Hard Disc space is reducing mysteriously

[PeterPotus]

Hi Juliet
I have run Window Repair twice as per their recommendation.

It has changed since your instructions for it by a couple of versions at least.

I have only had control back for a while and the first thing I tried to do was Create a restore point and do a disc clean-up. The system would not do either of these actions. The disc clean-up just hangs and I have to use Task Manager to close it.

I have lost another 11.5 Gb since booting up this morning and have only 12.8 Gb left.

I have to confess that I thought you were referring to the "Pro" edition so I bought it and discovered that it is only a bit different to the Free edition. The "Pro" edition has a number of extra repair options which I unchecked beforehand. I did however tick the two "Pro" features:-
1 Run Custom Scripts After repairs.
2 Apply System tweaks after repairs.
I don't know if this was a mistake.

Another feature of the "Pro" edition is an improved Disc Clean Up function

Just what I need but it does not work and I suspect it is causing the original windows item to malfunction.

I have not regained the Print Screen function.

Enough for today. I will try again tomorrow.

I will send a copy of this message to Tweaking.com (Key No. 3466019221)

Regards

Peter

[Juliet]

My opinion is we're not dealing with malware but rather a full system.
Not sure that makes sense and, I may not have described that correctly but, we're about at the end of what we can do for searching for malware.

https://support.microsoft.com/en-us/kb/2598438
Please read over the above article that might shed some light and give a couple of options to free up space.


~~~~~
If there are any personal files, pics, etc. on your computer you cannot live without, back them up now just as a precaution.
Emergency Backup Procedure - Tech Support Forum

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

How to use ComboFix

Download ComboFix from here:
Link 1
Link 2
Link 3

Place ComboFix.exe on your Desktop <--Important

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
  
  You can get help on disabling your protection programs here
• Double click on ComboFix.exe & follow the prompts.
• You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)
• Your desktop may go blank. This is normal. It will return when ComboFix is done. Combofix may need to reboot your computer more than once to do its job this is normal.
• When finished, it shall produce a log for you. Post that log in your next reply
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  
  Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer
  
  ---------------------------------------------------------------------------------------------
• Ensure your AntiVirus and AntiSpyware applications are re-enabled.
  
  Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
  Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.
  ---------------------------------------------------------------------------------------------
• If there are Internet issues after running ComboFix:
  Internet Explorer:
  Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" and check to "Automatically detect settings". Also clear any proxy address and port. ok, apply (only if applicable), ok.
  Firefox:
  Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection. "No Proxy" should be selected, unless you have one set up yourself.
  Chrome:
  Select -> Tools menu -> then "Options", then go to "Change Proxy Settings", then "LAN Settings" , then take out the check mark for "Use a proxy server for your LAN" if set, unless you set this up yourself.
  Safari
  Launch Safari
  Go to general settings menu
  Then in Preferences/ Advanced
  Then on line click Proxies change settings ...
  Click Internet Options, then click the Connections tab, click Network Settings.
  Disable option (uncheck) for the use of proxy server ...
  

[PeterPotus]

Hi Juliet

I can't see how it could be a full system when I could easily cleanup 35 Gb of free space. Losing about 10 Gb of that space a day tells me it is a resident problem.

I have not heard back from Shane at Tweaking.com as he has weekends off.

In the meantime I will have to mostly leave the computer shutdown.

Regards

Peter

[Juliet]

Did you run the last scan?

You could be very right. It could very well be a resident tool or software that causes this but, which one, I haven't found.

[PeterPotus]

Hi Juliet

I was waiting for a reply from Tweaking.com forum but no help so far.

Attached are several logs and in ComboFix the log refers to drivers "SWISSARMY" AND "MPKSL4511C4C3".

I put those through FRST with the following result MBAMSWISSARMY => Error: No automatic fix found for this entry.
MPKSL4511C4C3 => Error: No automatic fix found for this entry.

Not sure if that is good or not (Swiss Army looked suspicious to me.).

I am desperate to get back the abilities to create a restore point and do a Disc Clean-up. I have only 11.80 Gb of free space left. I can't work around the original problem if I can't get these two back.

Regards

Peter

[Juliet]

Attached are several logs and in ComboFix the log refers to drivers "SWISSARMY" AND "MPKSL4511C4C3".

I put those through FRST with the following result MBAMSWISSARMY => Error: No automatic fix found for this entry.
MPKSL4511C4C3 => Error: No automatic fix found for this entry.

Not sure if that is good or not (Swiss Army looked suspicious to me.).

MBAMSwissArmy.sys
is a normal and legitimate file for MBAM (Malwarebytes' Anti-Malware)

c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{651A3338-2AC0-432D-A9B8-9E036FACC3F4}\MpKsl4511c4c3.sys
Is a legit folder related to Microsoft Security Essentials
You do not want to delete those folders/files.


AVS Registry Cleaner is registry cleaner/fixer utility whose purported purpose is to remove redundant items from the Windows registry.
RiskWare 61% remove it

Please take a moment to read about the dangers of using registry cleaners.
We DO NOT recommend the use of registry cleaners/optimizers for several reasons:

• Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.
  
  The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
• Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
  Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
• Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
• The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".
  
  Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.
  
• Ed Bott's Webog: Why I don't use registry cleaners
• Do I need a Registry Cleaner?

For this reason I recommend you uninstall AVS Registry Cleaner.


FixCamera.exe is also found in your start up folder.
MSConfigStartUp-FixCamera - c:\windows\FixCamera.exe

Did you follow these instructions to use Disk clean up?
http://windows.microsoft.com/en-us/w...=windows-vista

[PeterPotus]

2 Hours ago I had only 11.8 Gb of free space. I then did 2 things.

Attempted to run FRST to again get rid of FixCamera.exe but it stalled on trying to create a restore point.
Ran the basic Disc Cleanup routine (The primary option which does not require a restore point).

A while later I went back to "Computer" and saw the magic change to available space. Incidentally I was trying to download a picture of my Disc Cleanup "More Options" page from my camera when I went to "Computer" as my camera was not logging in. My version of Windows/Disc Cleanup refers specifically to certain versions of Vista holding backup information from earlier restore points. I have been creating a new restore point and clearing all the stuff before it. It has worked like a charm until Windows Repair changed it.

Your comments about AVS Registry cleaner are noted and I will uninstall it. But I have been using it for a couple of years without problems. It is currently unusable anyway as it needs to create a Restore Point first up.

From my position running Windows repair has caused more problems immediately than anything else.

On message 14 I sent you the Fixlog showing FRST had removed FixCamera.exe.

If the ComboFix log did not show anything "bad" I guess we have explored all avenues.

Thanks for doing your best.

Regards

Peter

[Juliet]

I'm sorry, I read the log wrong. ComboFix did take it out.

- - ORPHANS REMOVED - -
MSConfigStartUp-FixCamera - c:\windows\FixCamera.exe

~~~~~~~~~~~~~`
For restore points.
It's possible Windows Repair changed or reset settings back to default.

Type services.msc in the start search box. Click on the 'gear' icon.

Once the window has opened up, scroll down to
Volume Shadow Copy service

Is it set to automatic? If it isn't, then set it, reboot and see if you can make a new restore point.

~~~
Try the above and let me know how that works out.

[PeterPotus]

Yes I did that and changed it from Manuel to Auto.
But when I click on System/System Protection, it cannot find the last Restore Point and the Button to create a Restore Pointed is "Faded".

Regards

Peter

[Juliet]

Peter

From here I need to ask you to register at this forum for tech support
http://forums.whatthetech.com/index.php?showforum=119

Members here work on these types of issues and are highly regarded tech experts.

I don't think the problems now are malware but rather hardware or operating system error that I have no expertise in.

We need to remove tools and quarantine folders.

DelFix

• Please download DelFix or from Here and save the file to your Desktop.
  
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  
• Remove disinfection tools
• Reset system settings
  
  
• Click the Run button.
• -- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).