and try again.
4.Ensure that the Safe mode option is selected.
5.Press Enter. The computer then begins to start in Safe mode.

run ewido and do a full system scan, this may take a while, remove everything it finds, you should also get the option to save a report, if you can cut and paste the report when you reply to this message

Let me know if anything is picked up.. if its clean we can try then next step

thanks

Thanks

I will try tonight and let you know

Hello Zorro

I downloaded the AV antispyware on your link, however it won't install as I am running windows Me and it says it needs 2000 or XP.

I do have the following spyware on my machine and so ran them
- Ad-aware
- Spybot SD
- Spyware blaster

Some things noticed is that the spyware blaster appeared to have been disabled, I re-enabled it. Spybot & ad-aware both found some errors and cleaned them (mostly tracking cookies). On reboot and rescan no more errors where found but the disc is still showing as full (almost 40GB), even though only 11GB is allocated to my files & folders on the C drive.

I also downloaded stopzilla which found the following other threat the programs above never mentioned :

Stopzilla

clickspring.purityscan (2 threats)
- C:\program files\common files\is3\anti-spyware\?
- hkus\.default\software\microsoft\internet explorer\searchurl\?

However it would not let me delete these without registering and paying and the first line appears to be from the program itself???? This folder contains the stopzilla files

Finally I also downloaded hijackthis and the log is below. Don't know if this is of any help

Thanks in advance

hijackthislog

Logfile of HijackThis v1.99.1
Scan saved at 18:03:25, on 19/10/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCSHLD9X.EXE
C:\PROGRAM FILES\COMMON FILES\IS3\ANTI-SPYWARE\SZSERVER.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\OASCLNT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\GSICON.EXE
C:\WINDOWS\SYSTEM\DSLAGENT.EXE
C:\PROGRAM FILES\VOYAGERTEST\FTS.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCTSKSHD.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFTRAY.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\MSOFFICE.EXE
C:\LOTUS\REGISTER\REMIND32.EXE
C:\WINDOWS\RSRCMTR.EXE
C:\PROGRAM FILES\MCAFEE.COM\PERSONAL FIREWALL\MPFAGENT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\STOPZILLA!\STOPZILLA.EXE
C:\PROGRAM FILES\STOPZILLA!\SZQUARANTINE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.aol.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: ZILLAbar BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\ZB2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: STOPzilla securitybar - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\ZB2.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MCTskShd] C:\PROGRA~1\MCAFEE.COM\AGENT\mctskshd.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MpfTray.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [McShld9x] C:\Program Files\McAfee.com\VSO\mcshld9x.exe
O4 - HKLM\..\RunServices: [szserver] "C:\PROGRAM FILES\COMMON FILES\IS3\ANTI-SPYWARE\SZSERVER.EXE" szserver
O4 - Startup: Microsoft Office Shortcut Bar.Lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Startup: Lotus SmartSuite 97 Registration.lnk = C:\lotus\register\remind32.exe
O4 - Startup: Resource Meter.lnk = C:\WINDOWS\RSRCMTR.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.co.uk
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/comput...up/qdiagcc.cab
O16 - DPF: {E04EAE82-14AD-41CB-BF5A-45556ABB8347} (WebCoachDownload Class) - http://esupport.aolsvc.aol.co.uk/uk/...inst_uk_uk.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://webmailgb.enersysinc.com/iNotes6.cab
O16 - DPF: {2A493D5F-8914-4D3E-8BF3-767F281862F4} (TraderMediaImgX Control) - http://sell.autotrader.co.uk/uk-ola/...aderMediaX.cab

Zorro I have resolved it

I noticed on virus scan it taking a very long time on files of the type

C:_RESTORE\TEMP\A000xxxxx.CPY

However I could not find these .cpy files or the _restore folder in windows explorer.

I have managed to locate using DOS and there where 33MB of .cpy files which I have now deleted.

Space now back up to 35MB and system working fine

Thanks for your initial response and time

Hi,

Glad you manange to find the problem, i didnt realise you were on ME , otherwise i wouldnt of suggested that link..

by the way the _restore folder is the where ME keeps all the restore point for the system restore feature, perhaps the job of the virus was filling up the folder!..

To clear that in future you can do this
1.Click Start>Settings>Control Panel and click the System icon to open the system properties dialog box.
2. Go to Performance>File System>Trouble Shooting
3. Mark the disable system restore checkbox (to enable simply use the same steps but uncheck this box) then click Apply.
4. You must restart your computer for the setting to take effect.

this will clear your restore point, just re-enable to turn the feature back on..