[raskapopolis]

Hi all,

I've recently been charged with solving hard drive space problems on the family PC. I've noticed that on our 55GB hard drive the Windows folder in inexplicably 36.7GB big (26,781 files, 1881 folders)! Opening the folder and checking the size of all the files present (hidden files shown) yields a size of 3.14GB (22,889 files, 1839 folders).

I've come across a few websites and followed some steps. Turned off system restore, reduced space % allocation on utilities such as the Recycle bin etc. I've run a full virus and spyware scan and the results are negative.

Can anyone advise me what is causing this and how I might solve it?

Thanks

Dave.

[flavallee]

Delete everything from inside these 2 TEMP folders:

C:\WINDOWS\TEMP

C:\DOCUMENTS AND SETTINGS\(USERNAME)\LOCAL SETTINGS\TEMP

If this hasn't been done in awhile or has never been done, expect to find hundreds or even thousands of them present.

--------------------------------------------------------------------------------------------------------

A free utility that will do an even better job of getting rid of all the junk is ToniArts EasyCleaner 2.0.6.380, which can be downloaded from:

http://personal.inet.fi/business/toniarts/ecleane.htm

After it's been installed, start it and click the "Unnecessary" button. Place a checkmark in "Normal types" and "Temp directories" and leave the other boxes blank. Click the "Find" button and allow it to scan. Once the scan is finished, click the "Select All - Delete All" buttons. If there is a massive number of files to delete, it'll take several seconds to complete the deletion process, so be patient. If it finds a few files that it can't delete, it'll tell you. Once it's done, click the "Close - Close" buttons, then restart your computer.
(Other than the instructions that I've given you, don't mess with any other buttons or functions)

--------------------------------------------------------------------------------------------------------

[ozrom1e]

Welcome to TSG....

Lets see what is running in the background and if there are any infections;

To download HJTsetup.exe from SpyKiller To Download HijackThis go to the following at the File Repository
Click on the link below to Download HijackThis Self Installer:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Save the file to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\HijackThis.
Continue to click Next in the setup dialog boxes until you get to the Select Additional Tasks dialog.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialog box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
At the top of the Notepad HJT log screen, hit Edit then Select All then click Edit and then click Copy doing that copies the text to the clipboard, you won't see it yet....
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
A security expert with a gold shield to the right of their name should take a look at your log - please be patient.

[raskapopolis]

flavallee,

thanks for your reply. i run CClearner regularily so i believe it keeps those folders to managable sizes.

ozrom1e,

thanks for the program, ive run it and i'll post the log file in below. any insight would be appreciated. cheers.

****

Logfile of HijackThis v1.99.1
Scan saved at 15:36:55, on 16/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Program Files\Starware337\bin\Starware337.dll
O3 - Toolbar: Starware Recipe Toolbar - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Program Files\Starware337\bin\Starware337.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{25290F11-D4FC-43AE-A308-1B1D4ADFC1FD}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B260D820-09AD-438F-8C76-326C8540EAED}: NameServer = 213.94.190.235 213.94.190.195
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Frank4d]

I'm confused. When you click properties one way it shows 36GB, and click properties another way it shows 3GB?

[raskapopolis]

Frank4d,

that's correct. when i right click on the "Windows" directory and bring up the properties tab it counts up 36GB. however when i go into the Windows folder and select all the files and folders in it (hidden files shown) and then call up the properties tab on that, its counts up only 3GB.

[The Hound]

I'm no expert, but that might be the leanest hijackthis log I've ever seen...that said, there appears to be at least a couple of items that an hjt expert might help you with.

As for the files--I see the ipod service running--where do you store your music files?

[Frank4d]

That is very strange. I tried the same thing and get the same result both ways. It appears you may have a file or subfolder that is "super-hidden". Here is one suggestion: http://www.pctipsbox.com/show-super-hidden-files

[raskapopolis]

The Hound,

As its the family PC and im not always around to fix problems i try to keep the setup as simple as possible. that said, it might be looking particularily lean as i emptied the c:\windows\prefetch folder of most of its files and modified its registry entry so as not add any new ones. didn't solve my massive Windows dir problem (but did improve boot time..). My music is in My Documents/My Music.

Frank4d,

Thanks for the tip. I followed the instructions but after checking the directory again there was no significant change in size, i.e. its still roughly 36GB vs 3GB

[redoak]

A "HJT" log should only be interpreted by a poster with a gold or blue "shield" following their name/moniker.

{redoak}

[JohnWill]

Try WinDirStat to see where the space actually is.

[redoak]

"it might be looking particularily lean as i emptied the c:\windows\prefetch folder of most of its files and modified its registry entry so as not add any new ones"

Folks in the know will tell you that this was not a wise move.

{redoak}

[JohnWill]

Originally Posted by redoak

"it might be looking particularily lean as i emptied the c:\windows\prefetch folder of most of its files and modified its registry entry so as not add any new ones"

Folks in the know will tell you that this was not a wise move.

{redoak}

I'll SAY! I didn't notice this, but it was a REALLY bad idea! My Prefetch folder has a massive 5.15mb of space used, and I've never done anything with it. Windows maintains it automatically, screwing around with this is NOT recommended.

[windowswoe]

well, I don't know where all the posts went but to answer Raskapopolis, no I don't use any Windows utilities like Ace Utilities that don't come from Microsoft.
I'm at the same point as you- format and reinstall... just no time to do so for another week or two.
Good luck with yours...

[raskapopolis]

redoak,

thanks for the advice, i don't know much about the inner workings of windows so i reckon i'll change the prefetch back to their originals.

to get back to my hard disk space problem with the massive windows directory, i'm glad to announce i've happened upon the cause of the problem.

in a nutshell, the folder "C:\WINDOWS\INSTALLER" is 34GB+ big. this isn't something i could tell you before because, even with hidden files and folders set to shown, this "INSTALLER" folder is still not visibile in my windows directory.

i came across it when i tried to defragment the C: drive (a massive 54% defragmentation) but at the end of the process i was informed some files could not be defragmented (still leaving fragmentation at about 50%) and all these files were in this hitherto unknown "installer" folder. typing the folder path directly into the address bar took me there and to the source of my space problem.

my final query is then what does this folder do and is it okay to delete the entire contents??

thanks to everyone for their suggestions in helping me track this one down.

windowswoe, i hope you get to read this before you end up formatting. good luck.