hard drive keeps filling up

[Morrison]

My hard drive keeps filling up even if I delete files (even lots of large ones).  I think I must be infected with malware.  I've seen a few strange things in the Windows event viewer that led me to another thread on this site and I'd like some help clearing my computer of whatever malware is keeping my hard drive at capacity.  I ran a free malwaybytes scan, but it didn't find anything.

[AdvancedSetup]

Hello @Morrison and

Very unlikely an infection, but we can scan and see what we can find. In many cases it's simply the Windows caching, updates, etc that fluctuate the disk space.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan Now.
• When finished, please click Clean & Repair.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[Morrison]

Here are the files you asked for.  It is very unlikely that this is normal Windows operation.  I've done a lot of troubleshooting and I have a lot of experience in the field.  I cleared out some of my caches, I cleanup the disk on a weekly basis including the system files, I've turned off indexing, I've checked my hard drive, I've defragged, I've deleted hundreds of gigabytes of data and the drive always fills right back up.  In a matter of days or weeks.  I had to delete nearly several hundred megabytes of data just to install what you wanted me to install because I was sitting a 0 bytes of free disk space again.  Anyway, thank you so much for your help.  By the way, after I selected clean and repair and then clean and reboot for AdwCleaner, it did not bring up the log file after the reboot.  But I found them and attached them, then ran Farbar like you asked.  Thanks again for the help, I'm getting really frustrated with this problem.

Addition.txt AdwCleaner[C00].txt AdwCleaner[S00].txt FRST.txt mwbThreadScanReport.txt

[AdvancedSetup]

For now please uninstall Java. You have an old compromised version on the computer. Then run the following @Morrison

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

[Morrison]

I followed your instructions.  FRST64 did end up telling me the machine needed to be rebooted.  It caused chkdsk to run upon reboot.  It also gave me back 183 GB of disk space.  I can't tell you how happy I am to see that.  Thank you so much for all of you help thus far.

Fixlog.txt

[AdvancedSetup]

Yes, I forced a disk check as many times the bitmap volume will be corrupted and can cause various issues like this. Hopefully, that's all it was.

Keep an eye on it and let me know. I'll go ahead and close the topic in a couple of days.

Cheers

Ron

 

[Morrison]

The problem is not solved.  I had a 183 Gigabytes free last night, but that quickly dropped to 182 Gigabytes and continued to drop.  I was doing nothing on the machine except watching it drop.  I then shutdown the machine.  Today, I turned it back on and after about an hour and a half, it is down to 175 Gigabytes free and I've done nothing on the machine.  Is there anything else you can do to help me get rid of whatever is chewing up my hard drive space?  If I were to leave it on for a few days, all of that free space would be gone again.  Do you have anything that can check for rootkits or polymorphic or armored viruses?

[AdvancedSetup]

Please download and run the following using Admin rights

TreeSize Free
https://www.jam-software.com/treesize_free/

Then run it about once an hour to see where space is getting consumed.

 

[Morrison]

Last time I sent you my reply, I shutdown my machine afterwards.  I was going to leave it running, but it wanted to do a Windows update.  When I booted it up today to run the TreeSize utility to wanted me to run, my free space was down to 130 something.  I think by the time I ran TreeSize, it had jumped up to 140 something.  It has actually been steady at 142 Gig since then.  Here are 4 TreeSize images.

[AdvancedSetup]

Just keep an eye on it. You can save/export them I believe. Then over time you should be able to see what is actually taking that space.

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks