Storage question…

[torankusu]

I’m running Vista. The other day, I was downloading a crapload of stuff and I looked at my c: and I was like, “*edited*, I only have 80mb left.” I was gonna burn my stuff to DVD/move it to my external HDD, but when I checked later on, it said I was up to 1gb. A little while later, I checked it again and it said I had 12gb.

 

I moved a lot of my stuff and backed it up on DVDs after that, but I’m downloading more stuff and I went down to 8gb about an hour or two ago. When I checked it just now, it says I have 13gb. Does anyone have any idea of why this could be happening? I was thinking maybe there’s some automated task or setting that’s set to delete files when I reach… I dunno, a limit or something. I asked Kuros and he said maybe it’s deleting temporary files, but I dunno if I’d really have gigs of temporary files sitting around… Anyone have any ideas? Having gigs of space just suddenly appear is kind of alarming.

 

Thanks.

[MasterP]

You have a virus.

 

Reinstall Vista using a Windows7 DVD.

[torankusu]

O NOES. @_@ How do I get ahold of one of those?

 

Also, can I just use the recovery cds or whatever? My laptop came with Vista, so I don’t have a cd to install it with, but I recall making the recovery cds (or dvds) earlier this year.

[Phonetically Phamous (dice]

MasterP said:

 

 

Reinstall Vista using a Windows7 DVD.

 

i LOL!’d

[torankusu]

My question is… I thought Windows7 doesn’t come out till next month. And I know I’m seeing threads where people already have it. So how do I get ahold of it?

 

Also, I ran a scan and it came up with nothing (using AVG).

[MasterP]

That’s because AVG is terrible.

 

Run a Spybot and Malwarebytes scan then run the Onecare Safety Scanner.

 

If those come up clean you can run an Avira scan just to be on the safe side but I imagine the other 3 will have caught anything.

 

For Windows7 you need MSDN/MSDNAA. I also take cash.

 

You may not have a virus but to jump around in HD space like that is definately not normal for windows. Some viruses will use your computer as a storage dump for warez. I imagine that’s more likely than temp files.

[torankusu]

It looks like I can download it free cuz my school is part of the MSDNAA or whatever, but I need a login ID and password.

[MasterP]

torankusu said:

It looks like I can download it free cuz my school is part of the MSDNAA or whatever, but I need a login ID and password.

User: Imanoob

Pass: Ineedtotalktomyschoolsadmin

[torankusu]

MasterP said:

torankusu said:

It looks like I can download it free cuz my school is part of the MSDNAA or whatever, but I need a login ID and password.

User: Imanoob

Pass: Ineedtotalktomyschoolsadmin

I know this. I also typed that response when I was still sleeping (well, super groggy); I didn’t think to add (nor did I really think that it needed to be explained) that it’s Sunday and there’s no one available to contact.

 

Also, I found this:

 

http://www.vistax64.com/vista-general/59369-hard-drive-free-space-keeps-changing.html

 

SS&D came up with nothing srs. I’ll do the other scans, too, just in case, but I think this might be worth looking into.

[Kuros]

MasterP said:

For Windows7 you need MSDN/MSDNAA. I also take cash.

 

Inb4 jail time.

[MasterP]

torankusu said:

MasterP said:

torankusu said:

It looks like I can download it free cuz my school is part of the MSDNAA or whatever, but I need a login ID and password.

User: Imanoob

Pass: Ineedtotalktomyschoolsadmin

I know this. I also typed that response when I was still sleeping (well, super groggy); I didn’t think to add (nor did I really think that it needed to be explained) that it’s Sunday and there’s no one available to contact.

 

Also, I found this:

 

http://www.vistax64.com/vista-general/59369-hard-drive-free-space-keeps-changing.html

 

SS&D came up with nothing srs. I’ll do the other scans, too, just in case, but I think this might be worth looking into.

System Restore doesn’t free up HD space unless you turn it off and delete the restore points. It wouldn’t free up the space on its own.

 

The pagefile uses a changing amount of HD space, true, but not more than a few GB.

[torankusu]

I lowered the amount of space for system restore and it freed up 35gb. @_@

 

I’m still looking into other stuff in case that’s not the issue.

[torankusu]

Hmm, a full system scan with Malwarebytes found nothing.

[Kuros]

Automatically jumping the virus bandwagon is pretty noobish imo. Honestly it’s probably a corrupted partition table or something along those lines. Windows is obviously confused. A backup and clean install is probably the best option and if that doesn’t work a new drive.

[MasterP]

Kuros said:

Automatically jumping the virus bandwagon is pretty noobish imo. Honestly it’s probably a corrupted partition table or something along those lines. Windows is obviously confused. A backup and clean install is probably the best option and if that doesn’t work a new drive.

So Windows randomly getting and losing HD space means the OS is corrupt or the hard drive is bad?

 

I think you’ve been working retail too long.

[Kuros]

MasterP said:

Kuros said:

Automatically jumping the virus bandwagon is pretty noobish imo. Honestly it’s probably a corrupted partition table or something along those lines. Windows is obviously confused. A backup and clean install is probably the best option and if that doesn’t work a new drive.

So Windows randomly getting and losing HD space means the OS is corrupt or the hard drive is bad?

 

I think you’ve been working retail too long.

 

I didn’t say that’s what it meant…I said that’s what it *could* mean. Only an idiot comes straight out with “You have a virus.” “You probably have a virus” would have been better phrasing…regardless, I’ve never seen a virus jump around hd space either without storing huge quantities of crap that’s generally easy to find. Afaik she hasn’t found anything like that. With a format it doesn’t matter either way because the virus is gone. If it still jumps around what is it then? She managed to get the virus onto her install media?

[MasterP]

Virus-based FTP.

 

We covered in your first Resnet training session.

 

Regardless, have you ever seen Windows do that all by itself?

 

Virus is much more likely than a corrupted partition table.

 

I try to avoid reformatting. I know you liked to but it’s a hassle for the user and you jumping straight to formatting is just as bad as me jumping to virus. Only if I’m right there’s alot less reinstalling required.

[Kuros]

MasterP said:

Virus-based FTP.

 

We covered in your first Resnet training session.

 

Regardless, have you ever seen Windows do that all by itself?

 

Virus is much more likely than a corrupted partition table.

 

Then where is the virus? Toran: run hijackthis and post the results to this thread.

[MasterP]

Kuros said:

Then where is the virus?

He has yet to actually run a virus scan.

 

AVG+Spybot+MBAM =/= good virus scanners

[torankusu]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:39:53 PM, on 9/28/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18294)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\System32\hkcmd.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\Users\torankusu\Desktop\foobar2000\foobar2000.exe

C:\Windows\system32\conime.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Users\torankusu\AppData\Roaming\Google\Google Talk\googletalk.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb

R0 – HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 – HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 – Hosts: ::1 localhost

O2 – BHO: AcroIEHelperStub – {18DF081C-E8AD-4283-A596-FA578C2EBDC3} – C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 – BHO: WormRadar.com IESiteBlocker.NavFilter – {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} – C:\Program Files\AVG\AVG8\avgssie.dll

O2 – BHO: Spybot-S&D IE Protection – {53707962-6F74-2D53-2644-206D7942484F} – C:\Program Files\Spybot – Search & Destroy\SDHelper.dll

O2 – BHO: (no name) – {5C255C8A-E604-49b4-9D64-90988571CECB} – (no file)

O2 – BHO: Symantec NCO BHO – {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} – C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O2 – BHO: Symantec Intrusion Prevention – {6D53EC84-6AAE-4787-AEEE-F4628F01010C} – C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL

O2 – BHO: Windows Live Sign-in Helper – {9030D464-4C02-4ABF-8ECC-5164760863C6} – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 – BHO: Java Plug-In 2 SSV Helper – {DBC80044-A445-435b-BC74-9C25C1C588A9} – C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 – BHO: Google Gears Helper – {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} – C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O2 – BHO: HP Smart BHO Class – {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} – C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 – Toolbar: Norton Toolbar – {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} – C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll

O4 – HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 – HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 – HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 – HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 – HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 – HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 – HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 – HKLM\..\Run: [WinampAgent] “C:\Program Files\Winamp\winampa.exe”

O4 – HKLM\..\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre6\bin\jusched.exe”

O4 – HKLM\..\RunOnce: [Malwarebytes’ Anti-Malware] C:\Program Files\Malwarebytes’ Anti-Malware\mbamgui.exe /install /silent

O4 – HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘LOCAL SERVICE’)

O4 – HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)

O4 – HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User ‘NETWORK SERVICE’)

O4 – Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 – Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 – Extra button: (no name) – {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} – C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O9 – Extra ‘Tools’ menuitem: &Gears Settings – {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} – C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll

O9 – Extra button: Send to OneNote – {2670000A-7350-4f3c-8081-5663EE0C6C49} – C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 – Extra ‘Tools’ menuitem: S&end to OneNote – {2670000A-7350-4f3c-8081-5663EE0C6C49} – C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 – Extra button: HP Smart Select – {DDE87865-83C5-48c4-8357-2F5B1AA84522} – C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 – Extra button: (no name) – {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} – C:\Program Files\Spybot – Search & Destroy\SDHelper.dll

O9 – Extra ‘Tools’ menuitem: Spybot – Search && Destroy Configuration – {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} – C:\Program Files\Spybot – Search & Destroy\SDHelper.dll

O13 – Gopher Prefix:

O18 – Protocol: linkscanner – {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} – C:\Program Files\AVG\AVG8\avgpp.dll

O20 – AppInit_DLLs: avgrsstx.dll

O23 – Service: Apple Mobile Device – Apple Inc. – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 – Service: AVG Free8 E-mail Scanner (avg8emc) – AVG Technologies CZ, s.r.o. – C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 – Service: AVG Free8 WatchDog (avg8wd) – AVG Technologies CZ, s.r.o. – C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 – Service: Bonjour Service – Apple Inc. – C:\Program Files\Bonjour\mDNSResponder.exe

O23 – Service: Com4QLBEx – Hewlett-Packard Development Company, L.P. – C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

O23 – Service: FLEXnet Licensing Service – Macrovision Europe Ltd. – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 – Service: GameConsoleService – WildTangent, Inc. – C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 – Service: Google Update Service (gupdate1c9bde3f0876de1) (gupdate1c9bde3f0876de1) – Google Inc. – C:\Program Files\Google\Update\GoogleUpdate.exe

O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 – Service: iPod Service – Apple Inc. – C:\Program Files\iPod\bin\iPodService.exe

O23 – Service: Recovery Service for Windows – Unknown owner – C:\Program Files\SMINST\BLService.exe

O23 – Service: Cyberlink RichVideo Service(CRVS) (RichVideo) – Unknown owner – C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 – Service: SBSD Security Center Service (SBSDWSCService) – Safer Networking Ltd. – C:\Program Files\Spybot – Search & Destroy\SDWinSec.exe

O23 – Service: Steam Client Service – Valve Corporation – C:\Program Files\Common Files\Steam\SteamService.exe

O23 – Service: Viewpoint Manager Service – Viewpoint Corporation – C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 – Service: VNC Server Version 4 (WinVNC4) – RealVNC Ltd. – C:\Program Files\RealVNC\VNC4\WinVNC4.exe

O23 – Service: XAudioService – Conexant Systems, Inc. – C:\Windows\system32\DRIVERS\xaudio.exe

 

—

End of file – 8989 bytes

[MasterP]

torankusu said:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:39:53 PM, on 9/28/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18294)

Boot mode: Normal

Windows updates. Like now. All of them.

 

 

torankusu said:

Running processes:

C:\Windows\system32\conime.exe

Find this program, right click, properties, detail. Post back who it’s made by.

[torankusu]

Updating.

 

My computer restarts itself periodically for the Windows Updates; the last time it was updated was 09/24/09. It’s set to install new updates every day at 3am. Your reaction is kinda unsettling. @_@

[MasterP]

torankusu said:

Updating.

 

My computer restarts itself periodically for the Windows Updates; the last time it was updated was 09/24/09. It’s set to install new updates every day at 3am. Your reaction is kinda unsettling. @_@

That’s because you’re running Vista SP1 with IE7. You haven’t run WU in about 6 months.

[torankusu]

MasterP said:

torankusu said:

Updating.

 

My computer restarts itself periodically for the Windows Updates; the last time it was updated was 09/24/09. It’s set to install new updates every day at 3am. Your reaction is kinda unsettling. @_@

That’s because you’re running Vista SP1 with IE7. You haven’t run WU in about 6 months.

Meh, so why did it say that when I checked Windows Update? >_< Not doubting you, but I’m wondering what the heck my laptop’s been doing.

[MasterP]

torankusu said:

Meh, so why did it say that when I checked Windows Update? >_

Just go install all the updates.

 

Idk what your computer is doing but if you still have Vista SP1 and IE7 you aren’t up-to-date.

[torankusu]

Updated. SP2 and IE8.

[Author]

Posts