April 26, 200521 yr Since about a month ago I've been getting little popups in the lower right hand corner that said I was low on space on my C drive. I'm running Windows XP, I have 512 RAM, and 80GB hard drive. Right now theres 25.5MB of space. About a week after this started happening I went out and bought McAfee 2005. It found several viruses (virii?), but it did not clean up the C drive. In order to install it, I had to uninstall several games though. Right now the only games I have on my computer are runescape and counterstrike. I uninstalled games such as Starcraft and Warcraft and within a day the space got filled up. One day I was looking through my WINDOWS folder and I found some weird files in a folder C:/WINDOWS/srchasst/chars. The files were weird and were named courtney, earl...etc.. There was only 3 in that folder, but I found some other files like them but I cannot recall where I found them. Anyone able to help me? I cannot even update McAfee since it needs 40MB to download. Just ask if you need anymore information. Thanks in advance.
April 26, 200521 yr Download Hijackthis and post a log here. It's only a very small download. Google for the link. I suspect a virus infection. Where the bloody hell are you?
April 26, 200521 yr Author Okay here it is: Logfile of HijackThis v1.99.1 Scan saved at 10:14:58 PM, on 4/25/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcvsrte[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE[Caution: ExecutableFile] C:\WINDOWS\System32\nvsvc32[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcshield[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\windows\system\hpsysdrv[Caution: ExecutableFile] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: ExecutableFile] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon[Caution: ExecutableFile] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05[Caution: ExecutableFile] C:\Program Files\QuickTime\qttask[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\vso\mcvsshld[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\agent\mcagent[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsescn[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray[Caution: ExecutableFile] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\Mp[bleep]ent[Caution: ExecutableFile] C:\Program Files\CallWave\IAM[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsftsn[Caution: ExecutableFile] C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] C:\WINDOWS\System32\wuauclt[Caution: ExecutableFile] C:\Program Files\MSN\MSNCoreFiles\msn6[Caution: ExecutableFile] C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile] C:\Program Files\AIM95\aim[Caution: ExecutableFile] C:\Program Files\hijackthis\HijackThis[Caution: ExecutableFile] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\windows\hp.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.search-space.com/ R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file) R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file) R3 - URLSearchHook: (no name) - _{A045DC85-FC44-45be-8A50-E4F9C62C9A84} - (no file) O1 - Hosts: 206.161.127.71 auto.search.msn.com O1 - Hosts: 206.161.127.71 sitefinder.verisign.com O1 - Hosts: 206.161.127.71 sitefinder-idn.verisign.com O1 - Hosts: 206.161.127.71 http://www.your.com O1 - Hosts: 206.161.127.71 your.com O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv[Caution: ExecutableFile] O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd[Caution: ExecutableFile] O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: ExecutableFile] O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon[Caution: ExecutableFile] O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray[Caution: ExecutableFile]" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD[Caution: ExecutableFile] O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32[Caution: ExecutableFile] C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz[Caution: ExecutableFile] /install O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2[Caution: ExecutableFile] O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05[Caution: ExecutableFile] O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr[Caution: ExecutableFile] O4 - HKLM\..\Run: [RunDLL] rundll32[Caution: ExecutableFile] "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32[Caution: ExecutableFile] C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32[Caution: ExecutableFile] "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain O4 - HKLM\..\Run: [otdoaugty] C:\WINDOWS\System32\oibsmo[Caution: ExecutableFile] O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR[Caution: ExecutableFile] O4 - HKLM\..\Run: [ynyn] C:\WINDOWS\ynyn[Caution: ExecutableFile] O4 - HKLM\..\Run: [Preview AdService] C:\Program Files\Preview AdService\PrevAdServ[Caution: ExecutableFile] O4 - HKLM\..\Run: [AutoLoadervF021bLSdPaa] "C:\WINDOWS\System32\usbbvm60[Caution: ExecutableFile]" /PC="CP.CDT3" /ShowLegalNote="nonbranded" /UninstallName="CtxPls" O4 - HKLM\..\Run: [vsrk3nW] usbbvm60[Caution: ExecutableFile] O4 - HKLM\..\Run: [zango] c:\program files\zango\zango[Caution: ExecutableFile] O4 - HKLM\..\Run: [rLDEHkj9F] C:\WINDOWS\awspqld[Caution: ExecutableFile] O4 - HKLM\..\Run: [ÃÆââ¬Å¡ÃâÃÂ¥gNÃÆââ¬Â¹Ã¢ââ¬Ã ÃÆÃââââ¬Ã¡:}KÃÆââââ¬Å¡Ã¬Ãâ¹ÃâÃÆââ¬Å¡Ãâæ~Pb]ÃÆââââ¬Å¡Ã¬ÃâæÃÆââ¬Å¡ÃâüÃÆââââ¬Å¡Ã¬ÃâáÃÆââââ¬Å¡Ã¬Ã¢ââ¬Ã
April 26, 200521 yr A Few questions for u.. 1) of ur 80 gig harddisk, is it partitioned? meaning splitted internally to become 2 drives? 2) did u delete all the temp internet files and cookies via internet explorer? 3) Open up window explorer, tools, folder options, under view and lastly advance setting, enable view all files and folders Once done, go to C drive; Documents and setting find the folder where there is a temp file holder.. delete everything inside. Once done restart your computer.. [/i]
April 26, 200521 yr The partition is what im thinking of. Do you have a D:/ drive as well as a C:/ or someting similar. You could really do with upgrading to SP2 as you are currently highly exploitable as your HJT shows Remove/fix the following [*]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\homepage.htm [*]R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp [*]R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://1-se.com/srchasst.html (obfuscated) [*]R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) [*]R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://1-se.com/home.html (obfuscated) [*]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.search-space.com/ [*]R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file) [*]R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file) [*]R3 - URLSearchHook: (no name) - _{A045DC85-FC44-45be-8A50-E4F9C62C9A84} - (no file) [*]O1 - Hosts: 206.161.127.71 auto.search.msn.com [*]O1 - Hosts: 206.161.127.71 sitefinder.verisign.com [*]O1 - Hosts: 206.161.127.71 sitefinder-idn.verisign.com [*]O1 - Hosts: 206.161.127.71 http://www.your.com [*]O1 - Hosts: 206.161.127.71 your.com [*]O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32[Caution: ExecutableFile] "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain [*]O4 - HKLM\..\Run: [otdoaugty] C:\WINDOWS\System32\oibsmo[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [ynyn] C:\WINDOWS\ynyn[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [Preview AdService] C:\Program Files\Preview AdService\PrevAdServ[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [AutoLoadervF021bLSdPaa] "C:\WINDOWS\System32\usbbvm60[Caution: ExecutableFile]" /PC="CP.CDT3" /ShowLegalNote="nonbranded" /UninstallName="CtxPls" [*]O4 - HKLM\..\Run: [vsrk3nW] usbbvm60[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [zango] c:\program files\zango\zango[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [rLDEHkj9F] C:\WINDOWS\awspqld[Caution: ExecutableFile] [*]O4 - HKLM\..\Run: [ÃÆââ¬Å¡ÃâÃÂ¥gNÃÆââ¬Â¹Ã¢ââ¬Ã ÃÆÃââââ¬Ã¡:}KÃÆââââ¬Å¡Ã¬Ãâ¹ÃâÃÆââ¬Å¡Ãâæ~Pb]ÃÆââââ¬Å¡Ã¬ÃâæÃÆââ¬Å¡ÃâüÃÆââââ¬Å¡Ã¬ÃâáÃÆââââ¬Å¡Ã¬Ã¢â∠Mercifull <3 Suzi "We don't want players to be able to buy their way to success in RuneScape. If we let players start doing this, it devalues RuneScape for others. We feel your status in real-life shouldn't affect your ability to be successful in RuneScape" Jagex 01/04/01 - 02/03/12
April 26, 200521 yr Author 1. Yes, the C drive is about 70 gig, D is like 6 gig 2. Yes 3. I couldn't find a temp folder inside documents and settings I removed what you said and it freed up about 25 MB...anything else I can remove? lol I'm not even sure if I can download the service pack
April 26, 200521 yr If you genuinely have no space left on your hardrive, you might want to start backing up and deleting some files*. * Files being anything that you have downloaded or made, NOT system files. Remember if you don't know what it is, it probably shouldn't be deleted.
April 26, 200521 yr Author Found the Temp folder, theres a lot of folders and files...you sure I delete them all? Heres an updated HJT log to see if I can remove anything else. Logfile of HijackThis v1.99.1 Scan saved at 7:14:48 AM, on 4/26/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcvsrte[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE[Caution: ExecutableFile] C:\WINDOWS\System32\nvsvc32[Caution: ExecutableFile] c:\PROGRA~1\mcafee.com\vso\mcshield[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\windows\system\hpsysdrv[Caution: ExecutableFile] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: ExecutableFile] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon[Caution: ExecutableFile] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05[Caution: ExecutableFile] C:\Program Files\QuickTime\qttask[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\vso\mcvsshld[Caution: ExecutableFile] C:\PROGRA~1\mcafee.com\agent\mcagent[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray[Caution: ExecutableFile] C:\Program Files\AIM95\aim[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsescn[Caution: ExecutableFile] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf[Caution: ExecutableFile] C:\PROGRA~1\McAfee.com\PERSON~1\Mp[bleep]ent[Caution: ExecutableFile] C:\WINDOWS\System32\wuauclt[Caution: ExecutableFile] C:\Program Files\CallWave\IAM[Caution: ExecutableFile] c:\progra~1\mcafee.com\vso\mcvsftsn[Caution: ExecutableFile] C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile] C:\Program Files\MSN\MSNCoreFiles\msn6[Caution: ExecutableFile] C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile] C:\Utopia\Angel\Angel[Caution: ExecutableFile] C:\Program Files\hijackthis\HijackThis[Caution: ExecutableFile] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\windows\hp.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv[Caution: ExecutableFile] O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd[Caution: ExecutableFile] O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd[Caution: ExecutableFile] O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon[Caution: ExecutableFile] O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray[Caution: ExecutableFile]" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD[Caution: ExecutableFile] O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32[Caution: ExecutableFile] C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz[Caution: ExecutableFile] /install O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2[Caution: ExecutableFile] O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05[Caution: ExecutableFile] O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Windows Shell Library Loader] load shell32.dll /c /set O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr[Caution: ExecutableFile] O4 - HKLM\..\Run: [RunDLL] rundll32[Caution: ExecutableFile] "C:\WINDOWS\System32\bridge.dll",Load O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32[Caution: ExecutableFile] C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr[Caution: ExecutableFile]" /checktask O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld[Caution: ExecutableFile]" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent[Caution: ExecutableFile] O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate[Caution: ExecutableFile] O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray[Caution: ExecutableFile] O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim[Caution: ExecutableFile] -cnetwait.odl O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM[Caution: ExecutableFile] O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim[Caution: ExecutableFile] O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS[Caution: ExecutableFile] O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS[Caution: ExecutableFile] O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: Video Poker - http://download.games.yahoo.com/games/c ... vpt0_x.cab O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/c ... /jt0_x.cab O16 - DPF: Yahoo! Bridge - http://download.games.yahoo.com/games/c ... /bt1_x.cab O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/c ... /yt1_x.cab O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/c ... /ct1_x.cab O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/c ... /ht1_x.cab O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/games/c ... /tt3_x.cab O16 - DPF: Yahoo! Pinochle - http://download.games.yahoo.com/games/c ... /ut2_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/c ... /pt1_x.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/c ... pote_x.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/[garden tool] ... scan60.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - ]http://a1540.g.akamai.net/7/1540/52/200 ... taller[Caution: ExecutableFile] O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab O16 - DPF: {7EBA6D58-EB2D-46F4-A363-10C4DF50B907} (SCORMAPIDLL.API) - http://hls.gemedicalsystems.com/thealp/SCORMAPIDLL.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1F56C48F-530B-41D5-8AFF-E851F8AADB96}: NameServer = 198.6.1.218 198.6.100.218 O17 - HKLM\System\CS1\Services\Tcpip\..\{1F56C48F-530B-41D5-8AFF-E851F8AADB96}: NameServer = 198.6.1.218 198.6.100.218 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield[Caution: ExecutableFile] O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr[Caution: ExecutableFile]) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr[Caution: ExecutableFile] O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte[Caution: ExecutableFile] O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE[Caution: ExecutableFile] O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32[Caution: ExecutableFile]
April 26, 200521 yr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\windows\hp.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://1-se.com/home.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://1-se.com/srchasst.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://1-se.com/home.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://1-se.com/srchasst.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://1-se.com/srchasst.html (obfuscated) Remove those please, you didnt remove them last time. Uninstall any unneeded programs and games. Backup the files you dont need anymore onto CD. 70 gig is a lot and im sure you havnt got that filled up with neccesity files. Empty recycle bin. Empty Temp folder and Empty Temp internet files. See how much space that improves? Mercifull <3 Suzi "We don't want players to be able to buy their way to success in RuneScape. If we let players start doing this, it devalues RuneScape for others. We feel your status in real-life shouldn't affect your ability to be successful in RuneScape" Jagex 01/04/01 - 02/03/12
April 26, 200521 yr Remove those please, you didnt remove them last time. Or something keeps putting them back? In which case, the original poster should: 0. UPDATE WINDOWS! 1. Update his antivirus program. 2. Do a full system scan (and remove any crap it finds). 3. Get Spybot and Ad-Aware SE 4. Update both. 5. Scan with both (and remove any crap they find). Hrm. After rereading everything in this thread, I think the above can only be done if you have some more space (yay for that). First, do what Mercifull suggested. Next, download Sequioaview. this program can be used to create a graph of your disk usage, which shows which folders / subfolder use a large amount of space. Maybe this can help you to find out what uses a lot of space :)
April 26, 200521 yr do you have music saved on your computer? This happend on my old computer i had alot of music on it which made my HD fill up. If you have music you can copy them to blank cd's (im guessing you have a cd burner) and then delete them from your computer. Like someone else said 70gb is alot of space, there must be something like a virus i suspect. Currently I'm using only 20gb of my HD. :)
April 26, 200521 yr Author Lol 6609 files in Temp...This is probably what was taking up all the space.
April 26, 200521 yr lol, windows update = crashed computer =-( any way, why hasn't any one pointed out this nice FREE, and very good online tool? It's caught stuff Nortan (mite as well rename "Useless Antivirus", regardless what Mercifull says), adaware, and spybot missed http://housecall.trendmicro.com/ please note they may or may not have have their beta scumware scanner online. ********** One of the old guard of RS. RS birthday = Feb - 27 - 2002 Proud member of the original forum.**********
April 26, 200521 yr Author I used to use trendmicro before I went out and bought McAfee. It caught a lot of stuff. Anyways, I do have ad-aware and spybot, they usually don't catch many things on my comp. Well, I went and deleted everything in my Temp and Temporary internet folders. It freed up like 250 MB...I now have 290MB free on the C drive...(yay?) I'm updated McAfee right now and I'll do a full system scan tonight.
April 27, 200521 yr lol, windows update = crashed computer =-( Windows update does not crash a computer. When sp2 was first released it did have some bugs, but there all fixed (or most of them). The piont is it is critical that you update windows with sp2 and all critical updates. Your computer is in danger if you don't. I am still interested in how almost 70gb of space on your HD is used :? . Someone else said this but make sure all your scanning tools are updated before you scan.
April 27, 200521 yr Author Well I just did a full system scan with McAfee and it found nothing :roll: I'm going to try the sequoiaview or whatever. Do I just google it?
April 27, 200521 yr Author Okay I did SequioaView and it looks like ~55 GB are being taken up by a bunch of files in C:\Program Files\MSN\MSNCoreFiles.PROMO.{Some string of numbers and letters here}\BITABC.tmp There are several files that look like that with ABC being some random number. Each file is like 75 MB too. Any ideas?
April 27, 200521 yr I know nothing about msn but it seems very odd. I would try uninstalling msn and then reinstall it. Before you unstall it make sure you have the installation cd. :lol: I have msn from my ISP but don't use. On my computer it only takes around 700mb.
April 27, 200521 yr Author Yeah it's weird. When I look in the MSN folder All I see is an MSN 8 icon and no other folders/files.
April 27, 200521 yr okay, uninstall MSN, and if that doesn't help, simply remove the directory. It sounds fishy to me :?
April 27, 200521 yr additionally, there is a folder called System Volume Informationin the root folder of your C:\ drive. This contains all of the restore points for your computer and can get VERY VERY large (I have seen some in excess of 15 GB). IT is hidden so, if you cant see it you need to go to the tools menu > folder options > view tab > select the "view all filles and folders" redio button , uncheck the "hide protected operating system files (recommended)" box and uncheck the "use simple file sharing(recommended)" box. Next, go back to the root folder in wondows explorer, right click on the system volume information folder and select "sharing and security". In the window that pops up, select the "security" tab and add your user name to the permissions list with full control permissions. Click ok. Now, open up the folder and delete as much as possible from the folder. Usually it will not allow you to delete everything, but if you select all > delete, when the error message pops up the first file in the list is the one it will not delete. Skip that one and continue, until you have as much deleted from the folder as possible. This can be a huge hog of space on your HDD.
April 27, 200521 yr also try doing a disc clean up, it will compact unused files, delete temporary files, and you can also delete all but the most recent of restore point as well as a bunch of other junk :wink: ...
April 28, 200521 yr additionally, there is a folder called System Volume Informationin the root folder of your C:\ drive. This contains all of the restore points for your computer and can get VERY VERY large (I have seen some in excess of 15 GB). IT is hidden so, if you cant see it you need to go to the tools menu > folder options > view tab > select the "view all filles and folders" redio button , uncheck the "hide protected operating system files (recommended)" box and uncheck the "use simple file sharing(recommended)" box. Next, go back to the root folder in wondows explorer, right click on the system volume information folder and select "sharing and security". In the window that pops up, select the "security" tab and add your user name to the permissions list with full control permissions. Click ok. Now, open up the folder and delete as much as possible from the folder. Usually it will not allow you to delete everything, but if you select all > delete, when the error message pops up the first file in the list is the one it will not delete. Skip that one and continue, until you have as much deleted from the folder as possible. This can be a huge hog of space on your HDD. I would not reccommend this. If you want to clear up your system restore files then simply turn system restore off, restart your computer, then turn it back on. You can turn off system restore from the system properties of the control panel.
April 28, 200521 yr additionally, there is a folder called System Volume Informationin the root folder of your C:\ drive. This contains all of the restore points for your computer and can get VERY VERY large (I have seen some in excess of 15 GB). IT is hidden so, if you cant see it you need to go to the tools menu > folder options > view tab > select the "view all filles and folders" redio button , uncheck the "hide protected operating system files (recommended)" box and uncheck the "use simple file sharing(recommended)" box. Next, go back to the root folder in wondows explorer, right click on the system volume information folder and select "sharing and security". In the window that pops up, select the "security" tab and add your user name to the permissions list with full control permissions. Click ok. Now, open up the folder and delete as much as possible from the folder. Usually it will not allow you to delete everything, but if you select all > delete, when the error message pops up the first file in the list is the one it will not delete. Skip that one and continue, until you have as much deleted from the folder as possible. This can be a huge hog of space on your HDD. I would not reccommend this. If you want to clear up your system restore files then simply turn system restore off, restart your computer, then turn it back on. You can turn off system restore from the system properties of the control panel.' Or you can use disc cleanup to delete all of the old system restore points accept for the most recently known working one ...
April 28, 200521 yr additionally, there is a folder called System Volume Informationin the root folder of your C:\ drive. This contains all of the restore points for your computer and can get VERY VERY large (I have seen some in excess of 15 GB). IT is hidden so, if you cant see it you need to go to the tools menu > folder options > view tab > select the "view all filles and folders" redio button , uncheck the "hide protected operating system files (recommended)" box and uncheck the "use simple file sharing(recommended)" box. Next, go back to the root folder in wondows explorer, right click on the system volume information folder and select "sharing and security". In the window that pops up, select the "security" tab and add your user name to the permissions list with full control permissions. Click ok. Now, open up the folder and delete as much as possible from the folder. Usually it will not allow you to delete everything, but if you select all > delete, when the error message pops up the first file in the list is the one it will not delete. Skip that one and continue, until you have as much deleted from the folder as possible. This can be a huge hog of space on your HDD. I would not reccommend this. If you want to clear up your system restore files then simply turn system restore off, restart your computer, then turn it back on. You can turn off system restore from the system properties of the control panel. Wow I did not know this :) :) Thanks for sharing that, I can clear up nearly a gig of memory on my laptop (it is much needed, until I buy some more memory) Er, is it COMPLETELY safe to delete those files? I mean, if my laptop crashes will I lose everything after I delete the Sys Volume Information, or will it be fine? I dont want to lose anything on this laptop, some valuable school projects, pictures, files etc I need on here, but I need the space, so can I delete the files in this System Volume Information folder SAFELY, without risk of losing files?
Create an account or sign in to comment