52 replies to this topic

[paultpa]

I've run several of the scans you wanted, but not all.  Here's some info:

 

-  system repair disk on USB is unable to complete because my flash drives ae not formatted for NTFS........

 

-  I performed a cmd scan in Windows, and will do another in safe mode if you think it will help.  The results said "no integrity violations"

 

-  as I previously posted, I run a disk cleanup upon starting and again before shutting down.  I've always liked chkdsk, and ran one off the command line as admin.  Results below, hopefully it is of some small help.  Note that I will continue to work on your previous suggestions as the weekend progresses.  

 

Microsoft Windows [Version 6.1.7601]

Copyright © 2009 Microsoft Corporation.  All rights reserved.

 

C:\Windows\system32>chkdsk

The type of the file system is NTFS.

Volume label is Gateway.

 

WARNING!  F parameter not specified.

Running CHKDSK in read-only mode.

 

CHKDSK is verifying files (stage 1 of 3)...

  391936 file records processed.

File verification completed.

  18187 large file records processed.

  0 bad file records processed.

  0 EA records processed.

  43 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 3)...

  460414 index entries processed.

Index verification completed.

  0 unindexed files scanned.

  0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 3)...

  391936 file SDs/SIDs processed.

Security descriptor verification completed.

  34240 data files processed.

CHKDSK is verifying Usn Journal...

  33872152 USN bytes processed.

Usn Journal verification completed.

Windows has checked the file system and found no problems.

 

 469407743 KB total disk space.

 468428412 KB in 262421 files.

    188264 KB in 34241 indexes.

         0 KB in bad sectors.

    511043 KB in use by the system.

     65536 KB occupied by the log file.

    280024 KB available on disk.

 

      4096 bytes in each allocation unit.

 117351935 total allocation units on disk.

     70006 allocation units available on disk.

 

C:\Windows\system32>

[paws]

Ok, it was good to see that there is some slight improvement

 

getting the message that sfc found no integrity violations is also excellent news, ( no reason at this stage to run it again) I only suggested running it in safe mode as it was showing error in completion in normal mode

 

The chkdsk results are interesting but seem to indicate that you did not specify the r switch ( or the f switch)

 

I would be inclined to run it again with the r switch from an elevated command prompt, it should then complete all 5 stages of the utility rather than just the 3 and will also attempt to identify any bad sectors or incorrect labelling of your free space/volumes etc. Using the r switch will set the repairs identified to automatic activation. There is no need to use the f switch at this stage as the r switch includes the repairs/actions specified with f switch.

 

The command you need is therefore

chkdsk /r

accept the warnings from the black screen, schedule the task by pressing Y and reboot.

 

As before it will take several hours to complete and you should not allow any interuptions to it...

 

Sometimes it can be tad tricky to find the output from chkdsk /r so here's a link to a handy little application written by SleepyDude that will do the trick for you and is so tiny in size that there's a fair chance you will be able to download it and get it to run. If you can't do that then you will need to do it the long way!

https://www.sysnativ...sk-results.html

 

Regards

paws

[paultpa]

Paws,

 

6 SEP 18

 

Over the past several days I've run the commands you specified at the DOS prompt in both Windows and in DOS via safe mode, as itemized in your post of 20 Aug.  

 

In all case nothing has really happened or completed.  There is no report or results to post.  I simply get a few lines of commands and descriptions.

 

Do we have another approach?  All I can think of at this point is to delete another beefy app like Filezilla and do a quick update of an anti-malware app.

[paws]

Ok all understood, I didn't want you to run chkdsk /r in safe mode but in normal mode...

 

When you ran it previously you did not use the r switch or the f switch so no remedial action was actually made, thats why I suggested in my post of 2nd Sept that you try running it again from an elevated command prompt and use the r switch.

 

It is possible that the volume of your c drive is being incorrectly reported due to errors in your file system that may, be repaired by the use of chkdsk /r

Its important that you specify the r switch otherwise the remedial action (if any are necessary) will not be initiated.

It's also important to run the command from an command prompt with elevated privileges.

 

Hope all this makes some sort of sense.

If you can't get it to run then a different appoach (that will achieve the same result) is as follows:

 

1 Click Start>Computer>Right Click on your C drive/Properties/Tools/Error Checking/Check Now/place a tickmark in BOTH boxes and click Start

2 You will see a message that Windows can't check the disk whilst it's in use...click on Schedule a disk check and press Enter key

 

3 Restart your computer and chkdsk will commence to run all 5 procedures and automatically fix any errors that it can.

 

When its finished please post the output.

 

Regards

paws

[paultpa]

Success with chkdsk/r.  I did not know about the "r" earlier.  Hope this helps.

 

 

TimeCreated : 9/10/2018 11:38:13 AM

Message     : 

              

              Checking file system on C:

              The type of the file system is NTFS.

              Volume label is Gateway.

              

              A disk check has been scheduled.

              Windows will now check the disk.                         

              

              CHKDSK is verifying files (stage 1 of 5)...

                391936 file records processed.                                         

              File verification completed.

                18231 large file records processed.                                   

                0 bad file records processed.                                     

                0 EA records processed.                                           

                43 reparse records processed.                                      

              CHKDSK is verifying indexes (stage 2 of 5)...

                460526 index entries processed.                                        

              Index verification completed.

                0 unindexed files scanned.                                        

                0 unindexed files recovered.                                      

              CHKDSK is verifying security descriptors (stage 3 of 5)...

                391936 file SDs/SIDs processed.                                        

              Cleaning up 74 unused index entries from index $SII of file 0x9.

              Cleaning up 74 unused index entries from index $SDH of file 0x9.

              Cleaning up 74 unused security descriptors.

              Security descriptor verification completed.

                34296 data files processed.                                           

              CHKDSK is verifying Usn Journal...

                36192344 USN bytes processed.                                            

              Usn Journal verification completed.

              CHKDSK is verifying file data (stage 4 of 5)...

                391920 files processed.                                                

              File data verification completed.

              CHKDSK is verifying free space (stage 5 of 5)...

                21628 free clusters processed.                                        

              Free space verification is complete.

              Windows has checked the file system and found no problems.

              

               469407743 KB total disk space.

               468619072 KB in 261783 files.

                  188804 KB in 34297 indexes.

                       0 KB in bad sectors.

                  513355 KB in use by the system.

                   65536 KB occupied by the log file.

                   86512 KB available on disk.

              

                    4096 bytes in each allocation unit.

               117351935 total allocation units on disk.

                   21628 allocation units available on disk.

              

              Internal Info:

              00 fb 05 00 9a 84 04 00 04 75 08 00 00 00 00 00  .........u......

              83 50 00 00 2b 00 00 00 00 00 00 00 00 00 00 00  .P..+...........

              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

              

              Windows has finished checking your disk.

              Please wait while your computer restarts.

              

 

TimeCreated : 8/19/2018 1:06:22 PM

Message     : 

              

              Checking file system on C:

              The type of the file system is NTFS.

              Volume label is Gateway.

              

              A disk check has been scheduled.

              Windows will now check the disk.                         

              

              CHKDSK is verifying files (stage 1 of 5)...

              Cleaning up instance tags for file 0x2192a.

                391936 file records processed.                                         

              File verification completed.

                17856 large file records processed.                                   

                0 bad file records processed.                                     

                0 EA records processed.                                           

                43 reparse records processed.                                      

              CHKDSK is verifying indexes (stage 2 of 5)...

                460422 index entries processed.                                        

              Index verification completed.

                0 unindexed files scanned.                                        

                0 unindexed files recovered.                                      

              CHKDSK is verifying security descriptors (stage 3 of 5)...

                391936 file SDs/SIDs processed.                                        

              Cleaning up 1657 unused index entries from index $SII of file 0x9.

              Cleaning up 1657 unused index entries from index $SDH of file 0x9.

              Cleaning up 1657 unused security descriptors.

              Security descriptor verification completed.

                34244 data files processed.                                           

              CHKDSK is verifying Usn Journal...

                36029608 USN bytes processed.                                            

              Usn Journal verification completed.

              CHKDSK is verifying file data (stage 4 of 5)...

                391920 files processed.                                                

              File data verification completed.

              CHKDSK is verifying free space (stage 5 of 5)...

                22230 free clusters processed.                                        

              Free space verification is complete.

              CHKDSK discovered free space marked as allocated in the

              master file table (MFT) bitmap.

              CHKDSK discovered free space marked as allocated in the volume bitmap.

              Windows has made corrections to the file system.

              

               469407743 KB total disk space.

               468617656 KB in 262852 files.

                  188172 KB in 34245 indexes.

                       0 KB in bad sectors.

                  512991 KB in use by the system.

                   65536 KB occupied by the log file.

                   88924 KB available on disk.

              

                    4096 bytes in each allocation unit.

               117351935 total allocation units on disk.

                   22231 allocation units available on disk.

              

              Internal Info:

              00 fb 05 00 93 88 04 00 c5 7b 08 00 00 00 00 00  .........{......

              80 50 00 00 2b 00 00 00 00 00 00 00 00 00 00 00  .P..+...........

              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

              

              Windows has finished checking your disk.

              Please wait while your computer restarts.

[paultpa]

After I posted the scan results I re-started.  No changes in available space.

[paws]

Ok, that's an improvement, there was free space incorrectly labelled but chkdsk with the r switch seems to have fixed it.

 

When you made the repair discs (using Windows native tools) and created a system image did your computer report any errors? (ignore please the incorrectly formatted flash drive)

 

Creating these important discs requires that temp files are created, and it is strange that Windows did not report that there was insufficient space to create them...

 

It could be that your hard drive is just too full..... what did you discover was taking up the room when you completed the analysis as outlined in my post 20th August bullet points 4/5 etc?

 

There is an automated tool called windirstat, that could help you see where the space is being used up and it's available here:

https://windirstat.net/

but you may have to do it the long way by examining your folders if you can't get the windirstat to run.

Regards

paws

[paultpa]

Good morning,

 

 

Was under the weather and had to break away.

 

I installed and ran WinDirStat.  The results have 450.1 GB on C:, and said :

 

-  the biggest space is in Windows with 420.6 GB, or 93.4%

-  second biggest was my name in "users", taking 96.5% of 10.1 GB, and of that 98.6% (or 9.6 GB) is AppData

-  note that 60 MB is in Tracing

-  in my public folder under "users" documents is 306 MB (or 84.4%)

- in the documents folder above, application name WonderShare is 277.6MB (or 90.7%)

-  finally, under "C:" MSO Cache is 619.7 MB

-  everything else in "C:" is not even close.

 

I suppose deleting WonderShare is a good first step?  But the question remains:  if I have some Malware, will it expand to hog that space too?

 

Thanks for the great insight so far.

[paultpa]

Wed. 19 Sep 18

 

I removed my 2016 version of Malwarebytes to open up space to re-install from your site.  No go.  I opened up 40 MB but need more. 

 

Before I keep tinkering, any suggestions?  Thanks.

Edited by paultpa, 19 September 2018 - 01:14 PM.

[paws]

not quite sure what you mean by

the biggest space is in Windows with 420.6 GB, or 93.4%

 

My win 7 (32bit) Windows folder is around 16GB

Some installations can be larger, but should not be 420GB

 

If you mean that the free space is 430GB or around 94% of it then that is fine.

Please advise.

Regards

paws

[paultpa]

By that, I meant (but didn't say) the largest folder taking up space is.....

 

So, to be more specific, I'm looking at a fresh WinDirStat page:

 

 

-  Gateway "C:" is 450.5 GB

 

-  under "C" my Windows folder is about 420 GB or 94.8%, with 152,152 items, 125,803 folders, and is the largest size on my PC

 

-  the 2nd largest folder under Windows: is Microsoft .NET, 836.8 MB, with 3210 items, 2471 items

 

-  under Windows, the 3rd largest is Logs, showing 91.6% or 385,4 GB, with 1654 items, 1645 files, an is 2nd largest

 

Everything else under Windows is much smaller. 

 

 

Hope that clarifies up to this point.

 

 

After the Windows folder, my 2nd largest is MSOCache, is 619.7 GB, 96 items, 79 files

 

 

I did delete a large application (MalwareBytes 2016), and the available space immediately filled, and I'm back to the popups that space "disk space low."

 

 

best,

[paultpa]

I understand we should not reply to our own posts, but I'm not going to let this beat me.

 

I was poking around in the folders and files that are large.  I noticed that some of them were recently locked, like Recovery and MSOCache.  Just an FYI.  

[paultpa]

I ran another chkdsk/r.  Results below:

 

 

------< Log generate on 9/25/2018 12:16:27 PM >------

Category: 0

Computer Name: --PC

Event Code: 1001

Record Number: 268402

Source Name: Microsoft-Windows-Wininit

Time Written: 09-25-2018 @ 15:45:25

Event Type: Information

User: 

Message: 

 

Checking file system on C:

The type of the file system is NTFS.

Volume label is Gateway.

 

A disk check has been scheduled.

Windows will now check the disk.                         

 

CHKDSK is verifying files (stage 1 of 5)...

  391936 file records processed.                                         

 

File verification completed.

  18489 large file records processed.                                   

 

  0 bad file records processed.                                     

 

  0 EA records processed.                                           

 

  43 reparse records processed.                                      

 

CHKDSK is verifying indexes (stage 2 of 5)...

  460652 index entries processed.                                        

 

Index verification completed.

  0 unindexed files scanned.                                        

 

  0 unindexed files recovered.                                      

 

CHKDSK is verifying security descriptors (stage 3 of 5)...

  391936 file SDs/SIDs processed.                                        

 

Cleaning up 61 unused index entries from index $SII of file 0x9.

Cleaning up 61 unused index entries from index $SDH of file 0x9.

Cleaning up 61 unused security descriptors.

Security descriptor verification completed.

  34359 data files processed.                                           

 

CHKDSK is verifying Usn Journal...

  34330488 USN bytes processed.                                            

 

Usn Journal verification completed.

CHKDSK is verifying file data (stage 4 of 5)...

  391920 files processed.                                                

 

File data verification completed.

CHKDSK is verifying free space (stage 5 of 5)...

  20984 free clusters processed.                                        

 

Free space verification is complete.

CHKDSK discovered free space marked as allocated in the

master file table (MFT) bitmap.

Windows has made corrections to the file system.

 

 469407743 KB total disk space.

 468622628 KB in 271345 files.

    189764 KB in 34360 indexes.

         0 KB in bad sectors.

    511415 KB in use by the system.

     65536 KB occupied by the log file.

     83936 KB available on disk.

 

      4096 bytes in each allocation unit.

 117351935 total allocation units on disk.

     20984 allocation units available on disk.

 

Internal Info:

00 fb 05 00 33 aa 04 00 0b 9a 08 00 00 00 00 00  ....3...........

83 50 00 00 2b 00 00 00 00 00 00 00 00 00 00 00  .P..+...........

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

 

Windows has finished checking your disk.

Please wait while your computer restarts.

 

-----------------------------------------------------------------------

[paws]

Apologies for the delay in getting back to you .Unfortunately I didn't get the usual notification saying that you had replied ( the board software sometimes does that!)

 

The chkdsk /r output has corrected some more errors on your hard drive and should have freed up a little bit of extra space.( not much but anything is helpful)

However if your Windows folder is really 420Gb then there is something seriously wrong with your system

If that is the case then I would seriously consider using your Gateway reinstall discs or your System Image discs/Win 7 installation discs to completely rebuild your system.

 

(do make sure that your back ups and system images are all 100% reproducible and contain everything you need with at least one copy kept safe on removable media offsite.

 

If it was just a simple typo then let me know and I'll ask one of our Virus and Spyware removal specialists to take a look and see if running some of their specialist analysis and removal tools will be helpful.

Regards

paws

[terry1966]

paws, seems to me there is 385GB of logs "the 3rd largest is Logs, showing 91.6% or 385,4 GB, with 1654 items" so i think it may be a good idea to find out what is making those log files and then delete them all if you think it's safe, (can't think of a reason why it shouldn't be safe to delete old logs.).

then there should be more than enough space to download and run any programs you or juliet may require to make sure the system is clean of any malware.

Edited by terry1966, 30 September 2018 - 08:43 AM.