mysterious increase in disk space usage

[doncee]

Have recently experienced a mysterious increase in amount of
disk space used when checking properties of C drive in My Computer.
My disk space increased about 700 MB in a couple of days even
though haven't added any files or programs. Am using XP Pro w\ all
updates installed. Ran the disk cleanup utility to no avail. Also
did chkdsk \ degrag etc & no change. Did a google search on this &
could only find suggestions for several 3rd party utilities to
download to monitor disk space usage. Are there any of these that
are recommended by the gurus here?
Any thoughts on what would cause this. Has anyone heard of a
virus \trojan or spyware that would cause this. The machine is
running just fine otherwise. Spybot \ NAV haven't shown a thing.
Thanks,
dc

 

[philo]

Have recently experienced a mysterious increase in amount of
disk space used when checking properties of C drive in My Computer.
My disk space increased about 700 MB in a couple of days even
though haven't added any files or programs. Am using XP Pro w\ all
updates installed. Ran the disk cleanup utility to no avail. Also
did chkdsk \ degrag etc & no change. Did a google search on this &
could only find suggestions for several 3rd party utilities to
download to monitor disk space usage. Are there any of these that
are recommended by the gurus here?
Any thoughts on what would cause this. Has anyone heard of a
virus \trojan or spyware that would cause this. The machine is
running just fine otherwise. Spybot \ NAV haven't shown a thing.
Thanks,
dc

If Windows is regulating your page file...then there is probably nothing to
worry about.

Also...did you perhaps disable hibernation or reduce the size of system
restore?


BTW: You did mention that your ran disk cleanup...that is also one way to
increase free space

 

[Gerry]

Don

Any Norton or imaging products installed?

Open Disk Defragmenter and click on Analyse. Select View Report and
click on Save As and Save. Now find VolumeC.txt in your My Documents
Folder and post a copy. I am interested in a copy before you defragment.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[doncee]

@TK2MSFTNGP06.phx.gbl:

DonAny Norton or imaging products installed?
Open Disk Defragmenter and click on Analyse. Select View Report
and click on Save As and Save. Now find VolumeC.txt in your My
Documents Folder and post a copy. I am interested in a copy before
you defragment.


Here is the Disk Defrag report. No norton imaging installed that
aware of. Thanks for responding.....very much appreciated:
dc

Volume ACER (C
Volume size = 71.58 GB
Cluster size = 4 KB
Used space = 7.90 GB
Free space = 63.68 GB
Percent free space = 88 %

Volume fragmentation
Total fragmentation = 3 %
File fragmentation = 7 %
Free space fragmentation = 0 %

File fragmentation
Total files = 40,225
Average file size = 286 KB
Total fragmented files = 394
Total excess fragments = 5,994
Average fragments per file = 1.14

Pagefile fragmentation
Pagefile size = 1.49 GB
Total fragments = 1

Folder fragmentation
Total folders = 3,602
Fragmented folders = 30
Excess folder fragments = 37

Master File Table (MFT) fragmentation
Total MFT size = 45 MB
MFT record count = 43,990
Percent MFT in use = 94 %
Total MFT fragments = 2

-------------------------------------------------------------------
-------------
Fragments File Size Most fragmented files
397 28 MB \Temp Folder\XNews Folder_2\folders
\_Queue.mbx
258 18 MB \Temp Folder\XNews Folder_2\folders
\_Queue.qdr
172 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp815.tmp\VIRSCAN7.DAT
165 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\BinHub\esrdef.bin
145 2 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\BinHub\cceraser.dll
137 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp22a7.tmp\VIRSCAN7.DAT
134 9 MB \Documents and Settings\All Users
\Application Data\Symantec\LiveUpdate\Downloads
\1195148577jtun_nav2k6enn05m25.m25.full.zip
132 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp143.tmp\VIRSCAN7.DAT
132 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp833.tmp\VIRSCAN7.DAT
111 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp15d.tmp\VIRSCAN7.DAT
94 4 MB \Temp Folder\XNews Folder_2\folders
\queu2.qdr
90 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\BinHub\virscan5.dat
85 5 MB \WINDOWS\temp\slu5df7.tmp
77 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp833.tmp\VIRSCAN5.DAT
77 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp22a7.tmp\ESRDEF.BIN
77 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp15d.tmp\ESRDEF.BIN
76 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp815.tmp\ESRDEF.BIN
76 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp5dda.tmp\ESRDEF.BIN
76 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp5dda.tmp\VIRSCAN7.DAT
72 5 MB \WINDOWS\temp\slu5e18.tmp
72 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp5dfa.tmp\ESRDEF.BIN
71 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp143.tmp\ESRDEF.BIN
69 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp5dfa.tmp\VIRSCAN7.DAT
68 15 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp22c5.tmp\VIRSCAN7.DAT
67 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp815.tmp\VIRSCAN5.DAT
64 5 MB \WINDOWS\temp\slu833.tmp
61 424 KB \ffastun.ffl
59 4 MB \Program Files\Spybot - Search &
Destroy\Includes\Startup.tnfo
58 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp5dda.tmp\VIRSCAN5.DAT
58 5 MB \Program Files\Common Files
\Symantec Shared\VirusDefs\tmp15d.tmp\VIRSCAN5.DAT

 

[doncee]

news:[email protected]...

Have recently experienced a mysterious increase in amount of
disk space used when checking properties of C drive in My
Computer.
My disk space increased about 700 MB in a couple of days even
though haven't added any files or programs. Am using XP Pro w\ all
updates installed. Ran the disk cleanup utility to no avail. Also
did chkdsk \ degrag etc & no change. Did a google search on this &
could only find suggestions for several 3rd party utilities to
download to monitor disk space usage. Are there any of these that
are recommended by the gurus here?
Any thoughts on what would cause this. Has anyone heard of a
virus \trojan or spyware that would cause this. The machine is
running just fine otherwise. Spybot \ NAV haven't shown a thing.
Thanks,
dc


If Windows is regulating your page file...then there is probably
nothing to worry about.
Also...did you perhaps disable hibernation or reduce the size of
system restore?
BTW: You did mention that your ran disk cleanup...that is also one
way to increase free space
I disabled hibernation & the size of restore months ago. Haven't
changed any of that since then. I don't know if Windows is
regulating the page file or not. How do I check for that? Disk
Cleanup had little to no effect on my disk space usage. Thanks for
your reply.
dc

 

[Gerry]

Don

Why are you worried about a 700 mb increase in disk space usage when
you have 88% free disk space?

Are there any other drives / partitions in addition to C?

What is the status of System Restore on your system?

What Norton product do you have?

Some Norton products operate a Protected Recycle Bin, which is not
visible. These can be a significant size.

Go to Start, Control Panel, Folder Options, View, Advanced Settings and
verify that the box before "Show hidden files and folders" is checked
and "Hide protected operating system files " is unchecked. You may need
to scroll down to see the second item. You should also make certain that
the box before "Hide extensions for known file types" is not checked.
Next in Windows Explorer make sure View, Details is selected and then
select View, Choose Details and check before Name, Type, Total Size, and
Free Space.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[doncee]

Don

Why are you worried about a 700 mb increase in disk space usage
when you have 88% free disk space?
Are there any other drives / partitions in addition to C?
What is the status of System Restore on your system?
What Norton product do you have?
Some Norton products operate a Protected Recycle Bin, which is not
visible. These can be a significant size.
Go to Start, Control Panel, Folder Options, View, Advanced
Settings and verify that the box before "Show hidden files and
folders" is checked and "Hide protected operating system files " is
unchecked. You may need to scroll down to see the second item. You
should also make certain that the box before "Hide extensions for
known file types" is not checked.
Next in Windows Explorer make sure View, Details is selected and
then select View, Choose Details and check before Name, Type, Total
Size, and Free Space.


Gerry:
Thanks for your response. I'm not actually worried about the
700 mb increase except that it happened suddenly ( in just a couple
of days) & without me adding any large files or programs that am
aware of. I guess my main concern is that I might have a virus or
some spyware working in the background that I am unaware of, or
that I am doing something stupid that is causing an increase in
disk space usage. Obviously with an increase in disk usage of 700mb
every few days I would run out of disk space quickly.
System Restore is set to use 1% of the C drive. It has been set
this way for months.
I am using the Norton AntiVirus 2006. To my knowledge it does
not have a hidden recycle bin. It is an OEM version & pretty
stripped down from others I have seen in the past. Is there a way
that you know of that I could determine if it has a protected
recycle bin??
I had hidden & system files showing already. I did change the
view in explorer but could not find a "Free Space" check box. I
did check the name\type\total size options. The "pagefile.sys" was
the largest file in the root directory @ 1.5 million KB.
I do have a D drive partition which has not shown any unusual
fluctuation in disk space usage in recent days. It also has about
90% free space.
Once again thanks for your responses. If there is anything else
you might suggest I look for please let me know. Do you think I
could have some spyware \ malware involved here??
Thanks again,
dc

 

[Dick Ballard]

My disk space usage has also increased dramatically just in the last
two days. It has become a critical issue in my case because my Sony
machine was set up with only a 15 GB partition for Windows and program
files.

Even though the Sony Media Center Edition has a 200 GB HD (plus a
second 200 GB HD I added), a major portion of the primary drive is
allocated for large media files (which I mostly am not using), with
another 6 GB set aside for recovery of the original operating system
(no OS CD's supplied).

My page file is set for D: (the media file partition) so it is not
affecting my Windows partition.

My free space decreased from around a GB down to near zero in two
days. I also note that Norton Internet Security 2007 has not been
updating via Automatic Live Update since Wed of this week. A manual
live update session appears to work but does not affect the virus
definition date status.

I went looking for the massive file usage and found that NIS is
leaving many hundreds of megabytes of trash in the Windows\Temp
directory under folder names slu****.tmp. There are temporary anti
virus definition file updates for just one date (11/21/07) repeated in
27 of the 118 slu folders for a total of 1.161 GB (yes, that's 1161
MB!).

So I deleted all of those files and temporarily turned off NIS
automatic live update. I think Symantec went on holiday and left some
the robots in charge. I'm not sure what is really going on.

In any case, I would like to increase the size of the Windows
partition. I could dump the OS restore partition because I have since
obtained the OS CD's, but Sony indicates that I would have to
reinstall the OS if I did that (is this true?). Or perhaps I could use
a partitioning utility to simply adjust the C: partition, but I
hesitate here because of potential issues with Sony proprietary disk
system tricks (any known problems here?)

Any suggestions?

Dick Ballard
(e-mail address removed)

 

[Enkidu]

Have recently experienced a mysterious increase in amount of
disk space used when checking properties of C drive in My Computer.
My disk space increased about 700 MB in a couple of days even
though haven't added any files or programs. Am using XP Pro w\ all
updates installed. Ran the disk cleanup utility to no avail. Also
did chkdsk \ degrag etc & no change. Did a google search on this &
could only find suggestions for several 3rd party utilities to
download to monitor disk space usage. Are there any of these that
are recommended by the gurus here?
Any thoughts on what would cause this. Has anyone heard of a
virus \trojan or spyware that would cause this. The machine is
running just fine otherwise. Spybot \ NAV haven't shown a thing.
Thanks,

Don't run chkdsk unless you really have to, like things are noticeably
broken. It involves a higher than usual risk of things going badly wrong.

Cheers,

Cliff

 

[doncee]

Dick:
Sorry, I have no suggestions for you about your partitioning
dilemma but thanks for the info about the slu**.tmp files. Just
to
confirm, you ARE saying it IS ok to remove those files from the
Wind\Temp folder?? I also have about 400MB of these files\folders
that are dated 11/22 & 11/23. This is on or about the time that I
was noticing the increase in disk space usage. Just wanting to
double check that it IS ok to remove those files\folders. Thanks
dc

 

[Dick Ballard]

All I've read on the net seems to suggest that everything in
windows\temp is fair game for deletion unless there are other running
applications using any of them. Close all apps before doing anything.

I'm far from expert here, though. I haven't deleted the sub folders,
only the files in them. In my case nothing bad has happened, at least
no more problems than I already had with NIS creating these files and
not cleaning up after itself.

Automatic live update doesn't seem to be working yet. I just tried a
manual update (after several unsuccessful tries during the last two
days) and it did increment the date to 11/24/07 (today). It also did
not leave the trash like it did in the last two days.

At this point I am convinced that some bad code was downloaded with
the 11/21/07 virus update which caused this whole mess. Symantec
appears to have corrected it now. I'll breathe a bit easier after a
couple more days, assuming the automatic live update starts working
again.

Dick Ballard
(e-mail address removed)

 

[philo]

If Windows is regulating your page file...then there is probably
nothing to worry about.
Also...did you perhaps disable hibernation or reduce the size of
system restore?
BTW: You did mention that your ran disk cleanup...that is also one
way to increase free space

I disabled hibernation & the size of restore months ago. Haven't
changed any of that since then. I don't know if Windows is
regulating the page file or not. How do I check for that? Disk
Cleanup had little to no effect on my disk space usage. Thanks for
your reply.
dc

If your machine had not been turned off...changes may have not been made
until after a reboot.

As far as pagefile goes... look in system properties

 

[Dick Ballard]

Automatic Live Update now appears to be working. However, NIS appears
to still be using disk space at about the rate of 43MB per update. So
I went exploring again for all those files.

There are no more added files to the \slu***.tmp\ folders in the
windows\temp directory. So then I started looking for anything
Symantec or Norton related.

Under C:\Program Files\Common Files\Symantec Shared\VirusDefs\ there
are a ton more temporary directories and a few other named and dated
directories:

\20071121.002\
\20071124.003\
\20071125.006\
\BinHub\
\incoming\
\TextHub\
\tmp1a51.tmp\
\tmp1a93.tmp\
\tmp1b02.tmp\
....
and many more of these:
\tmp****.tmp\
etc

Of the 100 or so \tmp****.tmp\ folders, 20 of them each contain 43MB
of the same files that I found in windows\temp folder, all with dates
in the last few days. The same series of files also appears in each of
the dated folders and the \BinHub\ folder.

I am suspicious that NIS is again not cleaning up after itself. I
believe I could dump most of the newly discovered stuff in these tmp
folders, but I want to check with Symantec first. I don't know if I'll
get any kind of intelligent answer though, especially not from the
usual tech support sources.

Dick Ballard
(e-mail address removed)

 

[doncee]

Dick:
Thanks again for the additonal info. I'll take a look for those
same files on my machine. This all appears to be very well what I
was looking for. I haven't noticed any unusual increase in disk
space usage during the last day or so. Let me know what you find
out from Symantec about deleting what appears to be useless left
over temp file. Once again, thanks
dc

 

[Dick Ballard]

More info on NIS trash and temporary files:

http://service1.symantec.com/suppor...94d487eb642c071b882571270003d12f?OpenDocument

or

http://tinyurl.com/2xezv4

I don't seem to be able to delete the tmp folders under VirusDefs
which, according to the notes above, are not supposed to be there.
They are using valuable disk space (a lot).

I suppose this whole thread is not important if one has a whole 200GB
or larger drive for windows and all of the apps. But my case must be
somewhat common since a lot of name brand machines were probably set
up like mine with a limited size partition for Windows.

Dick Ballard
(e-mail address removed)

 

[Dick Ballard]

OK, found out how to delete the tmp folders:

On the NIS screen go to "Internet Security and Firewall Options".
Under "Protect my product" uncheck "Turn on protection for my Symantec
product".

Now you can navigate to the tmp****.tmp folders and delete them.

Don't forget to empty the recycle bin afterwards. Also remember to
turn "Protect my product" back on when you finish.

Dick Ballard
(e-mail address removed)

 

[doncee]

Dick:
Thanks for the follow up. The total size of these unnecessary
files comes pretty close to the amount of bloated disk usage I
was experiencing. Good job!!!
dc



OK, found out how to delete the tmp folders:
On the NIS screen go to "Internet Security and Firewall Options".
Under "Protect my product" uncheck "Turn on protection for my
Symantec product".Now you can navigate to the tmp****.tmp folders and delete them.
Don't forget to empty the recycle bin afterwards. Also remember
to turn "Protect my product" back on when you finish.

Dick Ballard
(e-mail address removed)

On Mon, 26 Nov 2007 04:07:03 GMT, Dick Ballard
<[email protected]>
wrote:

More info on NIS trash and temporary files:
http://service1.symantec.com/support/ent-
security.nsf/854fa02b4f5013678825731a007d06af/94d487eb642c071b882
571270003d12f?OpenDocument
or
http://tinyurl.com/2xezv4

I don't seem to be able to delete the tmp folders under VirusDefs
which, according to the notes above, are not supposed to be
there.
They are using valuable disk space (a lot).
I suppose this whole thread is not important if one has a whole
200GB or larger drive for windows and all of the apps. But my
case must be somewhat common since a lot of name brand machines
were probably set up like mine with a limited size partition for
Windows.
Dick Ballard
(e-mail address removed)

On Sat, 24 Nov 2007 18:11:26 -0600, doncee


Dick:
Sorry, I have no suggestions for you about your partitioning
dilemma but thanks for the info about the slu**.tmp files. Just
to confirm, you ARE saying it IS ok to remove those files from
the Wind\Temp folder?? I also have about 400MB of these files
\folders that are dated 11/22 & 11/23. This is on or about the
time that I was noticing the increase in disk space usage. Just
wanting to double check that it IS ok to remove those files
\folders. Thanks
dc

 

[Gerry]

Dick

Before doing anything which follows pen Disk Defragmenter and click on
Analyse. Select View Report and click on Save As and Save. Now find
VolumeC.txt in your My Documents Folder and post a copy. I am interested
in a copy before you defragment.

The default allocation to System Restore is 12% on your C partition
which is over generous. I would reduce it to 700 mb. Right click your My
Computer icon on the Desktop and select System Restore. Place the cursor
on your C drive select Settings but this time find the slider and drag
it to the left until it reads 700 mb and
exit. When you get to the Settings screen click on Apply and OK and
exit.

Another default setting which could be wasteful is that for temporary
internet files, especially if you do not store offline copies on disk.
The default allocation is 3% of drive. Depending on your attitude to
offline copies you could reduce this to 1% or 2%. In Internet Explorer
select Tools, Internet Options, General, Temporary Internet Files,
Settings to make the change. At the same time look at the number of days
history is held.

The default allocation for the Recycle Bin is 10 % of drive. Change to
5%, which should be sufficient. In Windows Explorer place the cursor
on your Recycle Bin, right click and select Properties, Global and
move the slider from 10% to 5%. However, try to avoid letting it get
too full as if it is full and you delete a file by mistake it will
bypass the Recycle Bin and be gone for ever.

Select Start, All Programs, Accessories, System Tools, Disk CleanUp to
Empty your Recycle Bin and Remove Temporary Internet Files. Also
select Start, All Programs, accessories, System Tools, Disk CleanUp,
More Options, System Restore and remove all but the latest System
Restore point. Run Disk Defragmenter.

Using Disk CleanUp you need to run it in all User Profiles. cCleaner
avoids that necessity. Also the More Options suggestion above could
well have been overlooked when you ran Disk CleanUp. cCleaner
does not touch Restore Points.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Dick Ballard]

Systems Restore is already set at 5% which is 654 MB in this case.

I regularly run Cleanup on C: and did so several times while chasing
this issue.

History is also limited by routine maintenance.

I regularly empty the Recycle Bin so it rarely has much in it (except
after I dumped all of those Norton tmp files).

The big problem with the NIS tmp files, both in VirusDefs\ and in the
Windows\Temp\ folders, was that each virus update since about 11/21/07
appeared to be adding multiple instances of identically populated
\slu****.tmp\ or \tmp****.tmp\ folders. I believe Symantec shipped
some bad code with the 11/21 update. That appears to have been fixed.

I'll check out the Defrag report later. I puzzled though - in all my
previous experience I've never noticed any improvement in performance
after defragging, and, as I understand it, defrag doesn't reclaim any
disk space, but only reallocates it so that each file occupies a
contiguous area.

The best solution would be to repartition the 200 GB HD using one of
the third party utilities. I hesitate only because of the uncertainty
of messing with Sony's perhaps proprietary formatting tricks. I'd
really like to know if that is an issue or not. Sony seems to suggest
that it is, but that may only be a CYA thing on their part. I don't
want to have to reinstall everything.

Dick Ballard
(e-mail address removed)

 

[Gerry]

Dick

I believe that Defragmenting does help but I was asking for the Report,
preferably the Report before running Defragmenter, as a means of
gathering background information to see whether there might be other
things I might be able to suggest.

There might be ways, other than by resizing partitions, to generate more
space in the system partition.This can be achieved by relocation of
folders.

For Temporary Internet Files select Start, Control Panel, Internet
Options, Temporary Internet Files. Settings, Move Folder.

To move the Outlook Express Store Folder select in Outlook Express
Tools, Options, Maintenance, Store Folder, Change.
http://www.tomsterdam.com/insideoe/files/store.htm

How to Change the Default Location of the My Documents Folder:
http://support.microsoft.com/?id=310147

You may also need to change Default File locations in the Microsoft
Office programmes you choose to move the My Documents folder. For Word
go to Tools, Options, File Locations, highlight Documents, click on
Modify and change file path. For Excel go to Tools, Options, General
and change default file path.

My Documents is one of a number of system created Special Folders
including My Pictures and My Music. These can more easily be relocated
using Tweak Ui. Download TweakUI, one of the MS powertoys, from here:
http://www.microsoft.com/windowsxp/pro/downloads/powertoys.asp

In TweakUi select My Computer, Special Folders. You can scroll down to
see the full list of Special Folders to the left of the Change
Location button.

You can opt to relocate your programmes folder but in your situation I
do not feel that is necessary and there are arguments in favour of
leaving it where it is.

If your hard drive is formatted as NTFS another potential gain arises
with your operating system on your C partition. In the Windows
Directory of your C partition you will have some uninstall folders in
your Windows folder typically: $NtServicePackUninstall$ and
$NtUninstallKB282010$ etc. These files may be compressed or not
compressed. If compressed the text of the folder name appears in blue
characters. If not compressed you can compress them. Right click on
each folder and select Properties, General, Advanced and check the box
before Compress contents to save Disk Space. On the General Tab you
can see the amount gained by deducting the size on disk from the size.
Folder compression is only an option on a NTFS formatted drive /
partition.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~