Missing disk space, space display error and paging file error

So after I got hacked and virus infected so much that comp went into Blue Screen of Death Boot cycle, I have missing disk space and safe mode doesn't work. And after managing to stabilize protect my computer and also get help here, I am finally clean and I was told to handle that problem in this forum.

Admin edit. malware forum thread: http://forums.whatthetech.com/index.php?showtopic=128904&hl=

To get into details, as I was using scanners to handle a new attack, when removed something like hundreds of MB would be released, but I am missing a few good GB, so a lot of stuff is locked away somehow or from stuff I couldn't get in time. I recovered the computer from the loop of BSOD boot by going into a boot option called Directory Saving Mode or something like that. In there I did scans, and set the computer to not boot in safe mode (which someone that helped me with my first BSOD loop foolishly setup). While in there I also figured I may need some space for some fixes so I deleted some files until I had 6,7 GB or so. But on restart back in normal mode like 3 GB were missing. And that was the biggest chunk I had missing at once, there were mostly just countless small sizes being stolen.

Apparently someone used my drive to keep files on it or whatever and I have cached icons that at least give a wrong display of disk size. Now, most of my disk space IS taken up, and when added up all critical folders are about as much space as I have on drive, but Program Data was too big and puts it above the disk space. In any case disk space is totally missing because it just vanished inbetween restarts and I never got to use it.

HD space on C is 151 GB, but Program Data is an extra 15 GB on top of that, and before I got help with infection it showed as being 180 GB <,<. All of that were Cached Icons in  Microsoft->Secure. I tried to delete some files a few days ago, and some did not show disk space being freed up, and when I used Tune Up Shredder on some of them space DID clear up but I think it was just fake because I got low memory type errors even when the display was something like 500 MB.

[external image: cached_icons.png]
image hosting free no registration

Also since with the infection I kept getting a paging file error on Windows startup which takes up disk space and always enough to really mess with a good percentage of whatever I have left. If I was at 300 MB it would be 100 or so, if I was at over 1 GB it would be 900 and so on. The error message is always the same and basically says:

"Windows created a temporary paging file on the computer, due to a problem when configuring the paging file at startup. The total size of the paging file for all disk units is larger than specified."

And I never messed with it, its the Windows default of 0 to 6000 MB but and shows the current paging file as being whatever size was in the error.

I think that's most of it. I of course ran chkdsk and sfc scan even as being infected but the last time I did that a few weeks ago it found no problems and that's about all the steps I took so far. I would really appreciate some help solving this problem so that I can finally use my computer for the stuff I need and not lose my stuff trying to get space.

It sounds like a partition problem to me. The best I can help,currently with your provided data (Not that I am authorized as a UNITE member) without the Farbar scan, is my recommended to run TFC.

Edit : Fixed link. There are two TFCs, one from bleepingcomputer (the good), and the another, adware "TFC".

Hi Nare,

I took a look at your logs over in the Virus and Spyware removal forum where Ken has provided his  most excellent assistance to you.

It's great that your computer has now been cleaned from the serious infections that Ken was able to identify and help you deal with.

However despite all the logs and the insight they provide into the inner workings of your computer, it is practically impossible at this stage, to identfy positively, the damage that has been done to your operating system's important files

The absence of an effective anti virus product and software firewall, for some period of time, before it was addressed, provided an "open gateway" so that it was relatively easy for malicious code to embed itself in your computer's system and then carry out its various tasks ( none of which were to you or your computer's advantage)

Peer to peer file sharing ( P2P use of torrents etc like for example Bit Comet) are renowned  as a vector for bad people to  propagate/distribute Viruses, Trojan Horses, Worms and other horrors. Once these have penetrated your computer they are capable of inviting in other malicious code, opening back doors into your computer, perhaps stealing passwords and log in credentials and damaging,destroying or corrupting the very files that your operating system needs, in order for it to work effectively and without the sort of problems you have been experiencing.

It is not common for us here on WTT to recommend that folks format their machines and reinstall their operating system….

However in your particular circumstances and bearing in mind the history and usage of this computer and the serious nature of the infections that were found, it will be  impossible to ever rely 100% on this computer again, until it has been "wiped" correctly and formated and  Windows and all other required applications installed.

Please bear in mind that this is a drastic step, but drastic situations call for drastic measures….. the wiping and format will clear away all your files, the operating system itself, your documents ,music, films…everything…..the good along side the bad….The reinstall of Windows 7 and your applications will ensure that all important files are in place, not damaged, and able to work correctly and as smoothly and effectively as possible

Make sure therefore that you are fully prepared for it and have all the installation discs you need, and have a note of all your Product serial keys (including that for Windows itself) your log on credentials, passwords etc.,and that you have identified as working correctly your back ups created before there was any risk of your machine becoming infected.

Windows 7 should be able to install a suitable driver to operate your Ethernet connection ( so you can get online…) but just in case for any reason it cannot, then make sure your back up includes a suitable driver for it….  

Once your computer has been dealt with correctly (and formatted and reinstalled) it's important that the anti virus and software firewall are installed/activated BEFORE you go online…. when you first go online again do not use email or surf the net until you have both updated your Win 7 with all the latest updates ( keep updating and rebooting until you receive two consecutive messages that no more updates are available) and your firewall and anti virus are fully operational and updated as necessary.

NOTE

only have one anti virus application running resident in memory…. if you have more than one there will be a potential  conflict, that will affect your computer's security (reduce it) and encourage slow downs and other non responsive behaviour

With your now clean machine working fast and sweet with everything running correctly and your hard drive relieved of the massive burden it was labouring under….( make sure now that your C drive or drive for your operating system…never has less than 25% free disc space)…You can now change all your passwords and log on credentials ….( the old ones well may be in the possession of the bad people…)   

When the machine is working well , with everything just as you like it take the opportunity to make a disc image, so in the unfortunate event of a software or operating system disaster at some time in the future you will be able to reimage and be up and recovered again in less time than it takes to walk the dog…

Win 7 has native tools for this, but Macrium Reflect free version has a good reputation and is available from here:

http://www.macrium.com/reflectfree.aspx    

Paid for applications are also available from Symantec, Acronis, Paragon etc and a host of other companies.

Once you have made a few disc images keep at least one safe offsite on removable media (together with a means of booting your computer in the event that Windows will not load, and test or validate that they all work!

Good luck and regards

paws

Yeah, I was worried that may have been the case as I have gotten the same answers before, but I just wanted my machine functional somewhat, for a while at least. And that's really where the problem is, because if reinstall was an option I would have done this longer ago and saved myself both the frustration and the time. More precisely, this is why I was so adamant about the disk size, to do reinstalls, but in any case, disk space is my issue because I currently have no way to backup all my data. And I am pretty obsessive about the stuff I have and a lot can not be regained very easily or at all (some being self-made), which is why I was looking for more technical solutions and advanced tools, albeit more complicated. Formatting is an even a bigger problem then, and not until I get backup space.

However all the help I got here I think buys me enough time to do that eventually (and hopefully), so for that I am really grateful guys. And I am not so sure how hopeless extra recovery is because in these Secure Program Data folders I found traces of stuff which seemed to have been used such as Partition Magic and Folder Lock and who knows what else I will find. There's always the chance whoever did this was pretty amateurish (I mean he was pirating stupid movies ffs). 

I understand the ultimate, best and inevitable solution is just clean reinstalls, and I was looking to do that not only since the problem started and I couldn't even boot Windows but if there were still serious risks that won't do for some of the sensitive stuff I need to work with. But yeah, it all revolves around disk space for me at the moment…

Honestly, I am just seriously considering using Linux at this point and not have to deal with any of this Microsoft BS anymore. =_=;…

Hi Nare,

Yes I understand…

However it's never a good move to have all your back ups on your hard drive….(as you know all  hard drives will eventually fail, some will fail early, whilst others will go on longer. But eventually… all will fail at some time….

Your existing hard drive is absolutely full, and must be  almost unworkable, as Windows  needs free space to operate effectively and create the temp files that it needs for its day to day workings. (25% free space should normally be sufficient……. whereas you have only around 1% or so)

It's your call what you do with your computer, but I would not be inclined to place much trust in any back ups created after your machine became so heavily infected….

A couple of external hard drives (USB) could be very useful in keeping copies locally of important files, and storage on the cloud is also a useful method of diversifying your copies so if one medium should fail then there is an element of redundancy available. (this does of course rely upon a reasonably fast Internet connection…….. if you have a slower connection then it's worth while working out in advance how long a few hundred gigs of data, would take to upload, at the upload speed you can achieve…. for many folks even tens of Gigs of data would seem to take forever to upload….

In addition if you decide to explore this route then consder the security of your data… who will have access to it….? also consider encryption ….. which countries will have control of the data? its services, hardware both real and virtual….? Consider the steps you need to take to assure youself that the cloud provider will continue to provide the service and not simply give up….( it has happened)

In addition to these steps there is something to be said just for keeping your existing hard drive  just with your data on it, as one of your back ups, buy a new hard drive and fit it to your computer and install a fresh copy of Windows 7 on it……

As long as you do not contaminate it from infected files…. you should find it to be a lot more reliable

Anyway good luck with your work and post back if you need anything.

Regards

paws

Sorry if I wasn't clear. By "backup" I meant just meant like the safe clear stuff that I actually care for like video collection, pics, documents and perhaps some game files/saves. Not stuff like software or libraries or whatever else is risky. External is where I was always going, but it will take some time before I get an external HDD, and DVDs are too cumbersome. That's why I needed my machine more functional until then.

Way ahead on that cloud thing, I searched it even beforehand, and 50 GB is pretty nice. My country has one of the best connections in the world, and uploads aren't really a problem. But yeah I am pretty cautions and wary of trusting clouds too much. Besides, 50 GB isn't nearly enough and I also like the way my stuff is organized, don't want to mess with that much.

For now I am just looking into the Linux thing, but I would really like to maybe figure out what the space problem is and fix it somewhat, to get Windows to work better, as you pointed it out. I can delete some useless junk but rather not before making sure it won't vanish again for no reason.

Overall Treesize says I have 154/151 GB taken up and Program Data is a decent 2,2 GB, so it all looks reasonable, now where else could the problem be. This is getting ridiculous as now I don't even have that initial 1 GB I did, this thing is still here and took me down to 5 MB <,<…But Windows all of a sudden is now 26,5 GB, so this thing grows. Is it just winsx really acting up like a bitch? But then where did a lot of my previous space vanish before?

SO do you have any kind of explanation on the mechanisms, methods, codes that might be used to cause disk vanishing? I would at least like to look things up myself, to get to know this stuff. Also I know that just using delete doesn't technically remove information from the disk itself, rather it just gets overwritten, hence why there are shredders. Maybe that caused some clogging back when I was in Directory Safe Mode? I mean 3 GB over disk size sounds just like what I lost that one time. Aren't there some tools for deep space exploration and clearing?

Other than that I plan to do a Linux Boot disk tomorrow just for safety. Now I know this is strange to ask in a Windows forum, but wouldn't Linux not be affected by a lot of that bad code and damage that I got in Windows, since it uses like different a programing language, libraries, coding or whatever? I will also try to boot to the DVD and maybe see if I get a better, error free view of the disk space.

So that's about it so far…I would really appreciate any kind of input here.

If you switch to Linux you still have the same problem. You need to backup your data first. Also very few games don't work with Linux.

Your long range plan should be to get a 1TB or larger external USB 3.0 SATA hard drive (seen them as low as $54 US) and a 1TB or larger drive ($50 to $70 US) to replace your current internal hard drive. Backup you data then clone your existing drive to the new 1TB or larger drive. Swap drive, boot and you should be up and running with space to spare.