Hardrive Suddenly Full

[Larry R]

I have a possible malware problem on my WinXP PC (I’m emailing from my Win 7 PC). It has completely filled my C drive (145GB) to the point that the PC no longer can function or process unless I remove files, programs, and folders to which will allow the virus to fill up the vacated space again. The hard drive is partitioned into 3 separate drives (C, D, and spare that’s unnamed ). All of my data files are on D, thereby leaving C drive for programs only. Last week I had at least 75 GB free on C but by Wednesday I noticed that the PC was running slow and by Thursday was getting “low disk space errors”. (I had not added or deleted any programs or files within the last 7 days).
Malwarebytes only showed two minor threats so I’ve been searching the INET for solutions and ran Spyhunter 4 (similar to Sypbot but touted to be better than Spybot according to latest reviews). It found 26 threats, two of which will severely impact the PC and or shut it down so that it won’t function at all. Only thing about Spyhunter free version is that in order to delete the malware, you have to pay for it $40 and it's a recurring charge every 6 mo's. Spybot use to do it free but now there's no more space left to download a fix.
Also, there’s a free software download for a product called TREESIZE that will show you what folder or file has more files in it than normal which may indicate a virus in it if I can find a way to run it. I can't use System Restore because it requires space. Now MS Outlook has stopped working. I could sure use some advice on what to do next.

[Alan Brookes]

Hit <CTRL><ALT><DEL>, which brings up the Windows Task Manager. Click on the "Applications" tab and see if there are any programs running that you didn't open. If there are, right click on the program and close it. Then go to the "Performance" tab and see how much memory is being used. If I'm right, the Page File Usage History should show an enormous amount of RAM used. Then go to the "Processes" tab, click on "Mem Usage" and put them in order of usage, to see which program is using most memory. Then click on "CPU" and see which programs are running in the background. Look in "Image Name" to see if there are any suspicious programs that you haven't seen before. If there are, click on the "Start" button and run the "Search" utility, looking for files with a similar name to the one you're suspicious of.

You may not have discovered what the problem is, but you will have a good idea of how your computer is running. I had the same problem and I downloaded SparkTrust PC Cleaner Plus, which cleaned out a lot of spyware and malware and the problem stopped. I had to subscribe to it, by the way, which cost about $30.

[Larry R]

Thanks Alan, I'll give it a try. At this point the cost is little compared to the time I've spent in research.

[Cal Sharp]

If you don't have D backed up you might ought to do that on an external hard drive. But then you've got the possibility of backing up the virus with it, but that's better than no backup.

[Dave Potter]

The hard drive is partitioned into 3 separate drives (C, D, and spare that’s unnamed ).... Last week I had at least 75 GB free on C but by Wednesday I noticed that the PC was running slow and by Thursday was getting “low disk space errors”. (I had not added or deleted any programs or files within the last 7 days)... I could sure use some advice on what to do next.

When is the last time you used the Win7 built-in tools? Wouldn't cost anything to run error-checking and defrag on all 3 drives just to give the OS a chance to do its thing. Free space being misreported due to disk errors is not an uncommon problem.

[Larry R]

Cal - I backed up D drive 3 weeks ago with few changes since then. I agree, backing up now could cause disaster if the virus spreads to D drive.

Dave, it's the WinXp machine that has the virus. The Win 7 machine is ok so far. I can't defrag because that requires free space which I don't have. I can't do a system restore either for the same reason.

[Richard Sinkler]

I actually wonder if these "free" downloads really find a virus or lie to you so you will buy their paid version. I have had free ones find things that Trend or Malwarebytes won't find. How are we to know they are legitimate? I won't use them any more.

Have you taken the advice about defragmenting your drives?

By the way, I used to partition me drives like you did. Every time I have had a hard drive die, it was the C drive where the operating system is. I no longer do that as hard drives are cheap now, and I feel more secure with my data on a physically different hard drive. I have had C drives die and could not get any of my stuff out of the other partitions. Luckily, the hard drive that died on me earlier this year, I was able to use it as a second drive and get what important stuff there was on the drive, Then I took it out and put my second drive back in the system.

[Alan Brookes]

Richard is absolutely right. I won't trust my data on the same drive as the operating system. I back up all my photographs, music and artwork onto external hard disks, and then make copies of the copies. To avoid picking up viruses I have a completely separate computer with no internet connexion on which I do all my audio/video work.
In fact I never reuse memory cards. I keep the originals in case I lose the copies, and I record session work on Data Minidisks, which allow you to record eight channels individually. Eight channels is usually enough for me. I have a 24-channel hard disk recorder but I rarely use it.

[Larry R]

Richard, defragging was one of the first things I tried but it wouldn't let me do that because the system needs available storage space to move the files.

[Dave Potter]

Dave, it's the WinXp machine that has the virus. The Win 7 machine is ok so far. I can't defrag because that requires free space which I don't have. I can't do a system restore either for the same reason.

OK, sorry, I missed that.

For this issue, defrag wouldn't be as important as running chkdsk. Defrag just consolidates files, chkdsk fixes disk errors. Suggest you open a DOS box and run chkdsk /f.

http://www.microsoft.com/resources/docu ... x?mfr=true

[Dave Potter]

I actually wonder if these "free" downloads really find a virus or lie to you so you will buy their paid version. I have had free ones find things that Trend or Malwarebytes won't find. How are we to know they are legitimate? I won't use them any more.

I'm with you on that, and, cynical as I am wont to be, I'd take it a step further, and posit that some of them might even stoop low enough to PUT a virus on your disk so you'll take the bait and buy their software to get rid of that "nasty bug" it found.

I never use any of those "free" come-ons. It's a given that programmers aren't any more likely to work for free than anyone else. But it's those tactics I find offensive, and there are plenty of other, mostly better alternatives, from quality sources.

[Alan Brookes]

...there are plenty of other, mostly better alternatives, from quality sources.

The problem is knowing which is which.

[Richard Sinkler]

I actually wonder if these "free" downloads really find a virus or lie to you so you will buy their paid version. I have had free ones find things that Trend or Malwarebytes won't find. How are we to know they are legitimate? I won't use them any more.

I'm with you on that, and, cynical as I am wont to be, I'd take it a step further, and posit that some of them might even stoop low enough to PUT a virus on your disk so you'll take the bait and buy their software to get rid of that "nasty bug" it found.

I never use any of those "free" come-ons. It's a given that programmers aren't any more likely to work for free than anyone else. But it's those tactics I find offensive, and there are plenty of other, mostly better alternatives, from quality sources.

I completely agree. There is some good free stuff out there, but these virus and malware programs almost always lure you in to a pay situation. I do think that Malwarebytes is worth paying for.

When I was going to programming school, one of my instructors used to work for McAfee (but worked for IBM at the time), and told us that some McAfee employes created some of the viruses back in the day (1990). We really didn't know if we should believe him or not.

[Dave Potter]

...there are plenty of other, mostly better alternatives, from quality sources.

The problem is knowing which is which.

My experience with software in general, not limited to anti-malware, etc, has been that it's usually a function of getting what I paid for, meaning, the more it costs, the more it will do. I did say "usually". A notable exception is Microsoft Security Essentials. It's absolutely free, and it's right up there with the best of them, IMO.

On rare occasions, I have found a few applications that actually were "free" that I found useful, but more often, and especially with anti-malware, "free" is the hook used to get into your wallet.

[Wiz Feinberg]

When I was going to programming school, one of my instructors used to work for McAfee (but worked for IBM at the time), and told us that some McAfee employes created some of the viruses back in the day (1990). We really didn't know if we should believe him or not.

You may be thinking about the famous Eicar test virus that used to ship with McAfee and Thunderbyte anti-virus programs.

[Jim Priebe]

There is a Golden Rule you all need to remember about being on the net.
YOU are actually the commodity that is sought after, traded, sold, monitored and many other things once you connect to the WWW and if you go for freebies you just invited them all in.

Re your problem, you actually need to:

Disconnect however you connect to the net
Boot with a partitioning CD/Disk
Move your partitions so that there IS some room on the C:
Do a defrag preferably from a utility boot disk (don't run your operating system)
Run a chkdsk on the C: once again from a boot disk utility
Scan with whatever you use to try to find the culprit once again preferably from a boot utility
Once you can identify the problem culprit search (on your other machine) for a solution on the net
You can rest assured it has already been encountered and someone has worked out a fix

I just can't get more specific without more knowledge of your system and also your IT capability.
All the best of luck.