Sign in with
Sign up | Sign in
Your question
Closed

Disappearing Hard Drive Space

Last response: in Windows XP
Share
April 18, 2010 5:09:32 PM

Hi, when I turn on or restart my computer, the partitioned part of my hard disk has free space. However, within an hour or two, even if I download nothing, the remaining free space dwindles rapidly until it hits 0 MB. I've looked at the processes running under Task Manager, and none of them seems to be a back door. And I've also run antispyware and antivirus programs, none of which turn up any problem. This "disappearing hard disk space" trouble has only been happening for the past few days or so. Does anyone know what the cause and/or solution might be? Thanks very much!
April 18, 2010 5:53:04 PM

autograf said:
Hi, when I turn on or restart my computer, the partitioned part of my hard disk has free space. However, within an hour or two, even if I download nothing, the remaining free space dwindles rapidly until it hits 0 MB. I've looked at the processes running under Task Manager, and none of them seems to be a back door. And I've also run antispyware and antivirus programs, none of which turn up any problem. This "disappearing hard disk space" trouble has only been happening for the past few days or so. Does anyone know what the cause and/or solution might be? Thanks very much!




It starts off normal and decreases - that points to the file in the root of C:\ called pagefile.sys. Keep an eye on that as it grows and if that is the problem, you need more physical memory - RAM. Pagefile.,sys is the swap file which uses hard disk space to emulate memory - what the system refers to as Virtual memory. Any messages lately including that phrase? How big is that Partition and how much free space has it when you fire up the system?

Score
0
April 18, 2010 7:39:17 PM

Also try Disk Detective, which tells you how your files are distributed, using a pie chart.
Score
0
Related resources
April 18, 2010 7:46:26 PM

I suspect you've hit the nail on the head Saga Lout.

Windows XP these days needs a bare minimum of 1GB of free space, and likely more. If you have less or just over 1GB of free space then this is liekly the problem.

Check Control Panel->System-Advanced Tab->Performance Settings Button->Advanced Tab->Virtual Memory Change button and set a custom size range with the maximum size less than the total free drive space. This will keep the pagefile from outgrowing your available space, but might result in out of memory errors when running your programs. Good test though. Then you have to determine if you need a larger drive or can remove unnecessary programs and data.

Cheers!
Score
0
April 19, 2010 2:58:12 AM

Saga Lout said:

It starts off normal and decreases - that points to the file in the root of C:\ called pagefile.sys. Keep an eye on that as it grows and if that is the problem, you need more physical memory - RAM. Pagefile.,sys is the swap file which uses hard disk space to emulate memory - what the system refers to as Virtual memory. Any messages lately including that phrase? How big is that Partition and how much free space has it when you fire up the system?


It is a 54G partition on a 110 disc. The C: holds its own with aobut 8 G left, but there should be about 10 on the D: drive and it goes down to 0, yes zero & as soon as I free up more space it drains down to 0 again.

It actually only shows 1 G on startup, but there was more last week. I know the drives are too full, and it is time to do some serious housecleaning. In fact, this problem has had me at it! The page file is about 2.1 G.

I am wondering about the indexing service from windows search? I seem to remember seeing something about indexing somewhere.
Score
0
April 19, 2010 3:01:02 AM

Hi autograf,

Following along on Saga Lout's path, have you checked to see which drive the pagefile (Swap File) is hosted on. It doesn't have to be the C: drive. It can be set to any drive or partition in your system.

Check out that path I mentioned earlier just be be able to eliminate the swap file altogether: Check Control Panel->System-Advanced Tab->Performance Settings Button->Advanced Tab->Virtual Memory Change button
Score
0
April 19, 2010 3:22:33 AM

Indexing service should be OFF!
Score
0

Best solution

April 19, 2010 6:25:21 AM

autograf said:
It is a 54G partition on a 110 disc. The C: holds its own with aobut 8 G left, but there should be about 10 on the D: drive and it goes down to 0, yes zero & as soon as I free up more space it drains down to 0 again.

It actually only shows 1 G on startup, but there was more last week. I know the drives are too full, and it is time to do some serious housecleaning. In fact, this problem has had me at it! The page file is about 2.1 G.

I am wondering about the indexing service from windows search? I seem to remember seeing something about indexing somewhere.



Looking at your figures it would seem that the swap file has enough room to grow. The last time I saw behaviour this bad was due to a keylogger so you might like to let us all have a look at a HijackThis log. Go to http://www.trendmicro.com and download HijackThis, then install it and click on Scan and Save a Log. Don't fix anything until advised to do so but simply copy and paste that Notepad log back here.

You also need to declutter before scannign for malware. Get the ATF Cleaner form http://www.atribune.org and click on Select All and Delete. Download CCleaner from http://www.piriform.com, install it and run the cleaner, allowing it to delete everything it think unnecessary.

You'll also save some time if you go to http://www.malwarebytes.org to download MalwareBytes. Install it, let it update and restart itself then run the Quick Scan. Let it fix everything it finds and restart the system and run the Full Scan and repeat the process. After that restart, go back into MBAM and click on the Logs tab and copy and paste both back here along with a fresh log of a HJT scan. This way, we can see what you had and what you got rid of.

Temporarily suspend collecting any more temporary internet files by ticking to delete on exit in Internet Explorer's Tools menu, General tab.

Share
April 19, 2010 6:31:34 AM

I agree with Saga Lout ^^^^^^^^^^^^^^ All great suggestions.

Saga Lout, are you still up working on that payroll system for tomorrow!
Score
0
April 19, 2010 6:47:28 AM

We 3 are a team!! Glad you came with me, SL!!

It's already tomorrow in England.

Your cats are wrong, Digit.

^..^ ^..^ ^..^ ^..^ ^..^ ^..^ ^..^ ^..^ ^..^
Score
0
April 19, 2010 6:56:33 AM

<grin> Why being a wolf i thought it best not to present a proper cat in your presence... being that you would chase it and all!
Score
0
April 19, 2010 7:08:48 AM

I'm a friendly wolf. And your smileys or whatever you're using don't work. The BBCode here is not standard, or it's not BBCode. They look like this: <grin>
Score
0
April 19, 2010 7:11:16 AM

graywolf said:
I'm a friendly wolf.


Night all! :hello: 
Score
0
April 19, 2010 7:15:50 AM

It's morning here, 3:16 AM, but have no work till 6 PM tomorrow. [:digitalprospecter:3] :hello: 
Score
0
April 19, 2010 5:28:30 PM

WOW You are terrific!

I have discovered that somehow I ended up with copies of every file in My Documents! They are all labeled with the exact name and appended with (Empress v1).xxx and are the exact size of the other files which have turned blue in their lists. A friend told me that meant that they were compressed.

What the heck did I do? I now have 38,575 copies of files... no wonder my drive is full. Shall I simply discard the copies?

I will follow the advise you just sent me, too.






Saga Lout said:

Looking at your figures it would seem that the swap file has enough room to grow. The last time I saw behaviour this bad was due to a keylogger so you might like to let us all have a look at a HijackThis log. Go to http://www.trendmicro.com and download HijackThis, then install it and click on Scan and Save a Log. Don't fix anything until advised to do so but simply copy and paste that Notepad log back here.

You also need to declutter before scannign for malware. Get the ATF Cleaner form http://www.atribune.org and click on Select All and Delete. Download CCleaner from http://www.piriform.com, install it and run the cleaner, allowing it to delete everything it think unnecessary.

You'll also save some time if you go to http://www.malwarebytes.org to download MalwareBytes. Install it, let it update and restart itself then run the Quick Scan. Let it fix everything it finds and restart the system and run the Full Scan and repeat the process. After that restart, go back into MBAM and click on the Logs tab and copy and paste both back here along with a fresh log of a HJT scan. This way, we can see what you had and what you got rid of.

Temporarily suspend collecting any more temporary internet files by ticking to delete on exit in Internet Explorer's Tools menu, General tab.


Score
0
April 19, 2010 5:44:53 PM

Does the name Empress mean anything to you? A game or program you might have? Is xxx the actual file extension? [:graywolf:1]


Have you already checked for malware as Saga Lout laid out? This could be causing the duplicates.

And I have to ask --do you go to porn sites? Asking because of that file name, so don't take it personally.
Score
0
April 19, 2010 6:29:30 PM

Your computer isn't on a network is it, with offline files enabled by any chance?
Score
0
April 21, 2010 3:53:05 AM

Yes, Empress is one of my nicknames and ID's... xxx meant whatever the previous extension was.

No Porno ... just finished the HIjack scan and had a computer guy evaluate and research to find no problems although we did remove some stuff because of it!

It looks like I inadvertently decompressed the harddrive and it crashed during the process. There were about 39,000 files recreated, but on serious checking the files pair up perfectly... "HE" said he thinks that in the copying process it makes copies in the process tehn gets rid of them, but in the crash it didn't complete the process. Just an educated guess, though on his part.

We have just started eliminated all of the duplicates ... and I will be running check disk.

Not to say we are done with the whole process ... something about NTFS disk's possibly having errors when there are too many small files?



graywolf said:
Does the name Empress mean anything to you? A game or program you might have? Is xxx the actual file extension? [:graywolf:1]


Have you already checked for malware as Saga Lout laid out? This could be causing the duplicates.

And I have to ask --do you go to porn sites? Asking because of that file name, so don't take it personally.

Score
0
April 21, 2010 3:55:00 AM

It is on a network of two now, It could be on offline files from when there was another computer in the network ... I found a shortcut to offline files when I did a search.




digitalprospecter said:
Your computer isn't on a network is it, with offline files enabled by any chance?

Score
0
April 21, 2010 4:13:43 AM

A complex mystery, but the jigsaw puzzle is starting to assemble.

BTW--Learned this at my computer club last week-- you can submit HJT logs here:

www.hijackthis.de Try it and be surprised!

Score
0
April 21, 2010 7:08:57 AM

graywolf said:
A complex mystery, but the jigsaw puzzle is starting to assemble.

BTW--Learned this at my computer club last week-- you can submit HJT logs here:

www.hijackthis.de Try it and be surprised!




[#0005ff]Aaaaaarrrrgggghhhhhh!!!! Not the dreadred Matthias' site again? I wish had a pound - or even just a dollar :D  for every time I had to reconstitute systems after people took notice of that site. In the old days of USB Broadband MODEMS, just about every AOL member in Britain who ever ran HJT was disconnnected because that site told people to bin the main software for the MODEM.

There is no substitute for analysing logs by the experienced eye - whether those eyes got their experience in the real world or just because they got a certificate saying they know it all. :D  There's an AnalyseThis button on the HJT's own mainpage if people really want to see what's what but it's still adviseable to post to a responsible Forum (just like this one) and wait for advice. Then, don't hesitate to ask the responder for some proof that they know what they're talking about.

Also, never forget that sometimes, the best programmes and utilities for dealing with malware is free and that's because it also has a paid for version which helps to fund it or because the developers welcome - and need - donations.
[/#000ff]
Score
0
April 21, 2010 7:51:09 AM

Not dumping on real live help, but we don't have USB Broadband modems, and AOL is a disease anyway. Have you seen this site goofing up recently? I submitted a few logs for fun after scanning them myself, and there were no errors in malware, although the 04's aren't reduced.
Score
0
April 21, 2010 10:59:59 AM

graywolf said:
Not dumping on real live help, but we don't have USB Broadband modems, and AOL is a disease anyway. Have you seen this site goofing up recently? I submitted a few logs for fun after scanning them myself, and there were no errors in malware, although the 04's aren't reduced.



That was one of many examples. If I remember the rumours correctly, Matthias had set the site up after a falling-out with Merijn Belekom- the genius who originally developed HJT. In my 'umble opinion, there are some things which cannot be left to an automated system based on statistics and opinions and analysis of HJT logs is one of those things. It's entirely up to the individual of course but I only present my view as part of a balanced debate. Please don't feed me to the wolves! :D 


Score
0
April 21, 2010 5:38:41 PM

OK. :kaola: 
Score
0
April 29, 2010 3:59:13 AM

Best answer selected by autograf.
Score
0
April 29, 2010 4:25:42 AM

Hi There! I am doing OK here... I got rid of the duplicates and freed up about 20 gigs. My friend said there are a couple of ways I could have gotten them, but we haven't gotten together again yet and talked about it. It is stable though so I am blundering forward.

Hijack this was clean.



Saga Lout said:

Looking at your figures it would seem that the swap file has enough room to grow. The last time I saw behaviour this bad was due to a keylogger so you might like to let us all have a look at a HijackThis log. Go to http://www.trendmicro.com and download HijackThis, then install it and click on Scan and Save a Log. Don't fix anything until advised to do so but simply copy and paste that Notepad log back here.

You also need to declutter before scannign for malware. Get the ATF Cleaner form http://www.atribune.org and click on Select All and Delete. Download CCleaner from http://www.piriform.com, install it and run the cleaner, allowing it to delete everything it think unnecessary.

You'll also save some time if you go to http://www.malwarebytes.org to download MalwareBytes. Install it, let it update and restart itself then run the Quick Scan. Let it fix everything it finds and restart the system and run the Full Scan and repeat the process. After that restart, go back into MBAM and click on the Logs tab and copy and paste both back here along with a fresh log of a HJT scan. This way, we can see what you had and what you got rid of.

Temporarily suspend collecting any more temporary internet files by ticking to delete on exit in Internet Explorer's Tools menu, General tab.


Score
0
April 29, 2010 11:51:38 AM

Hi autograf,

Glad to hear it worked out. If you ever determine exactly why those duplicates happened, post the answer back here to help enhance the thread for someone else with the same issue. I still suspect offline files though.

Cheers!
Score
0
April 29, 2010 1:33:11 PM

digitalprospecter said:
Hi autograf,

Glad to hear it worked out. If you ever determine exactly why those duplicates happened, post the answer back here to help enhance the thread for someone else with the same issue. I still suspect offline files though.

Cheers!


I have a half-baked theory, DP which you may care to consider and expand. If System Restore was busily saving files and the system was shut down unexpectedly, it might dump them in the nearest place available.

Score
0
April 29, 2010 3:36:45 PM

Your theory sounds close to what my guy said ... we are still checking, but I did have a major crash on all of my system one day about the right time ... I will post when we track it down!

With Eyes to the Future... Dawn
Score
0
April 30, 2010 2:00:58 AM

I found this interesting article that talks about offline file synchronization and problems with Dell computers and a program that they use called "empress".
http://forums.techarena.in/windows-server-help/942215.h...

What you are suggesting is interesting as well SL, but it is the Empress part of the filename that is really making me wonder. Autograf, am I understanding right that each duplicate filename included the word 'empress'. When you say that Empress is one of your IDs, do you mean user profile names?

Cheers!
Score
0
April 30, 2010 4:11:51 AM

I did have a computer linked with offline files, that computer is gone (it was stolen when it was in for repair) and I can't find the offline files to get rid of the message that comes up, either .. It tells me that I can keep working offline or something like that.

Yes, Empress is one of my computer user profile names ... people used to call me that! So in the titles, it was referring to that. ... Dawn


digitalprospecter said:
Your computer isn't on a network is it, with offline files enabled by any chance?

Score
0
May 1, 2010 3:25:03 PM

Starting to make more sense now. If you double-click on your My Computer icon->Tools->Folder Options->Offline Files tab, you might find that your computer is still set to use offline files.
Score
0
January 14, 2012 1:34:21 PM

I know this is an old thread, but I was hoping I might get a little help.... My system is crashing all the time, and I have disk space constantly disappearing. I have two partitions, each 80GB, and it is only the C: drive that loses space (10GB last night). If my system is dumping files when it crashes, how do I find these files?
Score
0
January 14, 2012 5:54:55 PM

Start a new thread to receive help.
Score
0
!