Options

Decreasing Hard Disk Space on Windows XP partition!

Unknown
edited November 2007 in Spyware & Virus Removal
Hello Everybody,

I'm having a nasty problem with my Toshiba Satellite A100 notebook, running Windows XP Home Edition (Service Pack 2):

I recently set up a partition on my hard disk and installed Ubuntu Studio on it.
Things work perfectly with that operating system, but when I'm booting with Windows XP my hard disk space starts decreasing at an alarming rate, without any intervention from me: in less than 15 minutes, just "refreshing" with F5 key, my hard disk turns from 9 Gb to "full" (0 mb!) and I there's nothing I can do about it..

When I restart, the situation keeps stable for some moments, then suddenly starts "disappearing" as before.. any idea of the possible cause?

At first I thought of a virus/malware sort of thing, but neither my F-Secure Internet Security 2008 (original and updated) nor SUPER AntiSpyware detected an "intruder".

P.S.: I'm adding the HijackThis report in case anyone can understand what's happening.

I'm nearly desperate: any suggestion and help would be GREATLY apreciated.. Thanks!

- edlow

Comments

  • MJOMJO Denmark New
    edited November 2007
    I had a similar problem a couple of years ago.
    Here is the old thread:
    http://icrontic.com/forum/showthread.php?p=94494#post94494

    I guess it was some sort of virus or trojan, but I don't think I ever found out for sure. :confused:
    But a crashed/incomplete Bootvis analysis can also fill up the drive.
    I have tried that a couple of times.
  • edlow
    edited November 2007
    Thanks for the link, man!

    Seems like I'm in the same situation: just hope to find the same "feedback"..
    But a crashed/incomplete Bootvis analysis can also fill up the drive.
    I have tried that a couple of times.

    Now that you tell me, I launched Bootvis too. And it crashed. How did you get rid of it? Just deleting the file?

    I know it has been an "unsolved" case so far, but just to try something..

    I just formatted my notebook for the 8th time in the last few months: I'd like to spare this "hobby" for the next weeks..:smiles:
  • edlow
    edited November 2007
    However, that's the "new" hijack-log (just in case..):


    Logfile of HijackThis v1.99.1
    Scan saved at 14:32:03, on 22/11/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Programmi\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
    C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\AvidSDMService.exe
    C:\Programmi\Digidesign\Drivers\MMERefresh.exe
    C:\Programmi\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Programmi\F-Secure\Common\FSMA32.EXE
    C:\Programmi\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Programmi\F-Secure\Common\FSMB32.EXE
    C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Programmi\F-Secure\Common\FCH32.EXE
    C:\Programmi\Toshiba\TOSHIBA Applet\TAPPSRV.exe
    C:\Programmi\F-Secure\Common\FAMEH32.EXE
    C:\Programmi\F-Secure\Anti-Virus\fsqh.exe
    C:\Programmi\F-Secure\FSPC\fspc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programmi\F-Secure\FSAUA\program\fsaua.exe
    C:\Programmi\F-Secure\Anti-Virus\fssm32.exe
    C:\Programmi\F-Secure\FWES\Program\fsdfwd.exe
    C:\Programmi\F-Secure\FSAUA\program\fsus.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\AGRSMMSG.exe
    C:\Programmi\Synaptics\SynTP\SynToshiba.exe
    C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
    C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\system32\TDispVol.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Programmi\F-Secure\Common\FSM32.EXE
    C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Programmi\Windows Defender\MSASCui.exe
    C:\Programmi\File comuni\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Programmi\F-Secure\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Programmi\F-Secure\Anti-Virus\fsav32.exe
    C:\Programmi\Safari\Safari.exe
    C:\Programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\Programmi\FreshDevices\FreshDownload\FDCatch.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programmi\rpbrowserrecordplugin.dll
    O2 - BHO: Merriam-Webster Online BHO - {5ADA9CAC-04F9-4DD2-ABFD-74D673BE8624} - C:\WINDOWS\_MWOLTB.DLL
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programmi\styler\TB\StylerTB.dll
    O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\Programmi\FreshDevices\FreshDownload\fdiebar.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Merriam-Webster Online - {B7B76DD6-B6F0-4443-AF81-6A3ECF12A57D} - C:\WINDOWS\_MWOLTB.DLL
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [THotkey] C:\Programmi\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [Tvs] C:\Programmi\TOSHIBA\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [SmoothView] C:\Programmi\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programmi\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programmi\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programmi\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Programmi\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Programmi\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [SynTPStart] C:\Programmi\Synaptics\SynTP\SynTPStart.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Programmi\Digidesign\Drivers\MMERefresh.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Programmi\TOSHIBA\TOSCDSPD\toscdspd.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: MWOL &Dictionary - res://C:\WINDOWS\_MWOLTB.DLL/23/219
    O8 - Extra context menu item: MWOL &Thesaurus - res://C:\WINDOWS\_MWOLTB.DLL/23/220
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programmi\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Programmi\F-Secure\FSPC\fspcmsie.dll
    O9 - Extra button: FreshDownload - {60AE8FE6-992B-4B29-B406-3AAA8E284F7E} - C:\Programmi\FreshDevices\FreshDownload\fd.exe
    O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\programmi\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {3CF32649-D1C0-4F42-AB44-ED284748920B} (Merriam-Webster Online Toolbar) - http://www.m-w.com/downloads/toolbar/webinstall.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1194890642062
    O16 - DPF: {A4069847-C342-48E2-9257-01A24E5C78EA} (F-Secure Online Scanner 3.2) - http://support.f-secure.com/ols3beta/fscax.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5160/mcfscan.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.DLL
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe
    O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe
    O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Programmi\Digidesign\Drivers\MMERefresh.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: F-Secure BlackLight Sensor - Unknown owner - C:\WINDOWS\TEMP\F-Secure\Anti-Virus\fsblsrv.exe (file missing)
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programmi\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Programmi\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programmi\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - C:\Programmi\F-Secure\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programmi\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Programmi\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited November 2007
    moved thread to Spyware and Virus Removal forum
  • MJOMJO Denmark New
    edited November 2007
    edlow wrote:
    Thanks for the link, man!

    Seems like I'm in the same situation: just hope to find the same "feedback"..



    Now that you tell me, I launched Bootvis too. And it crashed. How did you get rid of it? Just deleting the file?

    I know it has been an "unsolved" case so far, but just to try something..

    I just formatted my notebook for the 8th time in the last few months: I'd like to spare this "hobby" for the next weeks..:smiles:

    Here's a link (I was too lazy to write it myself ;) )
    http://www.techsupportforum.com/505517-post4.html

    I didn't dare to start Bootvis this time around to see what I did. I was afraid it would crash again. :bigggrin:
  • edlow
    edited November 2007
    Nice shot! I'm gonna reboot Ubuntu just now and try this out on that WinSucks, then I'll tell you if it works..

    (Damn, if not for some apps I need for work, I would NEVER boot XP again!)

    Thanks again for the new link: you're smart, not lazy :wink:

    Hope to be of a little help myself to anybody 'round here..

    See ya!
Sign In or Register to comment.