Hard Drive Mysteriously Filling Up

How can my computer use 2 gigs of hd in 3 days when I
haven't downloaded anything?

Herb
Thu Jul 24 12:28:43 CDT 2003

try a directory command and if you have disk space
send the output to a file...

dir /s >c:\t.txt

Look especially for LOG files or grep for patterns that
reference files larger than say, 100,000,000 meg.

You might find a tool that searches for files with size
constraints (I have an old DOS whereIs and am writing
a newer version for .NET)

Bugaboo
Thu Jul 24 17:53:44 CDT 2003

Thank you!!!! I have been waiting all day for a reply!
I will do as you mentioned.

Lanwench
Thu Jul 24 21:58:26 CDT 2003

A thirdparty option is TreeSize - a nice shareware utility that will show
you where things are in a lovely graphical format.

Bugaboo wrote:
> Thank you!!!! I have been waiting all day for a reply!
> I will do as you mentioned.

Herb
Fri Jul 25 05:35:29 CDT 2003

> A thirdparty option is TreeSize - a nice shareware utility that will show
> you where things are in a lovely graphical format.

There's a good idea -- I think I will put dir sizing and constraints
into my "where is" program.


"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmail.atyahoo.com> wrote in message
news:OxbabvlUDHA.2316@TK2MSFTNGP09.phx.gbl...
> A thirdparty option is TreeSize - a nice shareware utility that will show
> you where things are in a lovely graphical format.
>
> Bugaboo wrote:
> > Thank you!!!! I have been waiting all day for a reply!
> > I will do as you mentioned.
>
>

Gary
Fri Jul 25 07:32:50 CDT 2003



Bugaboo wrote:
> How can my computer use 2 gigs of hd in 3 days when I
> haven't downloaded anything?

If you're running a server (web, ftp, database, etc.) on
an always on connection check for the following:

1) Files stored in the recycler folders at the root level
of the drive.
2) Use the search utility to search for files created on or
after the days on which you noticed the large change.

Servers that are compromised are often used as distribution
depots for movies, music, porn, software, etc.

If you're running an FTP server, make sure it doesn't
allow anonymous writes.


--
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe

Herb
Fri Jul 25 15:13:16 CDT 2003

Gary had another good idea that I never think of because I
never purposely use the Recycle bin.

Another one I found once was DiskKeeper had made a log
for everyday since I installed it 18 months previously. Down
in program files somewhere (this was the commercial version.)

Watch for logfiles down in System32 -- and all those Hotfix
folders in %SystemRoot% by the time a machine has lived
through everything up to SP4.

for /f %a in ('dir /ad /b $*') do @echo rd /q /s %a

The above will write the commands to kill all those dirs if
you run it from WinNT or whatever %systemroot% or %windir%
is. Take out the "echo" if you are SURE. Never do this before
rebooting and checking a machine to make sure an uninstall will
not be necessary.

If you place it in a batch file, you need to double the "%" signs,
thus

for /f %%a in ('dir /ad /b $*') do @echo rd /q /s %%a

BE CAREFUL -- you've been warned. <grin> <REALLY>
"Bugaboo" <bugaboo239@hotmail.com> wrote in message
news:016001c351fa$24b966f0$a101280a@phx.gbl...
> How can my computer use 2 gigs of hd in 3 days when I
> haven't downloaded anything?

Karl
Sat Jul 26 08:25:21 CDT 2003

My first guess would be someone may be running an illicit FTP server on your
computer. See here:

http://securityadmin.info/faq.htm#ftpfolder
http://securityadmin.info/faq.htm#hacked
http://securityadmin.info/faq.htm#harden

You might try first looking at the folders in your FTPROOT folder, or search
for any folder including the word tagged. One of the folders involved may
have COM or LPT or PRN or some other "reserved" word in the name [but I'm
not sure if you can see these when you search or not, it's worth a try].


"Bugaboo" <bugaboo239@hotmail.com> wrote in message
news:016001c351fa$24b966f0$a101280a@phx.gbl...
> How can my computer use 2 gigs of hd in 3 days when I
> haven't downloaded anything?