[Gib80]

My disk cleanup is not freeing up space. It needs repair. I'm losing space and there's not too many options for me. I tried sfc /scannow and I tried Dism /Online /Cleanup-Image /AnalyzeComponentStore > Dism /Online /Cleanup-Image /StartComponentCleanup. I even did Dism /Online /Cleanup-Image /CheckHealth and resetting windows, but nothing seems to free up space. My CCleaner isn't that effective either, so I think there's some rootkit on my laptop, but I do want to keep all of my browsing history and keep most of my restore points.  FRST.txt   26.05KB   83 downloads  Addition.txt   21.14KB   80 downloads

[Advertisements]

I don't see any malware but just in case:

 

Have you run an Avast boot-time scan?

I usually let it run at night but it's gotten faster so may finish in a few hours.  If you run it while you sleep: Mute your speakers so it doesn't wake you up when Windows boots.

 

Click on the Avast ball.  Then click on Protection, then on Antivirus, then on Other Scans then on Boot-time Scan.  Click on Install Special Definitions.  Click on Run on Next PC Reboot.

 

  Reboot and let it run a scan.  It may take hours.

Once it finishes it should load windows.   

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

 

http://www.howtogeek...-windows-vista/

 

Copy and paste the text from the log to a Reply when done.

 

Another useful rootkit scan is MBAR.  https://www.bleeping...s-anti-rootkit/

 

Download the file, save and then go to the download folder and right click on the file and Run as Admin.  Then follow the instructions.  (Pause Avast while it runs so they don't fight each other.)

 

 

There is a possibility that you have some Windows logging turned on, the following fixlist will clear all logs and collect some information about your system,.  We will see if it make a big difference in your drive usage.  Avast likes to eat FRST so pause it while you run the fix and scan.

 

Download the attached fixlist.txt to the same location as FRST

 

 fixlist.txt   1.79KB   82 downloads

 

Run FRST and press Fix

A fix log will be generated please post that 

 

Reboot if the fix doesn't reboot it for you

 

Run FRST again but this time make sure Addition.txt is checked and hit Scan.  Post both logs.

 

Finally you can try WinDirStat.  It will show you where the biggest files are.  Looking doesn't hurt anything but it offers the option to delete files and once deleted they are gone for good.  Best to just use it to locate the biggest users of the hard drive.

 

 

Download and Save

 

http://windirstat.in...rrent_setup.exe

 

and then go to the download folder and right click on it and Run As Admin.

 

Accept the defaults then once it runs, click on the C:\ drive and OK.  It will take 5 to 10 minutes to finish.  Wait until it says 100% and the little pacmen stop chomping and a confusing colored display shows up.  I like to turn off the display (Options then uncheck Show Treemap).  This will show you what folder is using the drive and the percentage.  To get details within a folder just click on the +  in front of the folder. 

 

 

 

 

Download and Save

 

http://windirstat.in...rrent_setup.exe

 

and then go to the download folder and right click on it and Run As Admin.

 

Accept the defaults then once it runs, click on the C:\ drive and OK.  It will take 5 to 10 minutes to finish.  Wait until it says 100% and the little pacmen stop chomping and a confusing colored display shows up.  I like to turn off the display (Options then uncheck Show Treemap).  This will show you what folder is using the drive and the percentage.  To get details within a folder just click on the +  in front of the folder. 

 

[RKinner]

I don't see any malware but just in case:

 

Have you run an Avast boot-time scan?

I usually let it run at night but it's gotten faster so may finish in a few hours.  If you run it while you sleep: Mute your speakers so it doesn't wake you up when Windows boots.

 

Click on the Avast ball.  Then click on Protection, then on Antivirus, then on Other Scans then on Boot-time Scan.  Click on Install Special Definitions.  Click on Run on Next PC Reboot.

 

  Reboot and let it run a scan.  It may take hours.

Once it finishes it should load windows.   

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

 

http://www.howtogeek...-windows-vista/

 

Copy and paste the text from the log to a Reply when done.

 

Another useful rootkit scan is MBAR.  https://www.bleeping...s-anti-rootkit/

 

Download the file, save and then go to the download folder and right click on the file and Run as Admin.  Then follow the instructions.  (Pause Avast while it runs so they don't fight each other.)

 

 

There is a possibility that you have some Windows logging turned on, the following fixlist will clear all logs and collect some information about your system,.  We will see if it make a big difference in your drive usage.  Avast likes to eat FRST so pause it while you run the fix and scan.

 

Download the attached fixlist.txt to the same location as FRST

 

 fixlist.txt   1.79KB   82 downloads

 

Run FRST and press Fix

A fix log will be generated please post that 

 

Reboot if the fix doesn't reboot it for you

 

Run FRST again but this time make sure Addition.txt is checked and hit Scan.  Post both logs.

 

Finally you can try WinDirStat.  It will show you where the biggest files are.  Looking doesn't hurt anything but it offers the option to delete files and once deleted they are gone for good.  Best to just use it to locate the biggest users of the hard drive.

 

 

Download and Save

 

http://windirstat.in...rrent_setup.exe

 

and then go to the download folder and right click on it and Run As Admin.

 

Accept the defaults then once it runs, click on the C:\ drive and OK.  It will take 5 to 10 minutes to finish.  Wait until it says 100% and the little pacmen stop chomping and a confusing colored display shows up.  I like to turn off the display (Options then uncheck Show Treemap).  This will show you what folder is using the drive and the percentage.  To get details within a folder just click on the +  in front of the folder. 

 

 

 

 

Download and Save

 

http://windirstat.in...rrent_setup.exe

 

and then go to the download folder and right click on it and Run As Admin.

 

Accept the defaults then once it runs, click on the C:\ drive and OK.  It will take 5 to 10 minutes to finish.  Wait until it says 100% and the little pacmen stop chomping and a confusing colored display shows up.  I like to turn off the display (Options then uncheck Show Treemap).  This will show you what folder is using the drive and the percentage.  To get details within a folder just click on the +  in front of the folder. 

 

[Gib80]

 Fixlog.txt   84.76KB   83 downloadsThanks, here is the FRST log. I started boot time scan around 8 or 9:00 at night and in the morning at 7:51, it was time to pull the plug, so I cut the scan short, because it was taking too long. Should I try MWB rootkit scan?

[RKinner]

Go ahead and try MBAR.  It's normally much quicker.

[Gib80]

I used TreeSizeFree and Space Sniffer to no avail, is WinDirStat better than those?

 

 

Update: the log is showing FSS as malware, that's odd and before I did Boot Time Scan I had 182 GB, now I have 180 GB of hard drive space.

 

 

 

 

 

 

 MBAM-log.txt   1.41KB   84 downloads

Edited by Gib80, 19 November 2022 - 01:34 PM.

[RKinner]

I assume FSS is Farbar Service Scanner.  Probably a false positive but check with virustotal.com and verify.

 

Did the boot-time scan leave a log?  C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt

 

Avast stores some other logs in C:\ProgramData\AVAST Software\Persistent Data\Avast\Logs.  Make sure they haven't grown overly large.  Biggest on mine is 4097 KB.

 

The file it has you download is boottimescan.wim.  Located in C:\ProgramData\AVAST Software\Avast\bootimescan.  Size on mine is 421MB.  You can delete it if you want but make sure it doesn't just move to the Recycle Bin.  Hopefully it is too big for the recycle bin.

 

I've never used the programs you mention so I can't say if they are same, better or worse.  Windirstat seems to find all of the files so haven't needed to use anything else.

 

When you use Disk Cleanup do you do the Cleanup System Files option too?  That's where you will get the biggest hits.  Windows stores its older version files after each update for at least 30 days and these can be enormous.  Just checked with mine and I have 5GB to recover.. 

 

Sometimes you will see a folder in file explorer C:\Windows.old which contains a full copy of a previous version of Windows that may have been on the machine.

 

Also check C:\$Recycle.bin after clearing the Recycle bin.  Sometimes there are folders in there that don't get cleared.

 

Finally there may be problems with your file system or hard drive.  You can run the older style

chkdsk c:

 

(Search for cmd and when it finds Command Prompt, right click on it and Run As Admin, OK  then type

chkdsk c:

hit Enter.  Answer y when it says it can't do it now and asks if you want to schedule it for the next boot.  Reboot.

 

Can take a few hours tho usually not too bad with an SSD.

 

Also check the hard drive with DiskCheckup

 

https://www.passmark...ts/diskcheckup/

 

Click on Smart info.

 

Especially important are the RAW number of Reallocated Sectors and Bad Blocks.  These should be 0.  If not your hard drive may be deteriorating.  

[Gib80]

Yes, it's definitely Farbar Service Scanner.

 

I have Windows 10 Home and I don't have C:\Program Data. I'm able to navigate to the AVAST folder, I have neither \report\ , \Persistent Data\ or boottimescan.win. My laptop was hanging at boot time scan, so I stopped it from running. I'm almost certain if I let it run, it would still be running as we speak. I tend to use cleanup system files, so that I can go to the more options tab and get rid of all restore points except one.

 

There was one situation where someone ran out of storage space and he found the WinREAgent folder, which was the culprit and he deleted it and solved his problem, but I'm scared to do that to my system, because I don't want to permanently prevent Windows Updates.

[RKinner]

You do have a Program Data folder but it is hidden.  In File Explorer (the folder icon in the task bar)  click on View then check Hidden Items.  Then click on the C: drive and you should see it.

[Gib80]

Thanks for that tidbit, so far this is what it looks like.

 

 

I was able to navigate to report and there was no aswBoot.txt, however I navigated to "C:\ProgramData\AVAST Software\Persistent Data\Avast\Logs"

I have two old files that have 4,097 KB and AvEmUpdate has 4,086 KB

 

You are not going to believe this, I go to randomly use my Disk Cleanup and I first started early this morning w/ 58.something used space and I went all the way down to 47.9 in one fell swoop, but I feel like someone is manipulating the valuable space that's on my laptop.

[RKinner]

Avast boot-time scan is sensitive to problems with the file system so I would run chkdsk c: to make sure it is OK then rerun the scan.

 

Did you happen to notice where exactly the major  items were when you ran Disk Cleanup?  It tells you.  The major eater of the disk is usually Windows Update since it has to store all of the outdated files in case you need to back out the change.

 

Another big user can be  Delivery Optimization.  This is on by default but should be turned off.  What this does is offload Windows Update Servers by having your PC service other PCs with updates.  Settings, Update & Security, then Delivery Optimization.  Off.

 

This is my standard fix for slow PCs.  It turns off many of Windows spyware tasks and services:

 

Search for

 

task scheduler

 

When it finds it, right click and Run As Administrator

 

Click on the arrow in front of Task Scheduler Library then

 

Click on the arrow in front of Microsoft

 

Click on the arrow in front of Windows

 

Click on Application Experience.  In the next pane to the right, right click on each Task and Delete.  Should be three or four (later versions) tasks.

 

Click on Customer Experience Improvement Program.  In the next pane to the right, right click on each Task and Delete.  Should be two tasks.

 

Close Task Scheduler.

 

Search for

services.msc

hit Enter

 

Find SysMain

Right click on it and select Properties.  Change the Startup Type from Automatic to Disabled.  OK

 

 

 

Download OOSU10.exe:

 

https://www.oo-softw...com/en/shutup10

 

Download and Save it (You will get a popup while it's downloading.  You can X out of it)

then go to the Download folder and Right click on the downloaded file and Run As Admin.

Allow it to make a System Restore Point.

Click on Actions then on Apply Recommended Settings.

 

Close the program and reboot.

[Gib80]

My Delivery Optimization was turned on and I turned it off

 

I will get back to you in a little while.

[Gib80]

Before I run boot time scan, in my event viewer, how do I get to cmd logs, so that I can show you the results of chkdsk c:?

 

 

Edited by Gib80, 23 November 2022 - 04:27 AM.

[RKinner]

https://www.sevenfor...viewer-log.htmlshould work even tho it doesn't say it's for Win 10.  Logs should be listed under wininit since it has to restart to run the check.  Or you can run the powershell script at the bottom of the page

[Gib80]

Sorry, I don't have Wininit recorded, because I ran chkdsk c: from within windows, should I post the log anyway?

[RKinner]

if you have the log go ahead and post it.