[Sbts]

Hi,
My hard drive was unexpectedly full one day. I downloaded Wiztree to analyse what was using up all the space and there was a folder in my user account called "updated" that was pretty much an exact copy of my desktop. After taking some advice I renamed the folder to see if it seemed to effect anything - it didn't.
Today I actually ran out of space on the hard drive so ran Wiztree again and a new folder has appeared called "updated" with lots of stuff from my decktop but not all (yet). I have now deleted the first folder I renamed but it looks like its gonna happen again. As you can see from the attached jpeg of the Wiztree screen grab my desktop is 841 gb big so when it duplicates everything I run out of space.

 

What is this folder "updated" , why is it there and why does it replace itself when I delete it ?

 

Any help greatly appreciated.

Thanks,
Keith

Attached Thumbnails

• 

[Advertisements]

I would ask you to run a SFC scan first in the start of the troubleshooting. Open an elevated command prompt. Right click Windows logo choose command prompt (Admin)

Select yes when prompted. Black screen will appear type sfc space /scannow hit enter post a screen shot of the results. The command will look like this

sfc  /scannow

Edited by chrissymarie, 23 September 2016 - 03:59 PM.

[chrissymarie]

I would ask you to run a SFC scan first in the start of the troubleshooting. Open an elevated command prompt. Right click Windows logo choose command prompt (Admin)

Select yes when prompted. Black screen will appear type sfc space /scannow hit enter post a screen shot of the results. The command will look like this

sfc  /scannow

Edited by chrissymarie, 23 September 2016 - 03:59 PM.

[Sbts]

Hi there, sorry for the delay in getting back to you my wife has been away for a few days so I have been home alone with our 2 year old son.

Firstly thank you for taking the time to look at this issue.

I ran the scannow utility and it said

 

 

C:\WINDOWS\system32>sfc /scannow

 

Beginning system scan.  This process will take some time.

 

Beginning verification phase of system scan.

Verification 100% complete.

 

Windows Resource Protection did not find any integrity violations.

 

C:\WINDOWS\system32>

 

I have also run Wiztree again as my E drive now says it is full again.

Please see attached  scan of output.

 

Help please.

 

Thanks,

 

Keith

[chrissymarie]

Thank you for running the scan. We now know the OS is fine, and I would say you have a program you installed giving you this issue. I would suggest uninstalling one program at a time until the problem no longer is an issue. This is the second step in troubleshooting this issue. Make a list of your programs so you can reinstall later.    

[Sbts]

Hi thanks for the help - I have found a solution (so far its working)

 

Here is how:

1. Open Windows Explorer and navigate to the location where this folder dwells.
2. Delete the "Updated" folder if it currently exists.
3. Right-click an empty area in this folder, then New, then Text Document. Give it the name "updated" and press Enter.
4. Right-click "updated", then remove the .txt extension, then press Enter.

You now have a file called "updated". This will prevent the rogue program from creating a folder of this same name.

 

Seems to have worked,

Best wishes,

Keith

[chrissymarie]

Good news Sbts, Thank you for letting us know and posting the repair.

[Sbts]

Hi,

I spoke too soon. The file I put there called updated has somehow been overwritten (without asking any permission) with a folder called updated and it is now filling up (back up to 736 GB so far and getting bigger).

I've also noticed a file called " updated.update_in_progress.lock " which has a .LOCK extension.

I don't know if this has anything to do with the problem but tried to delete the .LOCK file anyway using Malwarebytes File Assassin but no joy there.

Still need help please.

Cheers ,

Keith

[scarlet.rose]

Keith......I'd run this by the Malware Removal experts in the Virus, Spyware, Malware Removal Forum......provide a link to this topic.

Edited by scarlet.rose, 27 September 2016 - 10:03 AM.

[Sbts]

Hi again,

I used Process Explorer to search for "updated" it found the folder and the LOCK file. I deleted the LOCK file first then the folder using Process Explorer to delete. I also found a suspicious Firefox 32 bit exe file in an odd place and since my computer is 64 bit I deleted that too.

I have rebooted 3 times now and it does not seen to have come back ....YET.

Will keep you updated (no pun intended).

Cheers,

Keith

[Sbts]

Additional Info

 

• Note the file name or folder you're trying to delete 
• Run Process Explorer > Find > Find Handle > Enter the file or folder name in "Handle or DLL Substring" Dialogue box
• Click on Search
• Right Click on the handle and then click "Close Handle" > Press Yes when promoted.

Should be done. Hope it works;

 

Keith

[scarlet.rose]

Keith, but what is behind these odd occurrences? If this were my computer I'd want one of the malware experts here to check that all is well......they can arrange for you to thoroughly scan your computer, then analyse the results......they are able to use special tools to 'fix' certain problems.

 

But that's for you to decide on.

Edited by scarlet.rose, 27 September 2016 - 04:46 PM.

[chrissymarie]

Sbts we can continue where we left off. I will keep checking back.

[Sbts]

Hi again.

I've booted up this morning and no sign of a return of the problem. I was worried it was a timed installation - putting itself back on overnight.

So fingers crossed - still working.

Keith

[Sbts]

Day two - still fixed . No return of the problem file.

Keith