C-drive keeps filling up

Anonymous
2015-01-14T17:54:01+00:00

Here's a problem that I haven't been able to resolve for the last two months.  I've researched this problem on this forum and nothing been able to solve it yet.  My work computer's c-drive keeps filling up to capacity.  I have a 235 GB hard drive with very few programs loaded onto it and almost no picture or video files taking up space.  The computer is hooked up to a network here where I work, but nobody else has this problem.  Even if I'm able to free up several GB's of space, the c-drive will fill up in just a couple of days.  I think I might have a virus.  These are the measures I've tried to correct this issue:

  • Ran Disk Cleanup which freed up about 2 GB's initially.  After a couple of days, the c-drive filled back up again.  Subsequently, running Disk Cleanup only free's up a few MB's now.
  • Ran MalewareBytes, Eset online scanner, and Super-AntiSpyware programs to try to identify a virus, but neither of them can find anything other than cookies.  I've also run these programs in Safe Mode.
  • My Microsoft Security Essentials program had been removed, and I can't get it to re-install.  I even tried several work-arounds listed on this forum to install it, but I still get error messages when installing.
  • Tried the "Fix It" function
  • Tried System Restore but apparently that's been disabled too since there are no restore points to be found
  • Disabled the Hibernate function to free up several GB's, but the computer quickly filled-up within a couple of days.
  • Disabled the Backup function.
  • Deleted temp files from my user profile
  • I also run into problems trying to install the security updates from the Windows Update function.  I haven't been able to get the security updates to install for a couple of months now.

Anything thing I do that free's up space will only work temporarily.  The c-drive will continue to fill up in a matter of minutes or hours even if I'm away from my computer during that time.  

The strangest part is that if I right-click on the c-drive in My Computer, it will show that the 232 GB hard-drive is nearly or completely full (0 bytes).   If I open the c-drive, select all the files and folders in it and right-click, it only shows about 51 GB's of storage space used.  This does affect my computer greatly when trying to save or print even small files that only take up a few KB's.  Is there any other fix that I haven't tried yet?

I ran the WinDirStat utility but that doesn't show me anything other than the 51 GB's taking up storage space.  Also, my hard-drive is not partitioned.

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

51 answers

Sort by: Newest
  1. Anonymous
    2015-02-04T22:07:47+00:00

    Glad to hear that you've got free space again!  Now, let's see if we can figure out what is writing those files in the first place.

    1. Download and run Sysinternals Process Monitor (it is a standalone application).
    2. Clink cancel on its Filters dialog.
    3. In the Filter menu, make sure that Enable Advanced Output and Drop Filtered Events are both ticked.
    4. On the toolbar, in the group of five buttons on the end to the right, make sure that only the second one, Show File System Activity is ticked.
    5. Click the Filter button on the toolbar (or press [Ctrl]+[L]) to bring up the Filters dialog.
    6. You will see a row of controls at the top of the Filters dialog where you can fashion a rule.  Set them to "Path" "contains" "NetworkService\AppData" then "Include".
    7. Click [Add], click [OK], and then click the Clear button on the toolbar (or press [Ctrl]+[X]).

        When a program starts reading/writing files to the Network Service AppData folder, events should start appearing in the list, along with the name of the process that is responsible for the writes.  If nothing appears, make sure that the Capture toolbar button (the third one, it looks like a magnifying glass) doesn't have an "x" over it.  It if does, click on it to enable monitoring.

        Please note that due to the rather loose filter we set, some legitimate events will probably end up in that list as well.  After running for a few minutes on my system, a couple of entries appeared pertaining to a "VirtualStore" from svchost.exe, a Windows component.  The kind of suspicious activity that is filling up that folder on your computer should be hundreds or thousands of events, so it should be obvious.  You can click on the fourth button on the toolbar (next to the Capture button) to toggle auto-scrolling on or off.

        You may be able to figure out the problem on your own by Googling the suspect's name (as long as it isn't svchost.exe).  If not, you can take a screenshot of the suspicious activity and post it here, or save the Process Monitor log by clicking Process Monitor's save button and upload it somewhere, posting a link here.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments No comments
  2. Anonymous
    2015-02-04T21:27:12+00:00

        Wow.  That's a lot of files!  It is very suspicious that it is the NetworkService's user profile that is filling up with Temporary Internet Files, and not your user profile.  This suggests that some service was accessing the Internet via Internet Explorer or an Internet Explorer ActiveX control.  Incidentally, my computer's NetworkService Temporary Internet Files folder is completely empty.

        For now, I am going to assume that any infection has been removed, and we just need to clean out its payload.  I wrote a program that is specifically designed to delete massive amounts of files, and files where the pathnames are too long, both which are scenarios that Explorer does not handle too well.  If you have not already been successful clearing out that folder, please:

    1. Cancel any delete operations currently in progress.
    2. Download my program: DeleteFolderTree.exe (42 KB standalone portable application).
    3. Copy the path to the errant folder: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
    4. Paste it into my program and click [Delete].

        Unlike Explorer, my program won't have a "Preparing to delete" period; it will start deleting files/folders immediately after confirmation from you.  Unfortunately, there will also be no progress indication, only a count of deleted/failed items, and a readout of the increasing amount of free disk space.  This is due to my program's skipping file enumeration, which is what took TreeSize so long, and is what Explorer is doing during the "Preparing to delete" phase.  My program does the enumeration and deletion at the same time, which means it never knows how many files are left to delete.

        @Frederik Long and HairyFool:  I know you guys were trying to be helpful, but if a user changes the Temporary Internet Files cache size setting, if will only affect their user profile.  In this case, since it is the NetworkService profiles' Temporary Internet Files cache that is getting out of hand, changing that setting won't help at all.

    That program you wrote certainly did the trick as far as deleting the contents of that folder.  It took a couple of days, but I now have about 120 GB's of free space again and my computer is performing like before.  Many thanks.  

    However, there's still some sort of virus/malware infecting my computer because that same folder constantly fills up with .jpg, .js, and .htm files.  I run your delete program once a day to get back 1-2 GB's of space.  At least this buys me time to get rid of whatever is infecting my computer.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2015-01-23T20:19:41+00:00

    Wow.  That's a lot of files!  It is very suspicious that it is the NetworkService's user profile that is filling up with Temporary Internet Files, and not your user profile.  This suggests that some service was accessing the Internet via Internet Explorer or an Internet Explorer ActiveX control.  Incidentally, my computer's NetworkService Temporary Internet Files folder is completely empty.

        For now, I am going to assume that any infection has been removed, and we just need to clean out its payload.  I wrote a program that is specifically designed to delete massive amounts of files, and files where the pathnames are too long, both which are scenarios that Explorer does not handle too well.  If you have not already been successful clearing out that folder, please:

    1. Cancel any delete operations currently in progress.
    2. Download my program: DeleteFolderTree.exe (42 KB standalone portable application).
    3. Copy the path to the errant folder: C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
    4. Paste it into my program and click [Delete].

        Unlike Explorer, my program won't have a "Preparing to delete" period; it will start deleting files/folders immediately after confirmation from you.  Unfortunately, there will also be no progress indication, only a count of deleted/failed items, and a readout of the increasing amount of free disk space.  This is due to my program's skipping file enumeration, which is what took TreeSize so long, and is what Explorer is doing during the "Preparing to delete" phase.  My program does the enumeration and deletion at the same time, which means it never knows how many files are left to delete.

        @Frederik Long and HairyFool:  I know you guys were trying to be helpful, but if a user changes the Temporary Internet Files cache size setting, if will only affect their user profile.  In this case, since it is the NetworkService profiles' Temporary Internet Files cache that is getting out of hand, changing that setting won't help at all.

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments No comments
  4. Anonymous
    2015-01-21T18:02:41+00:00

    Got to Control Panel > Internet Options(that way you do not have to open IE itself)

    On the Browsing History click on Settings, On the Temporary Internet Files tab check the settings. Here you define the limits which should be nothing like your experience. The limit should be hundreds on MB, mine is 250, not even 1GB (its max), and set to Automatic. It might be worth setting it to a new value just to make IE recreate the entry. 

    More importantly it shows the path, where is it pointing to?

    Was this answer helpful?

    0 comments No comments
  5. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more