Jump to content

Hard drive loosing space


Weyoun
 Share

Recommended Posts

Hello all,

 

Maybe I'm just being a bit paranoid here (I usually am), but I wanted to ask to see if this is something I should worry about. I noticed that my hard drive had 436 Gigs of free space, then a few minutes later, 435, then 434, now 433. Me being the paranoid that I am, put a clean image on the hard drive, and the hard drive again had 436 Gigs free after that. Then again, down to 433 within 2 minutes. I checked and System restore is not making any restore points, and I used CCleaner to clean out all temp and junk files, but I don't get the space back. I put the clean image back on a third time to see if it would happen again, and sure enough it did within 5 minutes again. I have not downloaded or installed anything, I checked and system restore is not making any restore points, and Windows update isn't doing it because it hasn't checked for updates in a while. Is this anything to worry about, or am I just being overly worried and this is just a normal thing for Windows? Running Windows 7 Ultimate x64. I'm extremely paranoid when it comes to security :P.

 

Thanks for the help!

Link to post
Share on other sites

  • Root Admin

It very well could just be normal Windows operations.  Please see if the following links help or not.
 
How to address disk space issues that are caused by a large Windows component store (WinSxS) directory

Engineering Windows 7 - Disk Space

Clean Up the WinSxS Folder

The Winsxs Folder Explained

 
 
You can also run the following scan and post the logs and we can review it and see if we can find anything out of the ordinary or not.
 
Please run the following scanner and send back the logs.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop
  • Please include the following logs in your next reply as an attachment: DDS.txt and Attach.txt
  • You can ignore the note about zipping the Attach.txt file and just post it or attach it.
Link to post
Share on other sites

Weyoun:
 
You can run the "Disk Cleanup" utility [ cleanmgr.exe ]
 
If will list various resources and the space they consume and give you the option to purge them if you desire as seen below.  This way you will have an idea what in the OS may have "cached" a large amount of data and thus consume more space.
 

post-14644-0-34171700-1380669102_thumb.j

Link to post
Share on other sites

Hi AS & Mr. David & daledoc1,

Thank you all for your assistance!

 

I read up those articles, I didn't really understand them very well though, lol. I ran the dds tool; here are the logs:

I ran cleanmgr.exe and it cleared 1.5 MB of space.

Daledoc1, NIS v 21.0.2.1 is my A-V and firewall.

 

Thanks all!

 

Weyoun

Link to post
Share on other sites

Daledoc1, NIS v 21.0.2.1 is my A-V and firewall.

 

 

Ah, OK.

My reason for asking is that folks running KIS/KAV sometimes inadvertently enable "traces" in the program, and that causes massive GB of hard drive space to be consumed by the accumulating files.

Since you run NIS, that's not the problem. :)

 

Well, with any luck the gurus will see something in yout DDS logs to help you out.

 

Cheers,

 

daledoc1

Link to post
Share on other sites

  • Root Admin

Well you need to disable your Norton antivirus to run the DDS scanner as it blocked many of the scans it was attempting to do.

When done then re-enable your antivirus.

 

I do see that you have Acronis TrueImage installed and that has a scheduler running so perhaps you have it scheduled to be doing data backups ?

Link to post
Share on other sites

Hi AS,

I thought I had disabled Norton, I apologize for that. I tried again:

Hope Norton didn't block it this time. Acronis is not running scheduled backups, because the version I use doesn't have that ability. I use the True Image free "WD Edition" that came with my WD external hard drive I bought 2 years ago. This version only does full backup images and only manually when I have the external hard drive plugged in, it doesn't even give me the option to do scheduled backups.

 

Mr. David, yes, that is 1.5 MB as in Megabytes.

 

Daledoc1, thanks for the reply, : )

 

Thanks again all!

Weyoun

Link to post
Share on other sites

  • Root Admin

Nope the log was still blocked.

 

I don't think you're necessarily infected but in order to run some other tools we'll need to move over into the malware removal forum.  Please follow the advice below.

 

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.


Thanks

Link to post
Share on other sites

  • Root Admin

The scans and logs do not appear to show any signs of real malware.
Now as to what or why you think drive space is disappearing out of the blue is another matter.

What you can try is starting NOTEPAD and then copy/paste the contents of the code box below into the new Notepad document.
Then do a File Save-As and save the file where you can easily find it and name it something like "GetDiskSpace.bat"
Make sure you enclose the name in quote marks as shown so that it will save it as .bat and not as .txt
 
 

pushd "%~dp0"cd /d "%~dp0"cls@echo off:checkspaceset Log="%USERPROFILE%\Desktop\MyDiskSpace.txt"echo/@echo off&SETLOCALFOR /f "tokens=1-4 delims=/-. " %%G IN ('date /t') DO (call :GetDate %%G %%H %%I %%J)goto SetDate:GetDateif "%1:~0,1%" GTR "9" shiftFOR /f "skip=1 tokens=2-4 delims=(-)" %%G IN ('echo.^|date') DO (    Set %%G=%1&set %%H=%2&Set %%I=%3)exit /b:SetDateEndlocal&(Echo.|date|find "JJ">nulIf errorlevel 1 (  SET yy=%yy%&SET mm=%mm%&SET dd=%dd%) Else (  SET yy=%JJ%&Set mm=%MM%&SET dd=%TT%))SET DV=%yy%-%mm%-%dd%For /f "tokens=1-3 delims=1234567890 " %%a in ("%time%") Do set "delims=%%a%%b%%c"For /f "tokens=1-4 delims=%delims%" %%G in ("%time%") Do (  Set _hh=%%G  Set _min=%%H  Set _ss=%%I  Set _ms=%%J)Set _hh=%_hh: =%if 1%_hh% LSS 20 Set _hh=0%_hh%ENDLOCAL&Set DT=%_hh%%_min%%_ss%%_ms%SET CDT=%DV%_%DT%echo/ >>%Log%echo Space Check Ran on: %CDT% >>%Log%echo/ >>%Log%dir c:\ >>%Log%goto eof)@echo on:EOFset Log=set OEMCP=set Folder=SET yy=SET DV=SET _hh=SET _min=SET _ss=SET _ms=SET DT=rem Code ideas from SS64

Then double-click on the new batch file it should create a new file on your desktop named: MyDiskSpace.txt
As long as it does create the file then you can now setup a scheduled task to run it every so often and see how much the disk space is changing.

Create a new scheduled task that runs with highest privileges as shown in the link below using your new batch file GetDiskSpace.bat

Set it to run say every 30 minutes and let it run for an hour to make sure it's working and creating and appending data to the file. Then after it's run for say 24 hours you can then post back that log file so we can check on the disk space and see if it really is changing much.

 

Don't forget the system also automatically makes System Restore Points which can take a lot of space as well.

How to schedule a Batch File to run automatically in Windows 7 | 8

 

 

I would also recommend installing and using this software to get a better handle on where your data is stored.

TreeSize Free, Hard Drive Storage Allocation Analyzer

Every hard disk is too small if you just wait long enough. TreeSize Free tells you where precious disk space has gone
TreeSize Free
 

Link to post
Share on other sites

Hi AS,

That's great! I saw your post in the other thread and I'll respond to both of your posts here, that way I don't bump up my thread in the Malware removal section. I uninstalled ComboFix using the command you posted and it worked. When I tried to make the .bat file though, it came up with a black command prompt for a second, then disappeared but never created the text document on the desktop. The hard drive seems to be hovering around 434/433 now, I haven't noticed any big drops, it just fluctuates now between those two sizes. I'll try again with the .bat file and see if it works so we can monitor that. *sigh of relief* great to know that I don't have any actual malware : )

Thanks for all your help and time!

 

Cheers and have a great day!

Weyoun

Link to post
Share on other sites

  • Root Admin

Make sure you have your system set to show extensions.  Do you see the extensions of files like .exe, .doc, .pdf, .bat, .txt etc.... ?
 
Please review this again.  How to see hidden files in Windows
 
Then make sure to save the file as shown here
 
GetDiskSpace.png
 

I've had a couple other users run it and they say it works for them.

Link to post
Share on other sites

Hi AS,

I know how to show the hidden files, I did that and saved the file exactly as you said, but it still doesn't make anything on my desktop, just a command prompt box for a second then nothing. Am I doing something wrong?

Link to post
Share on other sites

  • Root Admin

Try opening an elevated command prompt by clicking START and then type in CMD.EXE and when it shows on the menu right click over it and choose "Run as administrator"

 

Then type the following.

 

cd %USERPROFILE%\Desktop

 

Then type the name of the batch file.  GetDiskSpace.bat and press the Enter key.

That should run it and possibly provide you with some error message.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.