# unexplained massive loss of disk space



## 3870x2 (Oct 18, 2009)

This is a relatives vista computer, and it has a virus of some sort.  I fixed it a few months ago, but it is doing it again, and I dont remember what I did last time, (something to do with just deleting a file)

This file is using up 180 GB of HD space out of 220, giving us 0MB of free space.
Nothing can detect this, every program that scans the computer reads a normal 30GB or so of usage, and even splits them up.
The MY COMPUTER shows 0MB available
finally, hunting for folders to find the file has been fruitless.  I have already done a search and nothing was found.

I dont think it is a shadow copy or restore point issue, but if you could let me know where they are stored, i can check.


----------



## Marineborn (Oct 18, 2009)

hmmm.....odd...you said you scanned it with everything and if it is a virus you could always try the trial verison of kaspery, that pretty much detects and kills everything, thats all that i can think of, or just NUKE it ..reformatt..


----------



## 3870x2 (Oct 18, 2009)

Ive found it before, now I just need to find out where it was again


----------



## Mussels (Oct 18, 2009)

shadow copy? system restore?

i'd be formatting and reinstalling with a reoccuring problem like that.


----------



## wiak (Oct 18, 2009)

things that use space, shadow copy, system restore, sleep mode, hibernation, recycle bin and ofcorse the virtual memory


----------



## Mussels (Oct 18, 2009)

sleep mode and hibernation use the one file (hiberfil.sys) which is static locked to the size of the systems ram.

it cant be using this much data.


----------



## AsRock (Oct 18, 2009)

system restore can be found in a folder called System Volume Information. All though i'm not sure about shadow copy.

To turn of System restore right click my computer goto properties and it's under a tab called system restore..  IF you do happen to find a virus or malware make sure system restore is turned of as it can back them up.


----------



## 3870x2 (Oct 18, 2009)

yeah, 180GB, and from what I remember last time, it was like 179,xxx,xxx,xxx bytes in one file once I found it.  Ive been googling for a while, which i believe is the way i found it last time, but still havent found anything.

Reformatting is questionable because of their internet.  Their provider is all fkked in the head, and requires a technician to come out and set up the internet, because they have not heard of conventional mac address authorization broadband.  They use a username and password to connect.


----------



## Mussels (Oct 18, 2009)

all ISP's here in australia require a username and password, and dont use MAC.

MAC is silly, as you cant change hardware.
then again... no one here has a problem with entering a username and password.


try showing hidden files and folders, and system files and folders. it should show up fairly easily that way.


----------



## WarEagleAU (Oct 18, 2009)

IF that doesnt work, try making a dos boot usb key from one of those awesome AV programs you have tried and run it from the command prompt when you boot up the computer. Almost should take care of it as it was what I had to do one time when I had a virus and nothing could get it out of windows. Now, it may take 5 or 6 hours, but it will find it and delete it. It works because this way it doesn't have a chance to bury and protect itself in windows. Give that a shot if you have to, couldn't hurt.


----------



## 3870x2 (Oct 18, 2009)

Mussels said:


> all ISP's here in australia require a username and password, and dont use MAC.
> 
> MAC is silly, as you cant change hardware.
> then again... no one here has a problem with entering a username and password.
> ...



that is no big deal, you can call and add/delete a mac 24 hours a day if you want to add/delete  a computer / router.  It is a truly great system, very plug-and-playable.


----------



## 3870x2 (Oct 18, 2009)

Problem solved:

There is a file called PYAGCORE that was 186 GB large, and continues to get larger if it can.  I did some googling, and found out that it is a piece of malware, although my particular pyagcore didnt do any of those things.

The path (vista 32-bit) is as follows for anyone looking to resolve this issue:
C:\Windows\System32\config\systemprofile\AppData\Roaming\agi\logs
Thank you all for your help.


----------



## newtekie1 (Oct 18, 2009)

Just as a quick thing next time, you might want to use a program called TreeSize to locate what folders and files are taking up how much space on a hard drive.  It really makes locating things like this really easy.  Even if the file is hidden, it will at least point you into the folder that is taking up so much space, and from there you can find the file manually.


----------



## 3870x2 (Oct 20, 2009)

yep, actually had treesize before there was a problem.  Treesize would not have helped, unless i was in safe mode, the file was completely and entirely hidden, no matter what i did or what program I used.  Once i was in safe mode, I was able to see the file.


----------



## TheLaughingMan (Oct 20, 2009)

Try this one instead.  I think you can use it to see even protected files, which is most likely what the file did to hide itself.  Protected files can't be seen through normal scans, even if you search hidden files.  Please this program is a portable app so you can use it after you lose all your space.

WinDirStat


----------



## 1933 Poker (Oct 30, 2009)

I have an interesting story related to your thread involving an upgrade to Windows 7 from Vista 64. I had freed 20GB to install 7 leaving a total of 20GB free. After installing 7 I noticed that my free space had increased to 30GB not concluding to 0?


----------

