Link to home
Start Free TrialLog in
Avatar of mkramer777
mkramer777Flag for United States of America

asked on

low disk space

Have a win xp pro machine that says low disk space.  Ran tree size and it shows that there is plenty of space.  Is this a virus?  This happened on Friday on one of my machines.  Now the same thing just happened on another one.  Low disk space.  This is also win xp pro.  Seems like a malware or virus.  Any ideas on what to do?  The first pc I was able to copy everything off and when I had to reboot it would just cycle throught rebooting and now the pc is useless unless I reinstall OS.
Avatar of Ken Butters
Ken Butters
Flag of United States of America image

Do you use windows indexing/seaching?   If you are, try disabling it and see if that helps.
Try:

(1) Scanning with Malwarebytes antimalware (free).

(2) Please also read the information at the following Microsoft page:

http://support.microsoft.com/kb/285107 >
Avatar of mkramer777

ASKER

how do you disable indexing/searching
You can disable the index service from..
Start... Run... Services.msc

Look for the service and stop and disable it..
Right click on C: (drive) and select properties, and uncheck (check) indexing option.
to turn off indexing / searching ...

right click on your C-Drive (or any drive that is being indexed),
and uncheck the box that says "Allow indexing service to..."

To disable it, you will need to go into services and stop the service and set start-up type to disabled.

1. Start / Rum
2. type services.msc
3. Look for indexing Services
4. If it is running select "Stop"
5. Under start up type select - "Disabled"
Turned off indexing.  Not sure if that did anything.  I can literally see the space on the c drive counting down to 0.  I removed about 200MB and it is slowly going down to 0.  SOmething is eating up the space quickly.
Here is a free tool to help you figure out what is using your space on your hard drive:

http://www.pcworld.com/article/2018972/find-out-whats-using-all-the-space-on-your-hard-drive.html
This won't even run.  Locks up.  Malware bytes found nothing.   I used treesize and will not complete.  Not sure what to do next.
You could try a repair install.
The best tool I have ever used for determining what is using space on a drive is WinDirStat it is free and I use it often.

Once you start using it you won't want to use anything else.

On the off chance you don't happen to be using a Symantec product do you?
Before you do a repair install, please run "chkdsk /f" on your C: drive.
Are you using Trend micro?
no
What about Symantec?  What AV/AM solution are you using?  Is this a home installation?  You might want to try using Comodo http://www.comodo.com/business-enterprise/cesm3/index_v2.php or MBAM free (I like the pro version better).

Have you tried WinDirStat?  You can run it from a stick.
any other free programs to check malware?  I'm getting nervous if I have to reboot because the other computer that this happened to did not boot up after I rebooted.
not sure why windirstat will not get past 30%  It's locked up again.  Does it need disk space to run?
ASKER CERTIFIED SOLUTION
Avatar of Thomas Zucker-Scharff
Thomas Zucker-Scharff
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
OK.  So there is a difference running it from the c drive.  I have enough space to run it on the c drive which I am doing right now and it locks up.  Are you saying run it from the usb drive and it will finish?
I have never had a problem doing either, but yes run it from a thumb drive to eliminate that possibility.  I used to have a server with a similar problem, it ended up being the Symantec logs that were filling the space (that's why I asked) I changed my AV solution to solve the problem.
i suggest to scan from a bootable cd
here a couple :
http://majorgeeks.com/Kaspersky_Rescue_Disk_d6501.html            KASPERSKY   CD      
http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline     OFFLINE DEFENDER

then scan with mbam, and roguekiller : http://majorgeeks.com/RogueKiller_d6983.html      

if the problem still exists  - run a chkdsk

***it is wise to have a backup BEFORE starting all this !!!
Here is where windirstat is showing all of the space being taken up (screenshot)  Also, I cannot see this path anywhere unless I open it within windirstat.  Do you know where the network service folder is.  I have hidden files to be seen.
Screen-shot-2013-10-15-at-8.02.5.png
Have you tried resetting Internet Explorer Setting?
What happens when you run Disk Clean up?
Disk cleanup has never been able to complete.  I waited 20 hours and it still did not get done to the point where I could uncheck what I don't want.  I will try resetting ie.  WHere is this network service folder that windirstat is showing.  Windirstat sees it why can't I?
those are temporary folders for Internet Explorer.  It is where Internet Explorer stores/caches all files as you browse the internet. --- They are special system folders, and are purposely hidden by Microsoft.

It sounds like you still have a virus.

you can try this:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

This is called autoruns,  it will show every application that starts up when you start your computer.  You need to be careful with it, because you could easily remove something that is critical to the functioning of your computer.

Since this seems to be an issue with internet explorer, I would download it to a flashdrive and run it from there.

Then when you look at the results page, pay special attention to "BHO" or browser helper objects.   These are add-ons to your browser.   They will automatically run whenever you start your browser.   I cannot think of any BHO that is critical to the functioning of your system. -- but it is a common avenue for malware to attack your system.

It will highlight rows where you have startup entries that may be missing, this is stuff that is set to start when you start your computer, but the file that is to be started is no longer present.  I usually remove these from within AutoRuns as well.

Before removing anything else, I would carefully research and google it to determine if it is a necessary component for you system.

You may very well find other malware listed here, so it can at least help you pinpoint possible problems.
did you try scanning from cd - as i suggested?
The above suggestions are great, I would also suggest using Chameleon from MBAM.  This will run a rogue process killer then attempt to update MBAM and run a scan.  Use the links below.

https://forums.malwarebytes.org/index.php?showtopic=125373
http://www.malwarebytes.org/products/chameleon/
I can run all virus and malware programs.  Malware bytes showed me nothing.  Do you have another suggenstion of a malware program I can run?  Also, if windirstat can see the ie files that need to be deleted how can I delete them?
in windirstat simply click on the graphic of the file or the file name and press delete.  

Did you run a rogue process killer before running mbam (without a reboot in between)?
Until you can stop the temp files from being added... it's not going to do you any good to try to delete them.

(Let's plug the hole in the boat before worrying about bailing out the water)

did you try the "Autoruns" program above?
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

After you have identified and corrected the issue with writing temp files there are a couple of ways that you may be able to delete them.

1)  Within IE itself.   This may vary slightly depending upon what version of IE you have, but go to Internet Options, then on the general tab, click on the delete... button.   make sure "Temporary Internet Files" is selected, and then click on delete button.

2) A free utility to free up temporary files, and other garbage files on your Hard drive is
http://www.piriform.com/ccleaner
ccleaner is an excellent utility, but until the virus is cleaned up and you can reboot the machine without any problems DO NOT clean out the temp directory.  Many virii will move necessary windows files to the temp directory.
i understand your frustation "I can run all virus and malware programs.  Malware bytes showed me nothing.  "  but you need to run roguekiller too - it eliminates other types

the boot cd 's are to be sused if you can't start up the system
Repeat: Time for a repair install.  :-(
Are you talking repair install as in reinstalling the OS?  :-)
you can run sfc also :  http://www.updatexp.com/scannow-sfc.html                        SFC use in XP

this is how to do a repair  install :    http://www.michaelstevenstech.com/XPrepairinstall.htm            Repair install  XP
A repair install.

Reference: nobus's second link.
Your XP machines has been nonoperational for the past 4 days, its time you cut your loses no point fearing to switch off or reboot (too run all the scans that everyone has recommended above) the machine just because the other one didn't boot again

Download the following Kaspersky tool
http://support.kaspersky.com/8092

Scan your machine for viruses, Trojans and other nasty's go to the location where all your disk space is being used (IE temp files) and delete them. Should be able to browse to that location with kaspersky tool

sooner or later you will just have to bite the bullet and start over. No point in delaying the inevitable.

Sorry for being so straight forward..
It's easy to say bite the bullet when you don't know who's computer this is and what needs to be done by this user at the office.  The reason I am trying to fix and not reboot is because they are in the middle of an HR problem and can't afford to do anything to the machine until Friday afternoon.  That is why I am trying all ways to fix before I reboot.  Still don't understand why there isn't a way to delete the \networkservice\content.ie5\etc... folders so I can gain back disk space.  Also, this computer has been completely operational during this entire dialogue.
Have you made a backup of this computer yet (sorry I forget)?  If not, or even if you have, you might consider using the portable version of DriveImageXML from debugmode.  Download this and install onto a USB drive (so you have space for the backup) then plug into computer and run it.  It does a sector by sector backup of the drive.  Note that while the backup is being done the computer can be used for other purposes although it will slow down.

On another machine install a new copy of windows and then restore everything but the windows directory. to the new machine from the USB drive.  Note that the programs will have to be reinstalled and any preferences are likely to be lost (unless you clone the disk using something like Ghost and put the clone onto an identical machine).  The downside of cloning is capturing the problems as well as the settings.

Paragon has software (paragon hard disk manager) that does a much better job, but does cost you money.
Apologies wasn't aware your machine is operational. I just mentioned it because you can have windows XP loaded in about 4hr (plus the +/-1000 updates it has)

What kind of HR problems, is it related to software that's running on this machine that's causing problems.

On the other machine that's no longer booting have you tried running windows repair yet? Maybe take this time you have to play around on the other machine that's not booting to see if can get it working. If both machines are showing the same symptoms and they are running the same software and it started the same time i'll start looking at similarities between the two
Thanks for the suggestions.  I guess I'm kind of a little obsessed with going the way of repair and reinstall unless I absolutely have to.  I usually can get these things fixed by running several malware programs.   I'll probalby have to do it with a boot disk repair/malware remover.
you can boot from a live linux cd and delete what you want :
ftp://mirrors.kernel.org/knoppix-dvd/KNOPPIX_V7.0.5DVD-2012-12-21-EN.iso
As I suggested in this comment, creating a boot device using SARDU gives you all the options above and more.
Have you tried all suggestions above?  some?  which ones?
>>   I guess I'm kind of a little obsessed with going the way of repair   << understandable; but after a couple of repairs, the wisest thing is a fresh install - or factory reset
that is my experience
I'm gonna get a new pc for this user this weekend