Solved What is eating my C/ drive space?

[Doctor Wrex]

Hi, I've found some great info so far lurking these forums, but this time it didn't seem to be enough.

My SSD C drive is losing .1 gig every couple minutes, and it's adding up fast.

What I have done already:
-disabled hibernate
-disabled system restore
-shouted obscenities at screen

It does it even when disconnected from the internet and with all windows closed.

Resource Monitor is indicating a lot write from ShaD172.tmp, which i think is nvidia shadowplay... but it's not recording or anything. I don't know how or why that would be eating my available disk space.

I'm installing WindirStat right now, hopefully that will provide some useful info. Please help, i've lost about a thrid of a gig just while typing this. That ain't right.

 

[ignatzatsonic]

TreeSize Free - Quickly Scan Directory Sizes and Find Space Hogs

Tree Size Free from the above link may do a better job of finding out what's using space.

Got any backup apps?

Use any so-called "cloud" services?

Done recent anti-virus and anti-malware scans?

 

[Doctor Wrex]

TreeSize Free - Quickly Scan Directory Sizes and Find Space Hogs

Tree Size Free from the above link may do a better job of finding out what's using space.

Got any backup apps?

Use any so-called "cloud" services?

Done recent anti-virus and anti-malware scans?

So I closed firefox, and it returned several gigs immediately, and did not decrease any further. When I opened it again, it started decreasing gradually again. Page file maybe? I thought I already tried this, but maybe it was before disabling hibernate and restore, so those may have still been doing a thing.

For the record, no backup apps, I use adobe creative cloud, if that counts, but it has been disabled for days as they don't want it used on more than two devices. Have not done any recent malware scans. But I do stay maximum paranoid about where I go and what I download on this rig. I did recently discover that my roommates never changed the admin info on the router when they got it.

But I don't think it's a virus. I'm now pretty sure it was firefox, unless that sounds absurd.

Or would that be using the pagefile, and possibly not visible to me normally?

 

[ignatzatsonic]

vssadmin list shadowstorage

Run the above command and post the output of the command.

I never had the kind of issue with Firefox, but I no longer use it. It's goofy enough that anything is possible.

Likewise Adobe. Who knows what their cloud stuff can do whether you know it or not?

I'd at least do malware and virus scans.

Tree Size Free showed you nothing unusual?

I assume you do NOT use Avast?

No oddball processes or services running? Nothing you can't identify?

 

[Doctor Wrex]

vssadmin list shadowstorage

Run the above command and post the output of the command.

I never had the kind of issue with Firefox, but I no longer use it. It's goofy enough that anything is possible.

Likewise Adobe. Who knows what their cloud stuff can do whether you know it or not?

I'd at least do malware and virus scans.

Tree Size Free showed you nothing unusual?

I assume you do NOT use Avast?

No oddball processes or services running? Nothing you can't identify?

looks like the important parts are:
Used Shadow Copy Storage space: 0 B (0%)
Allocated Shadow Copy Storage space: 0 B (0%)
Maximum Shadow Copy Storage space: 1.114 GB (1%)

I would think if it was a cloud thing, it should have stopped when I disabled my internet connection, but that's just my conjecture.

treesize shows a nearly 16GB pagefile... a 2+ gb Sha344c.tmp file dated 3 days ago that i believe to be associated with nvidia shadowplay... some adobe stuff that appears to be from when I was editing video files a week ago... admittedly, i'm not 100% sure what i'm doing with this program. Just clicking down tabs and looking at what's big and recent? If so, the ease of use of is amazing, because i got that in like 30 seconds without ever seeing it before.

I use Avira now. Had Avast on previous rig. Never again. Scareware bullshit. Not sure how I feel about Avira, but at least it's not constantly implying that cyber-rapists are plotting to tear off my nipples.

Odball processes eh... i don't think so. Anything that looks suspicious to me gets googled from time to time, and it's always something that should be there.

 

[ignatzatsonic]

Other than malware/virus scans, I can't offer any new ideas.

Keep an eye on it, maybe someone else can help.

Does not appear to be related to System Restore.

 

[Doctor Wrex]

I'll definitely watch it. I'm pretty sure it was firefox related. Will try to reproduce it. And yeah, it is probably about time for a good virus scan.

Thanks for all your hard work! These forums are a great resource!