Disappearing HD space

[Trakkan2]

One of our employees just encountered this problem that I can't seem to figure out. While working, she got an error message that she had too little space available on her HD. When she checked the C drive through Windows Explorer, it showed her as having under 100 MB free. I came over the next morning to check it out for myself (since I couldn't believe she had filled her entire drive based on what she was running), and it showed her as having about 22 GB free space remaining (the max capacity is around 40 GB for this drive).

Since then, I've had her watching it closely, and she sees the free space consistently drop throughout the day. She'll start each morning with about 20 GBs free, but be down to 6 GBs after 2-3 hours. It's bad enough that it doesn't seem like she can make it through the day any longer, since she won't have enough free space available to operate most programs.

We've searched for large files on the drive, but found nothing out of the ordinary. I've had her check the processes and memory usage, but neither of those raised any flags either. She also checked for file system errors on the drive, but found nothing wrong. A virus scan also produced no answers, and I am running out of ideas. About the only thing I can think of that we haven't tried is running anti spyware stuff, but I've never heard of anything that can drop 20GB of free space in a matter of hours.

A warm reboot will not recover the lost space. However, shutting down for 10-15 minutes seems to work so far (1 minute was not long enough to change anything). At least we know that she can get her computer working again by turning it off for a few minutes, but I really need to figure out a more permanent solution. In that regard, any help would really be appreciated. I could always put a new HD in there if this is a symptom of a failing hard drive, but I've just never known anyone who experienced this to know exactly what it is I'm dealing with here.

 

[ej4love]

disconnect here computer from the network, and see if she is still having the same problem. you did'nt specify if she was on a network with internet access. so please advise.

 

[Trakkan2]

She is on a network through a router with high-speed interent. I had her disconnect from the router the other day, but she was already very low on space at the time so all I could tell was that it did not go back up after being disconnected. I just had her disconnect again though (since she has about 16GB free now), so I'll have her monitor the levels to see how they change while she is off of the network / internet.

Also, she just told me that the HD went from 6GB free to 16GB while it wasn't being used since she was eating lunch. Considering that it dropped from 20GB to 6GB while she was pretty much just using Word and Excell, I think I'm even more confused than I was before...

 

[MadHacker]

check windows temp directory and also monitor her user space directory if someting is eating up space it will probably occur there
my 2¢

 

[Trakkan2]

Update- After about an hour disconnected from the network / internet, she dropped back down under 6 GB free space.

The Windows temp folder only has about 30 MB of files in it, and her My Documents has about 600 MB (which sounds right for what she has in it).

 

[KTev]

Watching the temp folders is a place.

Depending on the v-ram settings the pagefile size can increase to huge sizes and give similar problems.

What is she using the computer for?

Opening a simple 5 mega-pix photo in gimp or other photo editors can eat disk space. Many of these programs will create a swap file of their own.

There are hidden folders to look at too. My mother had 2GB worth of email in outlook. Finding the folder to off load the email to a new drive was a bitch and required a registry edit.

 

[Trakkan2]

Yeah, I had checked her pagefile settings while I was over there, and they had the max set around 1.5 GB. Temporary internet files were given about 1 GB max space as well (though we deleted those without seeing any difference in free space available).

The swap files were my first thought, but I can't seem to find where one could be that would account for this much variation. The only programs she has been using today are Word, Excell, Outlook, and Internet Explorer. She also converted one Word document to Adobe before emailing it, but it was a small document and did not seem to affect anything.

To continue the updates, in the last 15 minutes, she has jumped from 1 GB to 23 GB, without seeming to do anything different (same programs running - connected to the network throughout).

 

[13thmonkey]

Is the size of drive changing, or the size of the files on the drive, i.e. looking at the drives properties is it used space that is changing or the total size. Its along shot I know. Am thinking that the reported drive size might be changing.

 

[qwertycopter]

Since this is at work, this is probably a workstation that is under warranty. Call the manufacturer.

If you must troubleshoot it yourself, check the drive under Control Panel > Administrative Tools > Computer Management > Disk Management. See if it really only has 6 GB left or if this is a reporting error. Spyware scan would have been one of the first things I would have tried (I know how employees like to browse the web on their breaks and install screensavers, etc.... sigh).

 

[Trakkan2]

Well, it's a work computer, but I built it myself. I suppose I could call Seagate since they made the Hard Drive, but I'm not sure how much luck I would have there.

Under Disk Management, the drive reports the same free space as it does under any other method, and the total drive capacity does not change throughout any of this.

 

[BGP_Spook]

Go hunting.

See if you can track down a bloated folder.

Edit:
Another thought, how full is your "Recycle Bin."

Edit2:
Might be useful.
http://www.short-media.com/forum/archive/index.php/t-8854.html
Be sure Dr. Watson isn't running and if all else fails run hijackthis.

 

[qwertycopter]

Well, then I gotta say you've narrowed it down to a software issue. One might try an XP repair install (the fix-all.. ehe!). But, I would get on that spyware scan first. Ad-Aware, Spybot S&D, check your msconfig > startup for blank/weird/unknown startup items, also run HijackThis!. Also, it's a good idea to run scans from safe mode. Recheck your task manager for unknown processes, search them on google to see if they are associated with spyware. Run Crap Cleaner to clear out the junk (ie. temp folders where spyware often lurks). Check the Add/Remove console for obvious spyware (ie. "freewebclicks").

Also, if you're familiar with the registry, check out

Under both HKEY_Current_User and HKEY_Local_Machine go through:

Software\Microsoft\Windows\CurrentVersion\

Expand each folder preceeded by the word "Run" and check for unusual/suspicious processes. This includes "Run," "RunOnce," and "RunOnceEx." If you have any other folders that start with Run.. I would be suspicious of the entire folder...

 

[13thmonkey]

Well, it's a work computer, but I built it myself. I suppose I could call Seagate since they made the Hard Drive, but I'm not sure how much luck I would have there.

Under Disk Management, the drive reports the same free space as it does under any other method, and the total drive capacity does not change throughout any of this.

try using windirtree (or similar), it displays space usage by directory, including hidden dirs. I can't find it irght now, so no links. But it gives a big graphical representation of where all the space is being used, also included recycle bin etc.

It might help to pinpoint what is changing, if nothing is changing assume spyware or virus.

its on my other PC Pm me if you want me to email it to you.

aka windirstat

 

[ej4love]

it is a software issue, but which one, and why, try uninstalling and reinstalling word and excel, thats the easiest to try right now, uninstall all the programs you have on the machine one at a time at a time, to try and isolate which one you having issue with.

 

[SomeJoe7777]

I agree with 13thmonkey.

WinDirStat (Windows Directory Statistics) will track down the offending file/directory.

Run it first thing in the morning to get a baseline of the drive usage, then after the free space has gone down run it again. You should see the large file represented graphically in the colored window, or listed in the directory tree in the upper window.

Is this machine running any kind of background distributed computing client like World Community Grid, Seti @ Home, Folding @ Home, etc.? The temporary files they create and the calculations they store on a work unit can be massive.

 

[ej4love]

it is a software issue, but which one, and why, try uninstalling and reinstalling word and excel, thats the easiest to try right now, uninstall all the programs you have on the machine one at a time at a time, to try and isolate which one you having issue with.

 

[Trakkan2]

Thanks for all the responses so far guys. I have her running Ad-aware right now, and that Windows directory software seems like it might be just what I need to track down where all the disk space is going. Unfortunately, I'm totally swamped today, so I haven't really had any time to get at her computer myself yet (we work in different locations a few miles apart). Regardless, I appreciate the help, and I'll run get that WinDirStat downloaded so I can run it on Monday.

Keep any other ideas coming if you've got them, and I'll let you know what I find out on my end.

 

[KTev]

If you have a spare computer you should eliminate the user from the equation. See if you can replicate the problem on the old computer or if the user causes the same errors on the new computer.

Just for S&G see what the size of the C:\Documents and Settings folder is at the start of the day and again when there is a problem.

 

[Mr_Gasket]

i like the sub-a-computer theory.
but before i did that would run CCleaner excellent program. if you have a spare hard drive set it up a secondary see if it loses space too.
dont think i saw you say if there was a load change on the cpu when this is all happening. best of luck dude

 

[Trakkan2]

Ok, I think I've got this thing fixed finally. WinDirStat was fantastic. It found the offending file instantly (tmphp32.inf) which was hiding in the Windows\Inf directory - so it did not appear on a regular search of the hard drive.

With the file name, I was able to google it and see that it appears to be a new virus / malware that is not yet detected by the majority of software out there, including all of the anti-virus / spyware software we had tried. Of course, the good news is that it seems to be a relatively easy fix (go into safe mode and delete the offending file and the svchost.exe file triggering it), so I'm hopeful that it won't be coming back again. The bad news is that I still have no idea where it came from (she swears that she did not download or install anything other than what I had her download trying to solve this problem), and that annoys the heck out of me. Ah well, at least it appears to be gone now, but I would sure like to know where it came from.

Anyway, thanks a lot for the help guys.

 

[13thmonkey]

windirstat is good isn't it. Its a lovely interface for spotting whats using what. Even the tree data is good, never mind the image of disk usage.

 

[qwertycopter]

Clicking the wrong link on a website and you can get spyware. Probably how she got it.