occupied space problem

[begbodyguard]

As windows tells me , and some other programs i use +- 380 GB at my primary drive but the problem is I can't find most of it :s .

But if i run advanced system optimizer it says that i also use 380 Gb but the size of all my files is maybe 40 GB plz help me because my occupied space is raising evry day.

Picture :

[DarkSnakeKobra]

Hi begbodyguard,

What version of windows are you using? Also how often are you defragging?

[begbodyguard]

Windows 7 64 bits , I defrag +- 1 time a month with smart defrag from iobit.

[DarkSnakeKobra]

Try running disk cleanup and cleanup old restore points. When defragging windows repeatedly makes shadow copies(back ups) that take up large amounts of space.

[begbodyguard]

Try running disk cleanup and cleanup old restore points. When defragging windows repeatedly makes shadow copies(back ups) that take up large amounts of space.

lol so windows made +- 300 GB back ups

Euhm ty

[DarkSnakeKobra]

I'm assuming that worked for you.

[begbodyguard]

I'm assuming that worked for you.

Yes it did , I did know about the disk clean up but that didn't help but didn't knpw about shadow copies and old restore points si I googled it and found the way.

So ty for helping me :)

[DarkSnakeKobra]

No problem.

[AdvancedSetup]

Well I'm a little late to the party, but here you go anyways...

Here are some other resources and information to help you review.

I would recommend enabling the show hidden files option

How to show hidden files in Windows 7

Here is a brief article to dicuss the Shadow Copy feature as well

Explore the features: Shadow Copy

[begbodyguard]

Ty for the information about Shadow copy,I knew how to show hidden maps etc. but still most of the maps/files aren't visible in the explorer.

[AdvancedSetup]

Well you don't really want to unhide the folders and symbolic links as that can be potentially dangerous if you mess with it too much.

[begbodyguard]

Well you don't really want to unhide the folders and symbolic links as that can be potentially dangerous if you mess with it too much.

I know but still , I watched a moment while Malwarebytes was scanning and It scanned likke more then 200 000 objects In D:\$rReclyce.bin\ while it is empty . I know there are always some files inside but 200 000 or more oO .

And another question In the past it took for mbam +- 8 minutes for a full scan ( with me) and now it like take an hour or more. It's possible my pc is the problem? :

- Windows messenger doesn't work propper (almost evry click not responding)

- Sometimes problems for watching vids on youtube

-...

[AdvancedSetup]

Well I would agree that does not sound right. There should not be anything in the Trash if you've emptied it aside from a few hidden files that can be seen from a DOS console prompt.

It could be that you are infected with some worm or maybe you have something like Norton installed that also keeps a backup of the Recycle Bin?

[begbodyguard]

Well I would agree that does not sound right. There should not be anything in the Trash if you've emptied it aside from a few hidden files that can be seen from a DOS console prompt.

It could be that you are infected with some worm or maybe you have something like Norton installed that also keeps a backup of the Recycle Bin?

I have Bitdefender and MSE. I once installed Norton (trail) but didn't like it.

So does Bitdefender take back up from it ? And if not MBAM or MSE or bitdefender should be able to detect the worm.

[AdvancedSetup]

Yes in most cases it should be detected.

Do you know how to start a DOS prompt with Admin rights? If so then start one and do the following.

CD\

CD $RECYCLE.BIN

DIR /S /A

That should show you a listing of all files in that folder.

[begbodyguard]

That should show you a listing of all files in that folder.

I tried this but had forgotten the /s and /a with Dir that's why i din't work and Dos is going crazy man now i am at 0400000 and still counting ....

[begbodyguard]

euhm ... this isn't normal anymore , it's going crazy

[AdvancedSetup]

When replying please click on the ADDreply button, not on the REPLY button. There is no need to quote every post back, thanks.

[begbodyguard]

K sorry but is there a way to delete all these files ? Dos is showing this :

10/03/2010 15: 39 <dir> .

10/03/2010 15: 39 <dir> ..

0 Directorys 0 bytes

Map from d:\$Recycle.bin\S-1-5-21-1236073407-2097119279-2600756359-100\RGIC23M\000000

10/03/2010 15: 39 <dir> .

10/03/2010 15: 39 <dir> ..

0 Directorys 0 bytes

Map from d:\$Recycle.bin\S-1-5-21-1236073407-2097119279-2600756359-100\RGIC23M\000001

....

[AdvancedSetup]

That shows nothing. That looks more like you ran DIR /A without the /S switch.

0 Directorys 0 bytes

Why are you on the D: drive? Is that the drive that Windows was installed on?

Make sure it's Run as administrator the prompt should also have Administrator: in the title

DIR /S /A

[begbodyguard]

I did the title is : D:\Windows\system32\cmd.exe - dir /s /a

first is starts counting until 0999999 like on pic below

then it shows post above

[AdvancedSetup]

I don't see where it shows that you are IN the $RECYCLE.BIN folder. From that it looks like you're in the C:\WINDOWS\SYSTEM32 folder.

Please run the following from that prompt and post back the results.

SET

(then hit the enter key)

[begbodyguard]

this ??? ->

Microsoft Windows [versie 6.1.7600]

Copyright © 2009 Microsoft Corporation. Alle rechten voorbehouden.

D:\Users\Jelle>set

ALLUSERSPROFILE=D:\ProgramData

APPDATA=D:\Users\Jelle\AppData\Roaming

com.adobe.versioncue.client.applocale=nl_NL

com.adobe.versioncue.client.appname=AdobeDrive

com.adobe.versioncue.client.appversion=1.0.0

CommonProgramFiles=D:\Program Files\Common Files

CommonProgramFiles(x86)=D:\Program Files (x86)\Common Files

CommonProgramW6432=D:\Program Files\Common Files

COMPUTERNAME=JELLE-PC

ComSpec=D:\Windows\system32\cmd.exe

FP_NO_HOST_CHECK=NO

HOMEDRIVE=D:

HOMEPATH=\Users\Jelle

LOCALAPPDATA=D:\Users\Jelle\AppData\Local

LOGONSERVER=\\JELLE-PC

NUMBER_OF_PROCESSORS=4

OS=Windows_NT

Path=D:\Program Files (x86)\PC Connectivity Solution\;D:\Program Files (x86)\NVI

DIA Corporation\PhysX\Common;D:\Windows\system32;D:\Windows;D:\Windows\System32\

Wbem;D:\Windows\System32\WindowsPowerShell\v1.0\

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

PROCESSOR_ARCHITECTURE=AMD64

PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel

PROCESSOR_LEVEL=6

PROCESSOR_REVISION=1707

ProgramData=D:\ProgramData

ProgramFiles=D:\Program Files

ProgramFiles(x86)=D:\Program Files (x86)

ProgramW6432=D:\Program Files

PROMPT=$P$G

PSModulePath=D:\Windows\system32\WindowsPowerShell\v1.0\Modules\

PUBLIC=D:\Users\Public

SESSIONNAME=Console

SystemDrive=D:

SystemRoot=D:\Windows

TEMP=D:\Users\Jelle\AppData\Local\Temp

TMP=D:\Users\Jelle\AppData\Local\Temp

USERDOMAIN=Jelle-PC

USERNAME=Jelle

USERPROFILE=D:\Users\Jelle

VS90COMNTOOLS=d:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\Tools\

windir=D:\Windows

D:\Users\Jelle>

_____

And Yes i was running in $Recycle.bin need screens?

[DarkSnakeKobra]

I have Bitdefender and MSE. I once installed Norton (trail) but didn't like it.

So does Bitdefender take back up from it ? And if not MBAM or MSE or bitdefender should be able to detect the worm.

I hope you don't have both installed. If so I highly recommend you remove MSE and keep bitdefender. Having more then one can conflict.

[AdvancedSetup]

What concerns me is the entry that you have here:

Map from d:\$Recycle.bin I'm not sure what is causing that result on a command prompt.

I would suggest running this command. Press the ENTER key after each line.

D:

CD\

DIR /AL /S

That should list all Junction points and we can possibly better determine what's going on. It could also be that your Shadow Copies when removed only remove the files and are leaving the folders behind but that sure would be a lot of folders.

Then run the other command again, but this time please let me see a screen shot of the finished scan.

D:

CD\

CD $RECYCLE.BIN

DIR /S /A

So when the command is done it should be sitting at this type of echoed prompt

D:\$RECYCLE.BIN