improper shutdown..disk fragmented/no space!

HELP???
I've done just about everything...run chkdsk, defragmented the c drive...nothing works. Weeks ago had an improper shutdown event. Had to pay Dell for help. Did a system restore. All seemed fine until two days ago. Suddenly by 145 GB drive was nearly completely full! The drive is extremely fragmented! Found the issue discussed at Microsoft but I cannot comprehend what I'm supposed to do. I just know something is wrong/corrupt? with my NTFS volumes. I can't do a system restore because some files were deleted and this seems to prevent that from being possible. My drive should basically be only half full (about 80 GB).
I tried registry mechanic, file recover, diskeeper lite, restoration....nothing seems to have helped me. I'm operating on Win XP.
Next stop....the Geeks at Best Buy!
I'd rather not do that.
Please...help?:cry

 

confused Does anyone reading this thread think that something like Norton's System works might help?

 

First, try to determine what is taking up the space. In Windows Explorer do a search for files at least 100,000 kb. [Start>Search select "all Files and Folders" click "What size is it" in drop down select "at least" and input 100,000.

This will give you a list of all files on your comp. larger than 90 mb. Look for any extremely big files that you don't recognize. This should help figure out what is eating up the space. Next we'll try to figure out what is causing the problem.

 

Hey Sach...hope you're still around...
I did what you said...files larger than 100,000.
Seems to be only movie files (mov, mpg4 sorts) and EA Games (The Sims). I never had problems with the movie files in the past and it has been a long time there.
checkdsk says that I've 85.99 GB file size of fragments (94,138 fragments) in the following file...that cannot be defragmented...
/documents and settings/all users/application

Also...I get an error message....svchost.exe application error.
The instruction at "0x745f2780" referenced memory at "0x00000000". The memory could not be "read.
Click OK to terminate or Cancel to debug...I've tried both.
Look forward to hearing from you. PLEASE!
Otherwise, I'm taking this machine to "The Geek Squad" later today....
Thanks.

 

I'm sorry, I should have said unhide system files first. In search window before searching, Tools>Folder Options>under the view tab put a mark in "show hidden files" and uncheck "Hide System files". Then redo the search and look for a very large file that could account for the 80gb.

Also while you have files unhidden go to the /documents and settings/all users/ and just mouse over the application data folder and see how large it is. I'm guessing that the problem might be in there.

 

:wave so happy you wrote back.
I found the space hogging file....

C:\documents and settings\all users\application data\microsoft\search\data\applications\windows\projects\system index\indexer\Ci Files\0001000

It has the 86 GB of used space I referrred to.
So now the big question...can I delete this darned file? I've been online trying to figure out what a Ci file is....I have a lot of them and I now know they've something to do with PHP whatever.
It is in the center of a long list of stuff in a CiFiles folder and there are MANY modifications withing this folder for that day.
Can't wait to hear back from you...or ANYONE FOR THAT MATTER.
I feel like I'm close to the solution and I'm dying to delete the file and save some money.

 

Ci stands for 'content indexing'. It is a regular Microsoft process but only needed if you are running a web server or large database from your pc.

Disable the service before you delete the file.

To disable the Indexing service, open Computer Management from Administrative Tools (on the Start menu if you enabled this, or from the Control Panel), select Services and Applications, double click Services, and find the Indexing Service. Double click to bring up the Properties window, and click Stop to let Windows stop the service. Then from the Status type drop down box select Disabled.

Incidentally your fancy defragger won't work well unless you also run chkdisk before a defrag. Another tip clear out temporary files , internet caches etc etc before defrag.

Studio T

 

Thanks for the prompt and clear directions.
Incidentally, when this all began I DID run chkdsk and cleared caches, etc. (I know that much is required ~ didn't want you to think I'm not terribly smart about these things ).
So, now I'll attempt what you said. Then I will run both chkdsk and defrag again to see that my hard drive is clear.
I'll get back to you with the results.
If I don't it's because it all failed and I destroyed my computer ....
Thank you so so so much.
Here I gooooo.......

 

Ok...I found the indexing service that you told me to shut down before deleting the questionable file. It appears that it already is shut down as it says Service Status: Stopped.
It also says (all of this is in the properties dialogue box you told me to view)
Path to Executable: C:\WINDOWS\system32\cisvc.exe
Startup Type: Manual
Also, under the Recovery Tab it has options for selecting the computer's recovery response should it fail and all three response possibilities are saying
"Take No Action".
Is this all proper? Should I go ahead and delete the file I have hogging the 86 GB? IF yes, should I then set this program to work?
Also, do you think this might be due to some sort of hacker attempt or some such thing?
Can't wait to hear from you...I'm extremely anxious to resolve this...I feel so close now.

 

I think the indexing service stops automatically when the disk space starts running out.
You can safely delete that large file. As proof if you simply rename it, restart and see that nothing else has failed then you can be sure.
Once the file has gone and the space is recovered you may need to stop the inexing service again. You don't need to remove the .exe etc files, they are small fry and you never know you may want the service in the future.
Microsoft default is off on setup but I expect it has been going since the year dot and someone has done alot of searching on your pc, although it is more likely to be housekeeping programs than a hacker.

Good luck

Studio T

 

You are correct in suggesting that lots of searches go on at my computer...we have two but I've also 4 kids (20, 18, 16, and 13) who use my computer. Although, I must admit, that the time and date of the creation of this file suggests that I was the one at the keyboard!
I also posted my query on a different website and I've received similar responses so I feel confident in following your suggestion to delete the file.
I am not sure how to rename this file, and I'm a bit worried that if I delete it and it has a negative effect on my computer, I may not be able to get back in.
I'm nervous.

 

I'm happy to defer to StudioT

Just so you know, I don't even have a Search folder in Application Data/Microsoft

 

To rename just right click the file, select rename, the name is highlighted, click once the name unhighlights and just add a few character to the end of the name ie. 0001000remove then enter.

Restart the computer. If all is well, delete the file. There should be no problem. Other than it may begin building up again.

 

ok...HERE I GO.
I renamed it to 0001000E.ciREMOVE
I will now shut down and restart.
Gosh I'm nervous!

 

I think the file was not created all at once it is an information file that keeps getting added to so long as the service is running. The date you refer to is probably the last access date, not the first.
I know that Microsoft defrag will not work if there is less than 15% free space on a drive. I wouldn't be suprised if indexing also stops at this figure. Both are useful processes in their place indexing make searches more and more efficient as the index grows.

Thanks Sachs for filling in the gaps

Studio T

 

OK y'all,
I renamed the suspicious file as recommended. I shut down and restarted my system and it apparently is a go since I'm online and able to respond to you.
I was aware of the disk limitations of the defrag program (min. of 15% available space). I am now going to remove the bad, renamed file. I will next run chkdsk and then defrag (which ought to take some time). I hope to get back to you and let you know how it turns out.
You've all been wonderful.
I am a high school math teacher and I maintain a webpage for my students (I teach in an all boys school). I keep a page of recommended links and don't you know that I've always had Major Geeks linked there! Of course the boys find it funny but, boy will they appreciate this story!
You're the best!

 

Glad to see you are still with us! I'm not convinced about the consistently adding to the file over a long time diagnosis. If you had a rough idea that you were only using 80gbs of space on your HD then the problem was probably recent and related to the irregular shutdown.

I would keep an eye on disk space over the next week or so. I've seen other posts about HD space rapidly disappearing. If you have further problems, I'll try to find and read through them.

*************
Oh, hide those protected system files before you let the kids on the computer.

 

YES SIR!:wave

 

Sach2 is dead on target to suggest keeping a wary eye on the search folders. I presume that now you have recovered some space you have checked again to make sure the service is still turned off?
As a matter of security I presume that you have taken the simple step of making all users limited users and reserving an administrator account for administrating the computer, not surfing the net. More than 75% of malware, including all rootkits, require an administrator environment to function.
Hope this helps

Studio T

 

You can be sure that I WILL periodically check the search folder. Glad you reminded me....guess I have to get back into that stuff to make certain it is turned off (is that what you said?). If you did tell me that, can you remind me of how to do that/check on that?
As for being the administrator...I am. I have other accounts set on the computer for my kids and my main account is password protected. Honestly, I think that the problem was my fault somehow...there was a day when I had to run out to work and I couldn't get the computer to shut down so I shut the surge protector (now I know NEVER to do that again!). I had to do a system restore at that time because I couldn't get to all of my stuff.
Hope to hear from you about the reminder...
by the way, is it safe to assume that maybe I ought to delete a bunch of the files in the search folder, where I found the bad file? Do they serve any serious purpose?
Thanks.

 

One of your users switched on indexing for a purpose. When they find out it is no longer working they will come and ask. then you will know what it was all about. If you keep the files you will be able to switch it back on again if the case is good enough. There are several files which can grow like Topsy and overwhelm windows; delteing the file sorts the problem and windows simply recreates them (hopefully in miniature).

I'm afraid you missed the point about administrator powers. No user, not even the system administrator, should surf the web whilst logged on as administrator. Professional administrators maintain 2 (or more) accounts; one for general use and one when they need to administrate the pc. I know this is off your original point but is the single most important secuity measure you can take. Passwords only protect you from others in the same house, not the internet.

Happy Geeking
Another fine math you've got me into ?

Studio T

 

HA HA HA HA HA
Love the math joke!

Yep, I did misunderstand you but at this point I'm just relieved to have this behind me now.
Again, you are the best....I so much appreciate all of your help. I hope to never need help of this magnitude again, but if I do, I also hope that I can find YOU.
:wave

 

It's actually the title of a book by Ian Stewart, author of many fine math books.

Studio T logging off

 

Hmm, what I know of kids at school suggests the purpose could have been:
a) boredom (random clicking around ensues...)
b) low skill ("Oops! I wonder what I just did??")
c) excess curiosity; ("What happens if I do this?") or
d) just general stuffing around to cause trouble!! ("Let's take the ball out of the mouse and change the keys on the keyboard around.")
There IS a remote chance that it was a student well-versed in computer usage... Very remote, but still a chance!

How big would you expect the Indexing System to get? (As in, is there some relationship between hard disk size, number of files, etc.?)
Would it be stored under C:\Documents and Settings\~username\Application Data\Microsoft and if not, where would I find it? Ours has been started running a couple of times but I think I got sick of waiting and stopped it before it finished so I don't know if I should expect to find it anywhere at all.

 

Post #13

Not every one has indexing turned on. This was an extreme case of topsy.
If you have the Google bars you also have Google indexing your pc!

Studio T