[DarenR]

actually combofix will remove any malware that is multiplying itself on the hard drive so his space will be cleared up. I know it is very powerful but sometimes you have to do what you have to do.


By the sounds of what he saying I am guessing that he is either downloaing items and not removing them from temp/dloads such as movies or music or he has bad sectors in his hd from a virus.

[no2pencil]

DarenR, on 20 April 2012 - 09:51 AM, said:

By the sounds of what he saying I am guessing that he is either downloaing items and not removing them from temp/dloads such as movies or music or he has bad sectors in his hd from a virus.

Of your diagnosis, malicious software is third on your list. Yet out of the gate you suggest the most technically advanced malicious software removal tool.

Lets take a deep breath, & wait for him to run ccleaner, & answer some questions that he has not yet done before he nukes something & can no longer boot.

Side note, I really really really doubt Combofix is going to assist him here. Proper troubleshooting is discovering the problem & fixing it. Not just throwing software at it until the problem goes away.

DarenR, on 20 April 2012 - 09:51 AM, said:

combofix will remove any malware that is multiplying itself on the hard drive so his space will be cleared up.

You seriously believe this is the problem? Viruses that use drive space by re-copying themselves have (to my knowledge) not been found in the wild since hard drives were measured by gigabytes. Malicious software is all about money. Todays targets are about redirecting traffic through hijacking the dns, forging search results, or data mining information.

[DarenR]

http://www.microsoft...n32%2FYeltminky

this worm is a form of malware that does just as you say doesnt exist.

[no2pencil]

I seriously doubt he has terabytes of space used by copies of a worm.

Also please re-read the entire diagnosis of the link you sent me :

Quote

Technical Information (Analysis)
Win32/Yeltminky is a family of worms that spreads by making copies of itself on all available drives and creating an autorun.inf file to execute that copy.

Installation

When executed the malware makes a copy of itself in one of the following locations:

%USERPROFILE%\<file name>.exe
%windir%\fonts\ < file name> .fon
It may also copy itself to a secondary location.

The file name used, and the secondary location it copies itself to, is supplied as part of configuration data stored in the malware file, for example:

%USERPROFILE%\auto.exe
%ProgramFiles%\common files\auto.exe
The malware also drops a DLL component to one of the following locations:

%USERPROFILE%\<random file name>.drv
%USERPROFILE%\<random file name>.fon
The file name is randomly generated and the file extension may vary, for example:

%USERPROFILE%\jmfxs.drv
%windir%\fonts\evngj.fon
The DLL component may then drop a driver component with a random name in one of the following locations:

%USERPROFILE%\<random file name>
%windir%\fonts\<random file name>.fon
Once the driver is loaded, the file is deleted.

The worm modifies the following registry entries to ensure that its copy executes at each Windows start:

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Sets value: "auto"
With data: "%ProgramFiles%\common files\auto.exe"

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Sets value: "SysAnti"
With data: "%ProgramFiles%\common files\sysanti.exe"

The malware can also contact a remote host to provide notification of a successful infection. The host URL is provided in the configuration data.

The copy destinations are targeted areas. The purpose is not to utilize 100% disk space.

[DarenR]

no2pencil, on 20 April 2012 - 10:04 AM, said:

I seriously doubt he has terabytes of space used by copies of a worm.

well we will never know until they tell us what they have tried or not have tried.....

OP is your computer turned on?

[Elihu5991]

Yes, the problem is drive space; ram seems fine. By clear, I mean move files to external hard drives (which I'm manually mirrored) or even delete unnecessary stuff. And yes, my Recycle Bin is fine.

Its about where do I start on what to try and not to try.
Yes, my computer is on ... if that's what you mean

This post has been edited by Elihu5991: 20 April 2012 - 08:22 PM

[blindstone]

use the cleanup program i have suggested, a possibility is turn down the system restore point space usage. Another thing, depending on certain stats on your system is turn down your page file (aka virtual memory usage) cause well if you have enough ram, it wont matter. And to be honest, whats a few quick virus scans going to do? Nothing but good really. suggestion is this and run them in order listed:

Run Full scan with MalwareBytes Free

Direct Link to file: TDSSKiller - for nasty downright rootkits

Combofix - be warned this is the ONLY link the writter of combofix has approved! the one mentioned earlier is NOT official and is NOT to be trusted... says so right in the program! Also disable your antivirus while running as it will conflict!

Afterwards and only if you know what you are doing: Hijackthis if you use hijackthis only remove things you are 100% clear about!

Once that is all done keep an eye on the disk space, if the issue is still there, let us know also keep an eye out for what programs are being installed along with updates etc.

Good Luck

[modi123_1]

If you are intensely curious, and I think you might be, open up your 'c' drive... click on the first folder.. check it's properties.. see how big it is.. if it's sufficiently larger than you expected open it up.. see what's inside. Narrow down where all your drive space is going and start investigating what programs hit that folder and why.