low disk space

Have a win xp pro machine that says low disk space.  Ran tree size and it shows that there is plenty of space.  Is this a virus?  This happened on Friday on one of my machines.  Now the same thing just happened on another one.  Low disk space.  This is also win xp pro.  Seems like a malware or virus.  Any ideas on what to do?  The first pc I was able to copy everything off and when I had to reboot it would just cycle throught rebooting and now the pc is useless unless I reinstall OS.
mkramer777Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Ken ButtersCommented:
Do you use windows indexing/seaching?   If you are, try disabling it and see if that helps.
0
aadihCommented:
Try:

(1) Scanning with Malwarebytes antimalware (free).

(2) Please also read the information at the following Microsoft page:

http://support.microsoft.com/kb/285107 >
0
mkramer777Author Commented:
how do you disable indexing/searching
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Dirk MareSystems Engineer (Acting IT Manager)Commented:
You can disable the index service from..
Start... Run... Services.msc

Look for the service and stop and disable it..
0
aadihCommented:
Right click on C: (drive) and select properties, and uncheck (check) indexing option.
0
Ken ButtersCommented:
to turn off indexing / searching ...

right click on your C-Drive (or any drive that is being indexed),
and uncheck the box that says "Allow indexing service to..."

To disable it, you will need to go into services and stop the service and set start-up type to disabled.

1. Start / Rum
2. type services.msc
3. Look for indexing Services
4. If it is running select "Stop"
5. Under start up type select - "Disabled"
0
mkramer777Author Commented:
Turned off indexing.  Not sure if that did anything.  I can literally see the space on the c drive counting down to 0.  I removed about 200MB and it is slowly going down to 0.  SOmething is eating up the space quickly.
0
Ken ButtersCommented:
Here is a free tool to help you figure out what is using your space on your hard drive:

http://www.pcworld.com/article/2018972/find-out-whats-using-all-the-space-on-your-hard-drive.html
0
mkramer777Author Commented:
This won't even run.  Locks up.  Malware bytes found nothing.   I used treesize and will not complete.  Not sure what to do next.
0
aadihCommented:
You could try a repair install.
0
Thomas Zucker-ScharffSolution GuideCommented:
The best tool I have ever used for determining what is using space on a drive is WinDirStat it is free and I use it often.

Once you start using it you won't want to use anything else.

On the off chance you don't happen to be using a Symantec product do you?
0
aadihCommented:
Before you do a repair install, please run "chkdsk /f" on your C: drive.
0
Dirk MareSystems Engineer (Acting IT Manager)Commented:
Are you using Trend micro?
0
mkramer777Author Commented:
no
0
Thomas Zucker-ScharffSolution GuideCommented:
What about Symantec?  What AV/AM solution are you using?  Is this a home installation?  You might want to try using Comodo http://www.comodo.com/business-enterprise/cesm3/index_v2.php or MBAM free (I like the pro version better).

Have you tried WinDirStat?  You can run it from a stick.
0
mkramer777Author Commented:
any other free programs to check malware?  I'm getting nervous if I have to reboot because the other computer that this happened to did not boot up after I rebooted.
0
mkramer777Author Commented:
not sure why windirstat will not get past 30%  It's locked up again.  Does it need disk space to run?
0
Thomas Zucker-ScharffSolution GuideCommented:
Like I said you can install it on a stick and run from there - no disk space needed.  Try this link for the portable version

http://portableapps.com/apps/utilities/windirstat_portable

If you believe your computer is infected you need to use a stick/thumbdrive that has nothing else on it (just a precaution).  I think you can install this to a cd and run from there as well (don't have first hand experience doing it this way.

It will definitely run from a bootable ISO like UBCD4Win (just include it when you create the disk), unfortunately you don't feel comfortable rebooting right now, so try the portable app.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mkramer777Author Commented:
OK.  So there is a difference running it from the c drive.  I have enough space to run it on the c drive which I am doing right now and it locks up.  Are you saying run it from the usb drive and it will finish?
0
Thomas Zucker-ScharffSolution GuideCommented:
I have never had a problem doing either, but yes run it from a thumb drive to eliminate that possibility.  I used to have a server with a similar problem, it ended up being the Symantec logs that were filling the space (that's why I asked) I changed my AV solution to solve the problem.
0
nobusCommented:
i suggest to scan from a bootable cd
here a couple :
http://majorgeeks.com/Kaspersky_Rescue_Disk_d6501.html            KASPERSKY   CD      
http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline     OFFLINE DEFENDER

then scan with mbam, and roguekiller : http://majorgeeks.com/RogueKiller_d6983.html      

if the problem still exists  - run a chkdsk

***it is wise to have a backup BEFORE starting all this !!!
0
Thomas Zucker-ScharffSolution GuideCommented:
0
mkramer777Author Commented:
Here is where windirstat is showing all of the space being taken up (screenshot)  Also, I cannot see this path anywhere unless I open it within windirstat.  Do you know where the network service folder is.  I have hidden files to be seen.
Screen-shot-2013-10-15-at-8.02.5.png
0
Dirk MareSystems Engineer (Acting IT Manager)Commented:
Have you tried resetting Internet Explorer Setting?
What happens when you run Disk Clean up?
0
mkramer777Author Commented:
Disk cleanup has never been able to complete.  I waited 20 hours and it still did not get done to the point where I could uncheck what I don't want.  I will try resetting ie.  WHere is this network service folder that windirstat is showing.  Windirstat sees it why can't I?
0
Ken ButtersCommented:
those are temporary folders for Internet Explorer.  It is where Internet Explorer stores/caches all files as you browse the internet. --- They are special system folders, and are purposely hidden by Microsoft.

It sounds like you still have a virus.

you can try this:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

This is called autoruns,  it will show every application that starts up when you start your computer.  You need to be careful with it, because you could easily remove something that is critical to the functioning of your computer.

Since this seems to be an issue with internet explorer, I would download it to a flashdrive and run it from there.

Then when you look at the results page, pay special attention to "BHO" or browser helper objects.   These are add-ons to your browser.   They will automatically run whenever you start your browser.   I cannot think of any BHO that is critical to the functioning of your system. -- but it is a common avenue for malware to attack your system.

It will highlight rows where you have startup entries that may be missing, this is stuff that is set to start when you start your computer, but the file that is to be started is no longer present.  I usually remove these from within AutoRuns as well.

Before removing anything else, I would carefully research and google it to determine if it is a necessary component for you system.

You may very well find other malware listed here, so it can at least help you pinpoint possible problems.
0
nobusCommented:
did you try scanning from cd - as i suggested?
0
Thomas Zucker-ScharffSolution GuideCommented:
The above suggestions are great, I would also suggest using Chameleon from MBAM.  This will run a rogue process killer then attempt to update MBAM and run a scan.  Use the links below.

https://forums.malwarebytes.org/index.php?showtopic=125373
http://www.malwarebytes.org/products/chameleon/
0
mkramer777Author Commented:
I can run all virus and malware programs.  Malware bytes showed me nothing.  Do you have another suggenstion of a malware program I can run?  Also, if windirstat can see the ie files that need to be deleted how can I delete them?
0
Thomas Zucker-ScharffSolution GuideCommented:
in windirstat simply click on the graphic of the file or the file name and press delete.  

Did you run a rogue process killer before running mbam (without a reboot in between)?
0
Ken ButtersCommented:
Until you can stop the temp files from being added... it's not going to do you any good to try to delete them.

(Let's plug the hole in the boat before worrying about bailing out the water)

did you try the "Autoruns" program above?
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

After you have identified and corrected the issue with writing temp files there are a couple of ways that you may be able to delete them.

1)  Within IE itself.   This may vary slightly depending upon what version of IE you have, but go to Internet Options, then on the general tab, click on the delete... button.   make sure "Temporary Internet Files" is selected, and then click on delete button.

2) A free utility to free up temporary files, and other garbage files on your Hard drive is
http://www.piriform.com/ccleaner
0
Thomas Zucker-ScharffSolution GuideCommented:
ccleaner is an excellent utility, but until the virus is cleaned up and you can reboot the machine without any problems DO NOT clean out the temp directory.  Many virii will move necessary windows files to the temp directory.
0
nobusCommented:
i understand your frustation "I can run all virus and malware programs.  Malware bytes showed me nothing.  "  but you need to run roguekiller too - it eliminates other types

the boot cd 's are to be sused if you can't start up the system
0
aadihCommented:
Repeat: Time for a repair install.  :-(
0
mkramer777Author Commented:
Are you talking repair install as in reinstalling the OS?  :-)
0
nobusCommented:
you can run sfc also :  http://www.updatexp.com/scannow-sfc.html                        SFC use in XP

this is how to do a repair  install :    http://www.michaelstevenstech.com/XPrepairinstall.htm            Repair install  XP
0
aadihCommented:
A repair install.

Reference: nobus's second link.
0
Dirk MareSystems Engineer (Acting IT Manager)Commented:
Your XP machines has been nonoperational for the past 4 days, its time you cut your loses no point fearing to switch off or reboot (too run all the scans that everyone has recommended above) the machine just because the other one didn't boot again

Download the following Kaspersky tool
http://support.kaspersky.com/8092

Scan your machine for viruses, Trojans and other nasty's go to the location where all your disk space is being used (IE temp files) and delete them. Should be able to browse to that location with kaspersky tool

sooner or later you will just have to bite the bullet and start over. No point in delaying the inevitable.

Sorry for being so straight forward..
0
mkramer777Author Commented:
It's easy to say bite the bullet when you don't know who's computer this is and what needs to be done by this user at the office.  The reason I am trying to fix and not reboot is because they are in the middle of an HR problem and can't afford to do anything to the machine until Friday afternoon.  That is why I am trying all ways to fix before I reboot.  Still don't understand why there isn't a way to delete the \networkservice\content.ie5\etc... folders so I can gain back disk space.  Also, this computer has been completely operational during this entire dialogue.
0
Thomas Zucker-ScharffSolution GuideCommented:
Have you made a backup of this computer yet (sorry I forget)?  If not, or even if you have, you might consider using the portable version of DriveImageXML from debugmode.  Download this and install onto a USB drive (so you have space for the backup) then plug into computer and run it.  It does a sector by sector backup of the drive.  Note that while the backup is being done the computer can be used for other purposes although it will slow down.

On another machine install a new copy of windows and then restore everything but the windows directory. to the new machine from the USB drive.  Note that the programs will have to be reinstalled and any preferences are likely to be lost (unless you clone the disk using something like Ghost and put the clone onto an identical machine).  The downside of cloning is capturing the problems as well as the settings.

Paragon has software (paragon hard disk manager) that does a much better job, but does cost you money.
0
Dirk MareSystems Engineer (Acting IT Manager)Commented:
Apologies wasn't aware your machine is operational. I just mentioned it because you can have windows XP loaded in about 4hr (plus the +/-1000 updates it has)

What kind of HR problems, is it related to software that's running on this machine that's causing problems.

On the other machine that's no longer booting have you tried running windows repair yet? Maybe take this time you have to play around on the other machine that's not booting to see if can get it working. If both machines are showing the same symptoms and they are running the same software and it started the same time i'll start looking at similarities between the two
0
mkramer777Author Commented:
Thanks for the suggestions.  I guess I'm kind of a little obsessed with going the way of repair and reinstall unless I absolutely have to.  I usually can get these things fixed by running several malware programs.   I'll probalby have to do it with a boot disk repair/malware remover.
0
nobusCommented:
you can boot from a live linux cd and delete what you want :
ftp://mirrors.kernel.org/knoppix-dvd/KNOPPIX_V7.0.5DVD-2012-12-21-EN.iso
0
Thomas Zucker-ScharffSolution GuideCommented:
As I suggested in this comment, creating a boot device using SARDU gives you all the options above and more.
0
Ken ButtersCommented:
Have you tried all suggestions above?  some?  which ones?
0
nobusCommented:
>>   I guess I'm kind of a little obsessed with going the way of repair   << understandable; but after a couple of repairs, the wisest thing is a fresh install - or factory reset
that is my experience
0
mkramer777Author Commented:
I'm gonna get a new pc for this user this weekend
0
Thomas Zucker-ScharffSolution GuideCommented:
good luck.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.