Help Its filling up my hard drive

[Guest]

Has anyone else noticed that each new definition update causes your hard
drive space (used space) to increase by ~20MB? Yes, I said approximately 20
MegaBytes!With today's update I again verified that, even though the update
file size was only supposed to be 2 to 3 MB, my used space increase by the
above mentioned amount. I ran disk cleanup and rebooted before installing
the update, checked my hard drive (used) space, installed the definition
update (via Auto Update), ran disk cleanup and rebooted, checked hard drive
(used) space and subtracted. Once again it had increased ~20MB. It seems
that the new definition would at least just overwrite the old one or anything
besides eating up 20 MB more disk space every time. Am I missing something
here??? If so just call me stupid.

 

[Bill Sanderson]

If you run the Disk Cleanup tool, does that space go down?

i.e. run disk cleanup, grab definitions and see space go up by 20 megs, and
then run disk cleanup again?

I'll see if I can test this on a VPC when I get a chance--some others have
complained about disk space usage, but without any specifics, and I really
haven't noticed it myself.
--

 

[Guest]

Bill,

Thanks for your reply. The space does not go down after running disk
cleanup tool.

My procedure, which I repeated with three separate definition updates, was
to run disk cleanup, reboot and then check used disk space (to get a
baseline), grab the update and let it install, run disk cleanup again, again
reboot, then check used disk space and it would always be approximately 20MB
higher than the baseline each time. What I also don't understand is why/how
can a 2.7MB file increase the used space by 20MB to start with?

 

[Bill Sanderson]

I've observed, I think, in documents and settings\all users\application
data\microsoft\windows defender--about 3 sets of update files--a guid
folder, a default folder and a backup folder. There's also a file in the
\program files\Windows defender folder, and perhaps 3 files of significant
size in \windows\temp.

You might look at those locations and add them up--but I don't think they
are duplicated each time--that should be the full burden, unless I'm missing
something--I'm not sure how many updates the box I was looking at had been
through.


--

 

[Guest]

I've also checked the folders you mentioned but none of them seem to account
for the 20+MB used space increase... even if they did, I guess what I'm
asking is this: Is Defender supposed to permanently use up 20+MB of hard
disk space every time it updates? Because I'm confident that is what it's
doing on my PC.

 

[Guest]

I just did a check using today's 1.7MB defintion with these results.

Used Space (before applying update): 4,396,007,424 bytes
Used Space (after applying update): 4,416,385,024 bytes
Used Space (after running disk cleanup): 4,416,376,832 bytes.

To get these numbers I right click on (C in "my computer" and select
"properties".

Interesting note: As another way to check used space this time I also
selected the C: drive in windows explorer to display all files/folders in the
right frame then clicked on EDIT "select all" then right clicked on the
selection for "properties" and got the following.

Size (before applying update): 4,183,719,850
Size (after applying update/running disk cleanup): 4,186,828,334

If my math is correct the first method showed a loss of approximately
19.43MB hard drive space. The second method showed a loss of approximately
2.96MB. Shouldn't they be approximately the same. Regardless, shouldn't
right clicking (C and selecting "properties" in "my computer" provide the
most accurate account of hard drive space?

 

[Guest]

I'm starting to think the problem isn't with Defender, its with the way
Windows XP reports drive space. Either that or there is a much bigger
problem because I just did a check using a regular security update that
became available this morning, a file that was smaller than 1MB and lost -
according to Windows - 14MB! This is too strange.

 

[Bill Sanderson]

I think the issue is your measuring technique, at this point.

We're getting into a level of detail that I understand some of the
complexities of, but can't give a quick answer about what the right answer
is--i.e. which of your two techniques is "correct"--and why the difference.

I'm going to see if I can get some other eyes that know this area better
than me to look at this.

 

[Guest]

Thanks Bill. And if it should turn out that the issue is my measuring
technique - Please, please......... PLEASE advise of the CORRECT technique.
Both those techniques worked, and were fairly close to each other with all
previous versions of Wndows I am familiar with. I realize NTFS partitions
and XP are way different than FAT32 and Win98 but I thought I had at least a
good grasp on the basics.

 

[Bill Sanderson]

OK - here are some thoughts from clearer/wiser heads:

1) Updates create System Restore restore points. Check System restore and
see how many there are and when they are created. You can limit SR space in
properties of My Computer.

2) The tools to remove temporary files don't remove files that are less than
a week old. I never knew that, although mostly I do that job by hand
anyway.

 

[Guest]

That is VERY interesting. The temp files don't seem to be the ones using up
that extra space though (at least not the ones in C:\Documents and
Settings\Tony\Local Settings\Temp).

But the System Restore points could very likely be the culprit. I found the
way to limit SR space as you mentioned, but how do you check System restore
to see how many there are and when they are created? Aren't those files
stored in C:/System Volume Information. Explorer will display that folder
but won't show me what is in it or its size (Error: System Volume Information
is not accesible. Access is denied)

Regarding my methods of checking hard drive used space? What is the correct
way?

 

[Bill Sanderson]

You can see the names and creation dates and times of the System Restore
points by going to start, all programs, accessories, system tools, system
restore, restore, next, and clicking on a bold date.

"Software Distribution Service 2.0" is the name of the restore point
associate with a Windows Defender signature update, apparently.

However--as to the rest---how to accurately determine the space taken up by
a Restore point, or even the broader question--what's the right way to
measure disk space for the complete system--I don't know that answer, off
the top of my head.

You can blow away all restore points by turning off System Restore--and take
a measurement there.

You can then turn the facility back on--take another measurement--there's
probably some overhead...

Then do a signature update-take a measurement.

Then turn System Restore off again.

This isn't a test I'd want to do on a running system, unless it is purely
for testing. It'd be pretty easy on a Virtual PC--but I don't have one of
those running XP--I should create one, though--it'd be useful for stuff like
this.

Unfortunately, I only know how to remove ALL system restore points (turn it
off and on) or all but the most recent, SR points (use the More Options tab
in Disk Cleanup)--there's no facility for removing an arbitrary SR point.

I know I'm not being much help on the root issue of how to properly measure
disk space here--you might want to post in one of the public XP support
groups for that one--I don't understand the difference you see between
methods, myself.





--

 

[Guest]

I don't mind running the test because I have a recent backup image of my
drive.
I went ahead removed all but the most recent restore point via Disk Ceanup
and reclaimed a whopping 538.59MB of used disk space! Then I turned off
System Restore completely, effectively removing the last restore point, and
reclaimed another 15.25MB. Hmmm. . . that's about the same amount of space I
lost (~14MB) with the application of the yesterday's regular security update.
Cool!

I think you're on to something here. And what's even better (for me anyway)
is that I don't really use System Restore since I create regular backup
images. So if that's where the space is going I can either turn it off
completely, or adjust the amount of space available to System Restore and
realize that it will only use up so much space anyway and then start
overwriting the oldest restore points automatically.

Based on this, if I apply the next update with System Restore turned off, I
should no longer loose anywhere near 20MB of disk space. Maybe none at all,
other than temp files, if the new definition overwrites the old one as I
would like to hope it would.

 

[Bill Sanderson]

If you are tight for space, I'd limit SR's usage.

I would hate to see you turn it off--it can save a lot of time--if a driver
trashes your system SR is quicker than restoring an image and losing a days
worth of email, etc.

--

 

[Guest]

Good point. I will probably limit it. I'm not really tight for space yet, I
just had a problem with the system seemingly growing at an unacceptable rate
with no end in site, for many reasons. But if I'm able to confirm what we
think it is, as I believe I will with the next definition update, then at
least I'll know why it's happening and how to control it if so desired.

 

[Guest]

I applied today's 1.6MB Defintion Update, with System Restore turned OFF, and
lost only 3.78MB of disk space which pretty much confirms (I guess) what
we've been talking about. I'm much happier with that and with understanding
where the space was going.

Certainly 3.78MB is much better than 20MB but I still have one unanswered
question: Are these defintion updates "overwriting" the old defintions or
anything along those lines? I think you mentioned defender keeps about 3 sets
of update files, but does that mean that is all it will keep. Let me try to
just say what I mean: Can you tell me if Defender is intended to use up ~3
or 4 MB of disk space each time it updates - on and on and on until someday
Defender will be the biggest single use of hard drive space? I can see
having a relatively small gain each time as I'm sure antispyware defintions
themselves get bigger due to new spyware coming out each day, but 3 or 4
MB? If thats the case I may have to do without Anti-spyware. But I'd like
to make an informed decision. Thanks in advance. And thanks for all your
help so far.

 

[Bill Sanderson]

I don't have any inside knowledge of the design of the program or its update
processes. I can say what I've observed, which is that there's an MSI file
in \program files\windows defender, and the subdirectories I mentioned
elswhere in this thread in the "all users" profile under application data.

My own guess from those observations is that it is designed to keep the
current version and at least one backup--but I haven't looked that closely
at what happens in an update.

I am certain that the design doesn't intentionally eat space permanently.
(and I've seen several different antivirus apps that DO have that design!)

--

 

[Guest]

Ok - sounds good to me. I think I'll keep it. Thanks for all your help and
thanks to Microsoft for providing software like this at no charge to help
protect our PC's.

 

[Bill Sanderson]

There's a good bit of very sophisticated engineering under the hood of this.
How it'll play out in the real world is another question, of course, but I
believe it will be capable of making a measurable difference in the problems
it is intended to fix.

--