my c drive free space keeps going down Solved/Closed

Question

Hello, 

please i need help :(

my c drive size keeps going down fast 
even without downloading or putting anything on the drive 
i think it a virus 
+ 
i checked and it is not  because i have restore point 

so it nothing on the drive i think it a virus 
please i need every help i can get :( 



Configuration: Windows 7 / Firefox 10.0.11

Ambucias · Answer

To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a system log. 

1. Open this link and download ZHPDiag2 : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html 

(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message. Once installed, click on the "hardhat" icon, it allows to change the language.)

2. Save the file on your Desktop. 

3. Double click on ZHPDiag.exe and follow the installation instructions. 

the tool creates three icons ZHPDiag, MRB, and ZHPFix (If necessary,we will use ZHPFix at the next step). 

4. Double click on the short cut ZHPDiag on your Destktop. 

5. Click on the screwdriver icon and ensure all of the items are checked.

6. Click on the Magnifying glass and run the analysys. 

Wait for the tool to finished (maybe a long time) 

7. Close ZHPDiag. 

8. To transmit the report, click on this link : 

https://authentification.site 

9. Click on Parcourir and search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt). 

10. Select the file ZHPDiag.txt. 

11. Click on "upload » 

12. Copy the url and post it here.

Best regards

Ambucias
Moderator /Security Contributor

sarah rock & roll · Answer

iam afraid i tried this software before but it didn't work 
while scanning it stopped with a message "" module : 047 in overflow (999). please contact nicolas coolman "
don't really know what it means but it refused to resume 

anyway thanks for trying to help :)

Ambucias · Answer

Have you tried it from the link I gave you ?  I don't think so !

Also, before you run it, try disabling your firewall.

Ambucias · Answer

Please, did you download ZHP Diag version I recommended or did you use the one you had ?  You must use the link I gave in this thread and click on "téléchargez" to download.

Ambucias · Answer

What next.  Did you get it downloaded ?  What version is it ?

Ambucias · Answer

Did you install it and launched, clicked on the magnifying glass it after disabling your firewall ?

Is the software in French ?  You can change the language to English if you wish with the configuration tool.

sarah rock & roll · Answer

yes i did all of that  closed my firewall started the scan but still it refused to resume :(
it is in English 
the message was " module: 047 in overflow (999) please contact nicolas coolman"

Ambucias · Answer

Okay

Please be patient.  Nicolas Coolman is presently in Europe.  I will contact him now and I will get back to you.

In the meantime, just looking at the HJT log, it looks as if you have adware and possibly a Trojan Horse.  I can't be 100% sure as HJT is a minimal report.

1. Please download and run the following tool:

https://toolslib.net

2. Download, install and run Malwarebyte which you can find on this site: 

https://ccm.net/downloads/security-and-maintenance/4621-malwarebytes-anti-malware/ es-anti-malware 

Ensure you make an update.

Boot your computer in safemode

Please request a FULL system scan, which may take from 20 minutes to hours.  Do not interfere no matter how long in takes.  The creators of Malwarebyte recommend that while the tool is running that you go do something else, such as watching a rerun of Gone with the Wind or read Tolstoy's War and Peace.

If Malwarebyte restarts your system, launch it again to finish the Full scan. 

When the scan is completed, delete all items found.

3. Tell me if your machine is running better.

Take care untill tomorrow as I must attend to my family.

Ambucias · Answer

Hi

The ZHP Diag overflow error has been fixed.

Please go to this site for download:

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Click on ftp://zebulon.fr/no1

Ambucias · Answer

You mean that you got the overflow error again ?

Ambucias · Answer

Okay,

I looked at your HJT log again, there are some indications that your system is infected by a Trojan Horse which may Hyjack your system.

There are also some spyware tool bars.

Unfortunately, I can't prescribe the specific method or remedy because I cannot identify the virus as ZHP would have permitted me to do.

I have one alternative and that is the following tool which is to be used only once and removed from your computer:

To keep your system safe, you must follow the instructions hereunder to the letter: 

1. Download Combofix to your desktop. 

https://www.bleepingcomputer.com/download/combofix/

(click on the download @ bleeping computer button) 

2.Close all open Windows including this one. 

Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix. 

3. Double click on the ComboFix icon. 

Windows is issuing this prompt because ComboFix does not have a digital signature. This is perfectly normal and safe and you can click on the Run button to continue. 

4. Accept the disclaimer and the recovery 

5.You should now press the Yes button to continue. If at any time during the Recovery Console installation you receive a message stating that it failed to install, please allow ComboFix to continue with the scan of your computer. 

ComboFix will disconnect your computer from the Internet, so do not be surprised or concerned if you receive any warnings stating that you are no longer on the Internet. When ComboFix has finished it will automatically restore your Internet connection. 

While the program is scanning your computer, it will change your clock format, so do not be concerned when you see this happen. When ComboFix is finished it will restore your clock settings to their previous settings. 

If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt. 

During the process, please do not mouse click nor must you tap on the keyboard. Let the tool run. 

Good luck

Ambucias · Answer

Hi,

Looks like could not delete everything it wanted to delete.

The creator of ZHP Diag told me today that the 047 overflow error is due to the numbers of items.

This time, please open ZHP Diag, click on the Eyedropper (options) click on check all but uncheck Export key (047).

Click on the magnifying glass to generate a report.

Upload the report on Speedyshare and post the url here.

Regards

Ambucias · Answer

Please wait for my analysis and instructions

Ambucias · Answer

Hi Sarah

Thank you the ZHP Diag log which is much more detailed.

I have identified the cause of problem, there is a virus at your memory and a few other malware as well, such as Rogue Trojan Horse. The source of the infections comes from applications that you have downloaded and installed and mostly from using UTorrent, Bit Torrent, Peer2Peer.

The worst and the most dangerous malware are the applications for which did not have a license, cracks and key generator.

In order to be able to desinfect your machine, the cracked applications must be removed otherwise the very same viruses will return in an eternal loop.

Also, because I am a Kioskea Moderator and Security Contributor, I must uphold Kioskea's Charter and we can't help members who have illegal software.

However, I am willing to help you, if you delete the illegal software.

Please delete the following software as well as the ZHP Diag log.  Once you have delete, produce another ZHP Diag log for me to verify that the software has been removed and upload it on Speedyshare.

C:\Documents and Settings\NEW LAP\AppData\Local\Opera\Opera\icons\crackedsoftwarespot.blogspot.com.idx    

C:\Documents and Settings\NEW LAP\AppData\Roaming\uTorrent\Sony Vegas Pro 10 Keygen.rar.torrent    

C:\Documents and Settings\NEW LAP\Downloads\Sony Vegas Pro 10 Keygen\Sony Vegas Pro 10 Keygen\Keygen.exe    

C:\Users\NEW LAP\AppData\Roaming\uTorrent\Sony Vegas Pro 10 Keygen.rar.torrent    

C:\Users\NEW LAP\Downloads\Sony Vegas Pro 10 Keygen\Sony Vegas Pro 10 Keygen\Keygen.exe    

D:\run\Music&Video\DFX.Audio.Enhancer.v9.012.Winamp.Incl.CORE-Keygen_yallarab.com\íáÇÚÜÜÜÜÑÈ áÜÜßÜÜá ÇáÜÜÚÜÜÜÑÈ.url    

C:\Documents and Settings\NEW LAP\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fcrackedsoftwarespot.blogspot.com%2Ffavicon.png    

C:\Documents and Settings\NEW LAP\Downloads\Sony Vegas Pro 10 Keygen\Sony Vegas Pro 10 Keygen\Keygen.exe    

D:\Programmes\DFX Audio Enhancer v9.211 Plus\CORE\keygen iDFX.exe    

D:\Programmes\Sobolsoft.USB.Flash.Drive.Data.Recovery.Software.v7.1.Incl.Keygen-UNiQUE.rar    

D:\Programmes\Sobolsoft.USB.Flash.Drive.Data.Recovery.Software.v7.1.Incl.Keygen-UNiQUE_2.rar    

D:\Programmes\sony vegas\Sony Vegas Pro 10 Keygen.rar    

 D:\run\Music&Video\DFX.Audio.Enhancer.v9.012.Winamp.Incl.CORE-Keygen_yallarab.com\60154068qx7.JPG    

D:\run\Music&Video\DFX.Audio.Enhancer.v9.012.Winamp.Incl.CORE-Keygen_yallarab.com\CR-DX7WP.reg    

D:\run\Music&Video\DFX.Audio.Enhancer.v9.012.Winamp.Incl.CORE-Keygen_yallarab.com\CR-DX7WP.reg    

You must also ensure that the following applications are removed:

Sony Vegas Pro 10 
Sobolsoft.USB.Flash.Drive.Data.Recovery.Software.v7
DFX.Audio.Enhancer.v9.012.

Once all of the above are removed from your computer, we shall be able to proceed with the virus clean-up.

Regards

Ambucias · Answer

Sony Vegas is both a crack and virused.

Remove the above, upload another log. we will take care of the rest later.

Regards

P.S. Most cracks come with a virus and that's how most viruses are transmitted by those who wish to contaminate other people's machines. Peer to peer softwares (torrents) are hyjackers' nest)

Ambucias · Answer

Thanks

I will try to analyse the results today but I can't promiss anything, it's 17:07 here.

The only thing that I found somewhat safe on Torrents are MP3 if the source is ISO. Most programmes and applications (cracked or not) are extremely risky.  Yet, if you keep a peer to peer application open, you expose yourself to pirates.  One needs the best performing antivirus software and firewall.  If I'm correct, you have Avast and I would say that your system is vulnerable to attacks.  There are plenty of mean people out there just thinking of inventing a new way to infect, just as a challenge.  They have nothing else better to do.

Catch you later

Ambucias · Answer

Okay, here we go. (Your English is very good, what are you doing in Egypt ?)

I may send you several messages so as to not confuse you in the scrolling.

You have a rogue virus Trojan Horse which is self protective, thus it will prevent any antivirus from fonctionning. 

You must kill the evil processes which the virus is presently running amd preventing you from running any antivirus. If you don't it will keep reproducing the files for ever. 

To kill the processes: 

1. Download to your desktop and run Rogue Kill: 

https://download.bleepingcomputer.com/grinler/rkill.com 

2. You should now see a window that shows all of your desktop icons, including the rkill.com program. 

3. Double-click on the rkill.com in order to automatically attempt to stop any processes associated with the Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. 

If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by the Horse when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate the processes . So, please try running Rkill until malware is no longer running. 

As a matter of a fact, if you get messages, it is a sign that the virus is agonizing with excrutiating pain, so you can just grin while it is suffering!:)))

Please, DO NOT REBOOT your computer or the processes will come back to haunt you! 

See my next message...

Ambucias · Answer

ZHP Diag has created an icon called ZHP Fix

1. Open ZHP Fix

2. Copy the following lines

[MD5.2960400094498DAE47B36173286D76A0] - (.Unknown owner - Updater.) -- C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe   [348160] [PID.2288]    => Infection LOP
O4 - HKLM\..\Run: [AutoRunExterminator] C:\Users\NEW LAP\AppData\Local\Temp\Rar$EX00.740\AutoRunExterminator.exe (.not file.)    => Infection Rogue (Trojan.FakeAlert)
O4 - Global Startup: C:\Users\NEW LAP\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk . (...)  -- C:\Users\NEW LAP\AppData\Roaming\Desktopicon\eBayShortcuts.exe (.not file.)    =>  (Adware.ADON)
[MD5.00000000000000000000000000000000] [APT] [Funmoods] (...) -- C:\Users\NEW LAP\AppData\Roaming\Funmoods\UPDATE~1\UPDATE~1.exe (.not file.)    => Infection PUP (PUP.Funmoods)
[MD5.2960400094498DAE47B36173286D76A0] [APT] [schedule!1143840799] (...) -- C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe    => Infection LOP
[HKCU\Software\1ClickDownload]    => Infection BT (Adware.1ClickDownloader)
[HKCU\Software\Funmoods]    => Infection PUP (PUP.Funmoods)
[HKCU\Software\InstallCore]    => Infection PUP (Adware.InstallCore)
[HKCU\Software\SweetIM]    => Infection PUP (PUP.SweetIM)
[HKLM\Software\Wow6432Node\InstallCore]    => Infection PUP (Adware.InstallCore)
[HKLM\Software\Wow6432Node\SweetIM]    => Infection PUP (PUP.SweetIM)
O43 - CFD: 11/11/2012 - 10:49:04 PM - [1.693] ----D C:\Program Files (x86)\~BabylonToolbar    => Infection BT (Toolbar.Babylon)
O43 - CFD: 03/02/2013 - 02:00:58 AM - [0] ----D C:\Users\NEW LAP\AppData\Roaming\Funmoods    => Infection PUP (PUP.Funmoods)
O69 - SBI: prefs.js [NEW LAP - b56b1pvf.default] user_pref("extensions.5058e8ab45e2d.scode", "(function(){try{if('aol.com,mail.google.com,premiumreports.info,search.babylon.com,se[...]    => Infection BT (Toolbar.Babylon)
O87 - FAEL: "{33EFA98A-E5C9-4B39-B979-B66E87FF119F}" |In - Private - P6 - TRUE | .(...) -- C:\Users\NEW LAP\AppData\Roaming\2YourFace\Updater.exe (.not file.)    => Infection BT (Adware.Agent)
O87 - FAEL: "{15C8A3CB-3420-416F-86F9-F152855C6A3E}" |In - Private - P17 - TRUE | .(...) -- C:\Users\NEW LAP\AppData\Roaming\2YourFace\Updater.exe (.not file.)    => Infection BT (Adware.Agent)
O87 - FAEL: "{F45EACB1-9B10-4A00-84F3-E2E2E8857828}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.)    => Infection PUP (PUP.SweetIM)
O87 - FAEL: "{D916D962-C91E-43A5-89CE-75BC3C28520B}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.)    => Infection PUP (PUP.SweetIM)
[HKLM\Software\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}]    => Infection PUP (Adware.Funmoods)
[HKLM\Software\Wow6432Node\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}]    => Infection PUP (Adware.Funmoods)
[HKLM\Software\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}]    => Infection BT (Adware.Downware)
[HKLM\Software\Wow6432Node\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}]    => Infection BT (Adware.Downware)
[HKCU\Software\funmoods]    

3. Using the clipboard button, paste the lines.  You will see a "GO" button appear at the bottom.

4. Click on the go button and paste the report here,

5. Go in your control panel, add remove programmes.  If you see any applications called "sweet IM, Continue to save, fun moods, Babylon, please remove them.

6. Rerun a full Malwarebyte scan. and post the report here.

7. Delete the ZHP Diag log, produce a new one and upload it on speedyshare.

The main memory eater is this application :  ContinueToSave

Catch you tomorrow for a final clean-up and optimizing your system.

Regards

sarah rock & roll · Answer

OK 
First iam sooo flattered that u liked my English :)  
two thank u soo much for all your help to me really thanks u soo much :)

===

so with run Rogue Kill i downloaded and run it a black screen  appeared and  then told then me that my computer is safe ,, that is what u told me to do right ?

then used ZHP fix 
and here is the report 

www.speedyshare.com/vxMRB/ZHP-FIX-report.txt



2 - i restarted my computer in order to run safe mode and run Malwarebyte scan 

that is the report 



https://authentification.site/XSkVs/mbam-log-2013-02-06-02-13-02.txt


3 - then i scanned with ZHP  but i didn't paste in the other ZHP  
and here is the report 

https://authentification.site/Kmerw/ZHPDiag.txt

thanks again :)

Ambucias · Answer

Thanks for the logs

You are running Windows 7 64 bit, did you have Vista on the computer before ?

You still have a memory issue which is bugging me. I must do a little research I will get back to you.

Ambucias · Answer

Where did you buy your Windows 7 ?

sarah rock & roll · Answer

i didn't buy it 
it was installed on the laptop when i bought it , it is HP

Ambucias · Answer

Could you please uninstall the following programmes:

PC Antivirus 
Search Assistant SimpleSpeedy 1.74

(they are useless and take space)

Also make a search for Kaspersky and delete all the items related to it.

Are you still loosing memory on your hard disk ?

Ambucias · Answer

Your hard disk's capacity is only 37 GB and you have lots of applications.  The more stuff you download and save closer you will get to the critical point of no return.  The difference between 2.25 and 1.92 is minimal if you used your computer.

You can now remove combofix, Malwarebyte and the rogue killer.

Delete all of your temporary files.

Ambucias · Answer

You may have a lot of programmes that automatically start when you start your computer.  Many are not necessary.  To find out what they are and prevent them from opening use this simple tool:

https://www.malwarebytes.com/mwb-download/

Everyday you can run this cleaner to delete obsolete files and also clean your registry:

https://ccm.net/downloads/security-and-maintenance/4555-ccleaner/

Last but not least, you will gain space by defragmenting your hard disk.

You will find the defragmenter in system tools.

Remember you are at the critical point.

You will know it's a virus when your machine starts acting weird and making faces at you !:-)

Good luck

My c drive free space keeps going down

25 responses

Similar discussions

Subscribe To Our Newsletter!