[Carmine RJNL]

I own a Sony Vaio laptop, and I have had to reboot (reinstall windows) it several times, at least 5 due to many reasons. Well, everytime I installed windows I clicked a New Install, thinking it would delete everything on the selected partition that windows was being installed on.

Well, here is the problem. I just rebooted, again.. Here are my current stats for the C:/ drive.

File System: NTFS
Free Space: 1.68GB
Total Size: 13.9GB

Well, when I go into the C:/ drive and select all the files including system hidden ones, right click > properties, the entire drive contents only comes up to 3.08GB, so i'm thinking that everytime I rebooted windows, it is not deleteing the old Windows Installation but hiding. It just doesn't seem right that I have 10GBs of space that I don't even know what happened to.

Does anyone have any idea what this might be, other than a worm because I have tried everything in terms of searching for one, or any suggestions on how I could possibly fix it? If not, does anyone know of a worm-scanner that I may not have tried but may help find something.

Thank you in advanced to anyone who can help.
Best Regards, Carmine RJNL

[Advertisements]

Windows may be misreporting

start > run
cmd
enter

type chkdsk /r at the prompt, say yes when it asks to do repair at next reboot and reboot

take a walk, it will take a while

Does the problem still exist?

[gerryf]

Windows may be misreporting

start > run
cmd
enter

type chkdsk /r at the prompt, say yes when it asks to do repair at next reboot and reboot

take a walk, it will take a while

Does the problem still exist?

[Carmine RJNL]

The DiskCheck is running now. I will let you know what happens. Thanks!

[Carmine RJNL]

The problem still exists, the volume was fine. Any other ideas possibly?

[gerryf]

download this and it will show you where things are....make a screenshot and post it

http://www.snapfiles...pacemonger.html

[Carmine RJNL]

Here is the screenshot, I attached it to the post.

Attached Thumbnails

• 

[gerryf]

Well, those are neat. Don't delete anything yet.

The _rzi_00.042 and _rzi_00.041 appear to be garbage files. I've looked around the internet and found only two posts referening them--one in japanese and one in german....

They are not active files....one was created in november and the other in February. Plus they are in your root...c:\ Normal programs don't tend to place things in there. They are not windows files, though.

If deleted, that would free up about half a gigabyte.

The hberfil.sys is your hibernation image...If you use hibernation, you ought to keep it...if not, turning it off will give you another half a gigabyte

The pagefile....well, I guess my questions are how much ram do you have and did someone set your page file to a static size, since windows should shrink it to a smaller size if it is not in use.


How about downloading hijackthis and posting a log (check the download section under spyware). Not looking for spyware, but I am curious if anything would create them

Do you have a cd or dvd burner on this machine?

[Carmine RJNL]

I don't use hibernation but I suppose I should keep it just incase anyways.

I have 512RAM, and the Virtual Memory was default set when I got the computer but it is set to 672-1344MB for the C:/ drive. Should I lower it? I deleted the _rzi_ files, and everything seems fine. I also deleted crash.txt and some other large files.. i now have 2.50GB's of free space.

I have a CDRW/DVD-ROM as well. I will download the hijackthis program to post a log, and will edit this post when I have it. Thanks so far for your help. You have been most helpful.

EDITTED FOR LOGFILE // // // // //
Logfile of HijackThis v1.99.1
Scan saved at 10:30:28 PM, on 4/22/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\WPC54Cfg.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\System32\wuauclt.exe
C:\DOCUMENTS AND SETTINGS\CARMINE RJNL\DESKTOP\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...90/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1114195679246
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,23/mcgdmgr.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: NICSer_WPC54GS - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter with SpeedBooster\NICServ.exe

Edited by Carmine RJNL, 22 April 2005 - 08:32 PM.

[gerryf]

Set page file to "SYSTEM MANAGED SIZE"

Windows will likely shrink it to a much smaller size.

[Carmine RJNL]

Can I delete the hiberfil.sys, if not.. how do I "turn it off"? Also, I have editted the above post if you notice anything in there, lemme know. Thank you.

[gerryf]

go to control panel, power settings, hibernate tab and uncheck USE HIBERNATION...that will delete the file

[gerryf]

log looks fine...I see nothing that explains those massive files

[Carmine RJNL]

That hibernate was already unchecked and the file was still there...? Maybe it's there from the old install of windows. :/ Thats what i'm saying, it's not deleting before it installs, it's just rewriting over some files, and leaving the others that didnt need to be rewritten. Even though you've helped get it up to 2.87 GB, I still have no clue where the other like 9 GB that is "used" even though its not.

Edited by Carmine RJNL, 22 April 2005 - 08:53 PM.

[gerryf]

Feel free to delete it,

the other space is likely taken up by your restore points (Default is 12 percent of your drive) and the , master boot record, which I think just about does it (plus there is overhead for drive function).

If you want to regain a little space, right click MY COMPUTER, choose PROPERTIES, choose SYSTEM RETORE, and check TURN OFF SYSTEM RESTORE, but you will lose the ability to restore to earlier system states (or slide the slider from 12 to 6 percent, maybe

[gerryf]

was there an old install of windows on this before? If so, what version?