Solved! 700GB in "Other" folders on 1TB HD

[tomfly]

1 year old HP laptop, 1TB HD, don't know how long it's been there but saw that 700GB is being used in 2 separate folders, all numbers and letters no names to the files, ran troubleshoot, Ccleaner, don't know what it is except MS on that page said those 2 files could not be characterized and may affect my computer. All the files that show up are 221.184kb, about 40 lines worth, doesn't even add up from files I can see. I don't game, don't download movies, music, 99% of the use of the laptop is checking email and web surfing and watching Netflix or Youtube videos. I've seen this issue posted in a few places, not here, but other forums and no one has found an answer. I should only have maybe 80-100GB used, if that. The only place it shows up is in settings and "Other folders", C:\dJbpM_!O2OvW!eS`YA is using 379GB. C:\5GQF85RjZ40H6CXelz is using 327GB . Any ideas? Thanks in advance.

 

[VirtualLarry]

Weird. Possible that you've been hacked. Sometimes MS Updates, create a random-gibberish sub-folder, but the biggest Windows Update is a full OS installation, which is max like 6-7GB, generally less than 4GB. Having 700GB in those folders is VERY suspect.

I'm fairly security-conscious, and I once found a web-server running that I didn't install, on one of my Win7 64-bit machines. I turned everything off, used a laptop to download new router firmware, flashed my router, updated my password, re-set-up my network, then went around re-formatting each of my PCs, and re-connecting it to my LAN. Was a bit frightening to see that someone had gotten in.

Been having some, rather "weirdness" lately, too, so maybe someone got in again. It's not even like I have UPnP enabled, or have internet-facing services on my PC or router. And yet, somehow, "they" got in.

I was using Intel-based PCs at the time. With what we know NOW regarding exploits, Skylake (unpatched), wasn't so secure. (This was a few years ago, Spectre / Meltdown weren't public knowledge back then; Skylake was just coming out, and Ryzen wasn't out yet.)

That being said, I would check VSS (vssadmin), and System Restore, and Disk Indexing, and see what they are taking up. Maybe it's the indexing service gone crazy. (Can happen.)

 

[tomfly]

Weird. Possible that you've been hacked. Sometimes MS Updates, create a random-gibberish sub-folder, but the biggest Windows Update is a full OS installation, which is max like 6-7GB, generally less than 4GB. Having 700GB in those folders is VERY suspect.

I'm fairly security-conscious, and I once found a web-server running that I didn't install, on one of my Win7 64-bit machines. I turned everything off, used a laptop to download new router firmware, flashed my router, updated my password, re-set-up my network, then went around re-formatting each of my PCs, and re-connecting it to my LAN. Was a bit frightening to see that someone had gotten in.

Been having some, rather "weirdness" lately, too, so maybe someone got in again. It's not even like I have UPnP enabled, or have internet-facing services on my PC or router. And yet, somehow, "they" got in.

I was using Intel-based PCs at the time. With what we know NOW regarding exploits, Skylake (unpatched), wasn't so secure. (This was a few years ago, Spectre / Meltdown weren't public knowledge back then; Skylake was just coming out, and Ryzen wasn't out yet.)

That being said, I would check VSS (vssadmin), and System Restore, and Disk Indexing, and see what they are taking up. Maybe it's the indexing service gone crazy. (Can happen.)

Thanks for the reply. I'm very security conscience also and have a hardware and software firewall, anti-everything and once a month I do a full system scan, the ones that take hours(5400 rpm HD doesn't help) but almost goes through every line of code, I'm covered on all fronts there, but your right it's possible but I'm one of those 1 in a million when it comes to security, use to run 6 computers and 1 dedicated to encryption/ethical hacking sites. What also makes it not so weird is that a search of it shows its somewhat common, people have paid MS for help and nothing improved, others have taken it to professionals and no luck. I also don't run WiFi, so weird, yeah, solution just hasn't been found except one guy said Ccleaner was the issue and it restored 100GB+ on his 120GB HD, he thought that all those files when he emptied his trash, stayed on his computer. If it was Ccleaner, it would have massive attention, so I dismiss that. Look at the codes I pulled off, no hint there either. Laptop works perfect, I'm the only user, don't share data/laptop with anyone, https and encryption and highest settings on screening programs, heuristic scanning. Even went into safe mode and ran everything I had for security and found nothing. Saw Win10 should take about 20GB, troubleshoot showed every system good. If someone got into my laptop, leaving 700GB behind is a bad idea, no issues with any important accounts, even checked my credit reports, clean. I will try the ideas you gave me, there are a lot more people that have this issue that don't even know about it as it shows no symptoms and causes no problems unless you get too close to 1TB or a little less that's actually available for use and no one I know uses that much HD space. Thanks again and keep me in mind if you ever see the subject currently being brought up.

 

[Insert_Nickname]

If you don't mind doing a reinstall, nuking the disk and doing that is what I'd do. Just to be on the safe side, you never know what might be lurking in the deep recesses of your HDD.

You'll need some install media, preferably clean images directly from MS (media creation tool). Also to eliminate any OEM crapware. Boot from that media (DVD/Flashdrive), start repair mode > command prompt. Then do a clean command in diskpart. That'll nuke everything on the disk down to, and including, the partition table. Leaving you with a completely clean disk for a reinstall.

It's actually a good habit to get into with new laptops. Immediately wipe and reinstall with known clean image.

 

[Shmee]

You should be able to safely delete them all, if you are not able to, you could try ccleaner or similar to delete, or boot up linux and delete them from there. If wiping the drive and reinstalling, I would get an SSD if possible for the laptop while I was at it.

 

[deustroop]

They are the MD5 and/or SHA1 of the Windows Updates.
This makes look-up faster and far more reliable as two different patches with the same name will not have the same hash/HMAC values.
- https://www.google.com.au/search?q=md5+sha1

If they are over 72 hours old, and you have restarted since they can be safely deleted.

 

[tomfly]

I finally found all the files with CCleaner, had to check everything on file lookup, 85% of 1TB is under "Other" files, I can delete them there but I'm seeing pagefile.sys , hyberfil.sys as 8 and 4GB and hundreds of other files with almost all being less than 1mb. I reset Win store apps and Win update, tried to clear MS store cache but it requires a command line prompt, the wsreset.exe did nothing. It's critical that I have a internet connection everyday and this laptop is it. MS says about the "other" files that some may be needed to keep the computer running basically, so deleting them is a risk I can't take now. I'm getting closer, but odd that the only place I could see every file was through CCleaner. I'm trying all the steps MS uses for a low disk space error to see if any of those options will see these "other" files and remove the trash and keep the needed ones. I can finish that in 30 minutes or less, if that doesn't work, keep looking for someone who had the same issue(they all seem to be 700GB area on a 1TB disk, so I can do a known fix rather than guessing or risk losing connectivity. Thanks for the input and keep it coming.

 

[VirtualLarry]

They are the MD5 and/or SHA1 of the Windows Updates.
This makes look-up faster and far more reliable as two different patches with the same name will not have the same hash/HMAC values.
- https://www.google.com.au/search?q=md5+sha1

If they are over 72 hours old, and you have restarted since they can be safely deleted.

Why would they be taking up 700GB!??!

Anyways, try opening File Explorer, right-click your C-colon drive, select Properties, click Disk Cleanup, when that window pops up, click "Clean up System Files", wait for that window to pop up (it must process something), then look at the right-hand column as to how much disk space is used by each option, and then check off everything that you want cleaned, then click "Clean" or whatever to start the process. If you select "Clean up Windows Updates", it has to filter through all of the updates, and weed out individual updates that have been superseded, and delete them. That can take literally a few HOURS. All of the other cleanup tasks should go fairly quickly, but that's on an SSD system.

 

[tomfly]

I did a targeted scan for the files, "Other folders", C:\dJbpM_!O2OvW!eS`YA is using 379GB. C:\5GQF85RjZ40H6CXelz is using 327GB with extreme deep scanning for a virus or malware with 4 different programs that looked only at those files, all files, every line of data, packers, types of files, rootkits, types of files, 2 intensive reboot/startup scans, extensions and archives. A simple google search shows several people who have the same issue but no solution. Surely someone who has had this issue has found a fix, I've not seen one?

 

[mikeymikec]

Folders created by Windows updates don't usually have symbols in the names in my experience.

@tomfly

Have you used any backup/imaging software at all?

Also, if you open a command prompt and type DIR C:\foldername /A /S > C:\Users\youruser\desktop\foldername.txt then it'll dump a full directory listing of that folder into the file of that folder's name on your desktop. Post the contents of that file here please? Use the code tags in order to make your post less messy to read.

 

[tomfly]

I already have a listing of the files in each folder, all code, posted above and all were 221.84 kb except for 2 files that were pagefiles.sys and another I forgot. Wish I knew if this was there when I bought the computer or built up over time. I can delete the files but a MS warning says this may affect my computer, which I need daily. I've tried all 10 options from MS to free up HD space and no change. I'm not the only user who has this issue and no one has found a solution. 700GB is a lot when your not talking games, movie downloads, gaming, none of which I do. MS says I can do a reset but I lose a lot of files and apps, which I can't afford to do either. 700GB listed as only "other" files is strange and perilous territory to just delete. Why is it that people who have paid MS and professionals have yet to find a fix?

 

[VirtualLarry]

They are the MD5 and/or SHA1 of the Windows Updates.

Folders created by Windows updates don't usually have symbols in the names in my experience.

Exactly. Generally, WU directories, are "clean" hexadecimal strings, I believe, representing the hash of the update. Those filenames, containing special characters, remind me a bit of bitcoin addresses.

I suspect some sort of crypto-mining malware, maybe a storage-based one like BurstCoin (to name just one well-known one, and not saying that the coin type is the problem, or even mining in general, but the possibility that someone was doing that to you illicitly, and using your PC's resources).

 

[tomfly]

Why would they be taking up 700GB!??!

Anyways, try opening File Explorer, right-click your C-colon drive, select Properties, click Disk Cleanup, when that window pops up, click "Clean up System Files", wait for that window to pop up (it must process something), then look at the right-hand column as to how much disk space is used by each option, and then check off everything that you want cleaned, then click "Clean" or whatever to start the process. If you select "Clean up Windows Updates", it has to filter through all of the updates, and weed out individual updates that have been superseded, and delete them. That can take literally a few HOURS. All of the other cleanup tasks should go fairly quickly, but that's on an SSD system.

VirtualLarry- Thanks for the input 9 GB was available to be deleated, that's all and I deleated it. I'm still 690GB short of getting rid of that file. Next?

 

[tomfly]

Folders created by Windows updates don't usually have symbols in the names in my experience.

@tomfly

Have you used any backup/imaging software at all?

Also, if you open a command prompt and type DIR C:\foldername /A /S > C:\Users\youruser\desktop\foldername.txt then it'll dump a full directory listing of that folder into the file of that folder's name on your desktop. Post the contents of that file here please? Use the code tags in order to make your post less messy to read.

Mikeymikec- Thanks for the input, I have seen all the files and other than the pagefile.sys at 8GB and another at around 6GB, hundreds of code files, no names all at 221.184kb. Now what?

 

[tomfly]

Defraggler seems to show the most about the files and also offers a delete, here's a copy: "Other folders", C:\dJbpM_!O2OvW!eS`YA is using 379GB. C:\5GQF85RjZ40H6CXelz is using 327GB . Even defraggler wont let me inspect the file, only delete or defragement the file, my system is only 3% fragmented. Do a google search of either file and you can see what I see, all code and each line is showing 216mb for every line of code, I thought mine was showing 214 kb, I may be wrong but either way they are all the exact same size and no words, the 1st C:\djbpM file is listed as pagefile.sys. C:\dJbpM_!O2OvW!eS`YA search also shows all files 216mb 12/31/2000. My files were created or last modified in 2018 which makes me think it may have been on my laptop when I bought it but no files anywhere explain the size and no program is associated with it. Very odd that a google search will show you all the files stored under that C:\ file. I am so tempted to delete it, but just can't take the risk of it disabling my laptop, the files are there for all to see.

 

[tomfly]

Defraggler seems to show the most about the files and also offers a delete, here's a copy: "Other folders", C:\dJbpM_!O2OvW!eS`YA is using 379GB. C:\5GQF85RjZ40H6CXelz is using 327GB . Even defraggler wont let me inspect the file, only delete or defragement the file, my system is only 3% fragmented. Do a google search of either file and you can see what I see, all code and each line is showing 216mb for every line of code, I thought mine was showing 214 kb, I may be wrong but either way they are all the exact same size and no words, the 1st C:\djbpM file is listed as pagefile.sys. C:\dJbpM_!O2OvW!eS`YA search also shows all files 216mb 12/31/2000. My files were created or last modified in 2018 which makes me think it may have been on my laptop when I bought it but no files anywhere explain the size and no program is associated with it. Very odd that a google search will show you all the files stored under that C:\ file. I am so tempted to delete it, but just can't take the risk of it disabling my laptop, the files are there for all to see.

Link: file:///C:/dJbpM_!O2OvW!eS%60YA/__%5DOwW2mvXV,'xM6n+
Link: file:///C:/5GQF85RjZ40H6CXelz/__bffvGi=457ht6Ulf

Hope that shows you all what I'm seeing except the date on these files is 2000 and both mine are 2018.

 

[mikeymikec]

Mikeymikec- Thanks for the input, I have seen all the files and other than the pagefile.sys at 8GB and another at around 6GB, hundreds of code files, no names all at 221.184kb. Now what?

I wanted an actual list rather a vague summary of what might be in there. Is pagefile.sys actually in one of those folders in question? Because that would be... odd. It would make me wonder if an entire Windows installation is also in there, as if some OS installer had come along and backed up the old OS into that folder before whatever occurred after.

'Code files' and 'Other files' doesn't mean much. However, if I saw the actual file listing I might get a better idea of what's in there.

 

[tomfly]

I wanted an actual list rather a vague summary of what might be in there. Is pagefile.sys actually in one of those folders in question? Because that would be... odd. It would make me wonder if an entire Windows installation is also in there, as if some OS installer had come along and backed up the old OS into that folder before whatever occurred after.

'Code files' and 'Other files' doesn't mean much. However, if I saw the actual file listing I might get a better idea of what's in there.

 

[tomfly]

Sorry, yes pagefile.sys is listed as one of the big files. If you copy/paste the 2 files I have listed as links on google, they will show you all the files I see, I thought that would help. Odd that the files come up on google, these are the files headers:

Link: file:///C:/dJbpM_!O2OvW!eS%60YA/__%5DOwW2mvXV,'xM6n+
Link: file:///C:/5GQF85RjZ40H6CXelz/__bffvGi=457ht6Ulf

Google either and its all there and all files are 216mb, every one, another oddity. Thanks for your interest. I bought the computer new and Win10 was already installed, all I did was select auto updates of critical updates, added nothing else.

 

[mikeymikec]

Those aren't links. Even if you had set them up as links, they would be trying to reference files on my computer, and even then pretty much every modern web browser will say "hell no!" to web page content attempting to access local file content.

I'm not sure what I'd google either of those file names but even when I do I unsurprisingly get zero results (except a result for this forum page).

If you need more explicit instructions regarding what I suggested doing at the command prompt then plus just ask.

 

[tomfly]

Sorry, yes pagefile.sys is listed as one of the big files. If you copy/paste the 2 files I have listed as links on google, they will show you all the files I see, I thought that would help. Odd that the files come up on google, these are the files headers:

Link: file:///C:/dJbpM_!O2OvW!eS%60YA/__%5DOwW2mvXV,'xM6n+
Link: file:///C:/5GQF85RjZ40H6CXelz/__bffvGi=457ht6Ulf

Google either and its all there and all files are 216mb, every one, another oddity. Thanks for your interest. I bought the computer new and Win10 was already installed, all I did was select auto updates of critical updates, added nothing else.

 

[tomfly]

[QUOTE=" Sorry. When I copy/paste" C:/dJbpM_!O2OvW!eS%60YA" all the files and google it I have show up include the C:/, everything in the ", I get all the files I show. I apologize I'm not getting you the info you want, trying and getting the files when I copy/paste the two files listed in my original post and here.

C:/dJbpM_!O2OvW!eS%60YA
C:/5GQF85RjZ40H6CXelz/__bffvGi=457ht6Ulf

A google search via copy/paste of either of the above shows all the files I have. Thanks for hanging in there with me, I'm brain dead from all the hours spent on this.

 

[mikeymikec]

Stop trying to copy and paste those folders; without the assistance of an extra program to do something useful with them you're not ever going to get a useful result that way.

You're probably running Windows 10 (judging by the age of your laptop). Open the Start menu, type in 'cmd', and you should get 'Command Prompt' as a search result for an app on your computer.
Right-click on it, look for the option to run as administrator.
Windows will ask are you sure, yes you are.
A black window will appear. Type in the following commands and press the Enter key on your keyboard at the end of each line (you can copy and paste each line into the command prompt I think - to do a paste you might have to right-click in the command prompt and select paste, I'm not using Windows 10 so I can't immediately check):

CD C:\
DIR dJbpM_!O2OvW!eS%60YA /A /S > %USERPROFILE%\DESKTOP\dJbpM_!O2OvW!eS%60YA.txt
DIR 5GQF85RjZ40H6CXelz /A /S > %USERPROFILE%\DESKTOP\5GQF85RjZ40H6CXelz.txt

Neither command will look like it does very much, but if it goes according to plan (assuming for example you got those folder names exactly correct) you should end up with two text files on your desktop that if you open them you should see folder/directory listings for the contents of each of those folders (one folder structure per file).

You should then be able to copy and paste the contents of each of those text files here, but go one at a time, and also use the code tag (above where you type your posts here there's a toolbar with an option to insert various things, one says 'code') and put the pasted contents into the code tag. That should allow us to have a look through what kind of files are being stored in those folder structures and give more informed advice.

 

[killster1]

i would buy a SSD reinstall everything and make a backup restore image for next time something goes wrong, might take 5 mins to do complete system restore.

 

[ElFenix]

i was going to ask you to post a screenshot of the contents of the folders but mikeymikec's suggestion is better.