[Volattile]

I recently formatted my XP Laptop, and for the last couple of days I keep getting low disk space warnings. It's a 40GB hard drive and apparently I have just 3gb free. I don't have anywhere near the amount of stuff on here that I did before, and I never got disk space warnings. I went into C:\ and selected all the files and folders (with it set to show hidden and system files) and they came to a combined size of about 10gb.

Help. Please.

[Advertisements]

Hello, Volattile.

It sounds like when you formatted the hdd and made the C: partition, not all the space was put on there. Most likely there is a bunch of non partitioned free space on there.

Go to Start > Programs > Administrative Tools > Computer Management. On the drop down box under Storage, click Disk Management. It will list your cd-rom drive(s) and hard drive(s), If there is a bar that says unpartitioned space on there or something like that, please let me know.

[OwNt]

Hello, Volattile.

It sounds like when you formatted the hdd and made the C: partition, not all the space was put on there. Most likely there is a bunch of non partitioned free space on there.

Go to Start > Programs > Administrative Tools > Computer Management. On the drop down box under Storage, click Disk Management. It will list your cd-rom drive(s) and hard drive(s), If there is a bar that says unpartitioned space on there or something like that, please let me know.

[Volattile]

Hello, Volattile.

Hello, OwNt.

It sounds like when you formatted the hdd and made the C: partition, not all the space was put on there. Most likely there is a bunch of non partitioned free space on there.

Go to Start > Programs > Administrative Tools > Computer Management. On the drop down box under Storage, click Disk Management. It will list your cd-rom drive(s) and hard drive(s), If there is a bar that says unpartitioned space on there or something like that, please let me know.

I don't see one.

[Fenor]

If you just formatted the hard drive and installed Windows and didn't put anything else on it, like a whole bunch of mp3's and video files, then this is most likely the cause of some sort of virus/malware that has gotten onto your computer. I suggest you check out the Malware Forum and start by reading the START HERE

If you are still having problems after being given a clean bill of health by a malware specialist, please return to this thread and we will pursue other options for solving this problem.

Good luck!

Fenor

[OwNt]

Let's not go down the malware road yet, I see way too many malware referrals.

Volattile, what brand is the computer? I'm wondering because some have hidden partitions on them with recovery data.

37.25GB NTFS

All your space is indeed there, are you sure you did a complete format? What I mean to say is, did you let windows delete all the files, or did you use a bootdisk/recovery console to do a format on it?

Please Try running Cleanup.

[Volattile]

Volattile, what brand is the computer? I'm wondering because some have hidden partitions on them with recovery data.

Fujitsu-Siemens Amilo D7820

All your space is indeed there, are you sure you did a complete format? What I mean to say is, did you let windows delete all the files, or did you use a bootdisk/recovery console to do a format on it?

I uninstalled Service Pack 2 (after failing to slipstream it) then used the XP disk that came with the laptop and chose "Clean Install".

Please Try running Cleanup.

"CleanUp! 4.0 recovered 207.5 MB of disk space from 13068 files."

[OwNt]

I uninstalled Service Pack 2 (after failing to slipstream it) then used the XP disk that came with the laptop and chose "Clean Install".

Ok, there we go.

Clean install will delete all files related to windows xp, except personal info - kind of like a windows xp repair, but instead of repairing it installs over it. All your old files are still there, plus some new ones now too.

The programs will still be in program files, your old data will be in C:\Documents and Settings\(Variable).(Random name) most likely. Any folders/files you had in other areas of the disk drive will probably still be in the same spot.

You can try formatting it at the recovery console, but I'd hate to see you have to re-customize everything again.

I gotta go to work now, good luck.

[darth_ash]

Hi Volattile,
Download SpaceMonger. It will show you a graphical view of a partition.
If you need anyu help on what files to delete, post a screenshot of SpaceMonger with the problem causing partition opened in it.

[Volattile]

Ok, there we go. smile.gif

Clean install will delete all files related to windows xp, except personal info - kind of like a windows xp repair, but instead of repairing it installs over it. All your old files are still there, plus some new ones now too. sad.gif

The programs will still be in program files, your old data will be in C:\Documents and Settings\(Variable).(Random name) most likely. Any folders/files you had in other areas of the disk drive will probably still be in the same spot.

You can try formatting it at the recovery console, but I'd hate to see you have to re-customize everything again.

I gotta go to work now, good luck.

I remember finding folders in C:\Documents and Settings named liked that, but I deleted them. There were also folders left in Program Files for old programs, but I deleted those too.

I'm not averse to formatting it again, I don't have anything on here I can't just download again.

Hi Volattile,
Download SpaceMonger. It will show you a graphical view of a partition.
If you need anyu help on what files to delete, post a screenshot of SpaceMonger with the problem causing partition opened in it.

All the stuff displayed there (the programs and files) are things I've added since formatting.

[darth_ash]

Your SpaceMonger is really wierd, graphically there is alot of free-space; but still you have only 5GB.
It could very well be malware, follow the instructions in Post#4 by Fenor.

[Volattile]

Your SpaceMonger is really wierd, graphically there is alot of free-space; but still you have only 5GB.
It could very well be malware, follow the instructions in Post#4 by Fenor.

Have done; MSAS found and fixed a trojan, Ad-Aware found some tracking cookies, HJT log is clean.

[Volattile]

Sorry to double post, but...

Just Defragged, and under "Files that did not defragment" the report lists files I had on the laptop before I formatted. They're apparently in

Documents and Settings\Sanders\My Documents

Unfortunately I can't access the Sanders\My Documents folder, Windows tells me "Access if Denied". I have admin privileges, this is the only user account on here.

[OwNt]

Hello, Volattile.

Did you have any of your file encrypted, or have windows configure them so only that user account could view them?

Either way, something is really weird. On the malware side, let's see if we can spot anything with Silent Runners.

After that, try running Rootkit Revealer. The link is at the bottom of the page.

It sounds like your pretty computer literate.

Perhaps run a virus scan if those turn up nothing. Maybe try running of one of these as well. ActiveScan
TrendMicro's HouseCall - check "Auto Clean"

If none of this finds anything/fixes it, it's looking pretty grim from my point of view.

[Volattile]

Did you have any of your file encrypted, or have windows configure them so only that user account could view them?

I don't remember deliberately doing either.

Either way, something is really weird. On the malware side, let's see if we can spot anything with Silent Runners.

After that, try running Rootkit Revealer. The link is at the bottom of the page.

Attached the two log files.

Rootkit Revealer was scanning all the old files that I can't access.

Perhaps run a virus scan if those turn up nothing. Maybe try running of one of these as well. ActiveScan
TrendMicro's HouseCall - check "Auto Clean"

4 infections, cleaned. Java stuff.

If none of this finds anything/fixes it, it's looking pretty grim from my point of view.

Now, when saving the logfile from RootkitReveal I was able to access C:\Documents and Settings\Sanders\My Documents which I can't access normally. I was also able to delete files and folders.

Attached Files

•  Startup_Programs__Volattile__2005_10_02_19.32.50.txt   9.45KB   222 downloads
•  RootkitReveal_Volattile_.txt   6.93KB   86 downloads

Edited by Volattile, 02 October 2005 - 01:38 PM.

[OwNt]

Data mismatch between Windows API and raw hive data.

Volattile, do you remember what else you were doing while running the rootkit revealer? Also, could you add the Silent Runners log onto your post, not as an attachment. As an attachment it scrambles up for some reason.

Thanks

-OwNt