Bob-PC (D:) is nearly full. What to do?

[Bobh]

Patio -
I remember you told me once before to stay out of D drive and I have.  I do not know how D is being filled up but it is not by me.  What I am afarid of is that when D gets full my computer will quit working.

[kpac]

O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup

BigFix can automatically download and read technical support information provided by computer and software manufacturers and other technical support experts (published in the form of Fixlet® Messages) and can automatically check your computer for bugs, configuration conflicts, and security holes. Should only be started manually as it's a resource hog

C:\Windows\system32\NOTEPAD.EXE

Your computer is infected. Visit the virus section to get the PC cleaned up.

There are probably more problems (one of them being RSIT is a temp folder), but someone else will take care of them in the malware section.

[Bobh]

Kpac -
Thanks -  I recently (last week) I ran a full factory restart.  There should not have been any virus then.  Since then I have used Norton Security and just now ran a full scan by Norton.  They found only one cookie and fixed it.  Do you still think I have a virus?  I deleted Big Fix because it never did anything that I could see and I thought it would free up space.  If I use the address you gave will it get Big Fix back?Thanks    Bob

[Bobh]

I opened the temporary files and found a lot of them.  I didn't count them but there was a lot.  Are these files used for some purpose and then filed away.  If they have no future use I could delete them and gain back a lot of space.  What advise do you have about this?   Thanks    Bob

[kpac]

Do you still think I have a virus? 

Yes, using Nortan being one reason.

Okay seriously, yes I think you do have a virus. notepad.exe (see my last post) should be in "C:\Windows", from what I can see, not "C:\Windows\System32\". I would recommend visiting the Virus and Spyware board now.

ThreatExpert
SystemLookup
ProcessLibrary
BleepingComputer

[Bobh]

Kpac -
Yes I have heard that about Norton before.  I plan on changing as soon as I get my low disk space straightened out.  Now about your suggestion of checking for virus.  Can you give me more detailed way to do that.  Note that I no longer have Big Fix.  Thanks   Bob

[kpac]

I plan on changing as soon as I get my low disk space straightened out.

If you want any suggestions, just ask.

Can you give me more detailed way to do that.

No problem. Read the information posted here: http://www.computerhope.com/forum/index.php/topic,46313.0.html
Then start a new topic here: http://www.computerhope.com/forum/index.php?action=post;board=7.0, refer to this topic, and post the three logs.

Good luck.

[Bobh]

Kpac -
Bear with me I am slow and not to smart about computers.  In your first link it talked about XP.  I am running Vista Home Basic and I don't know weather or not I have SP 1.  Will this make any difference?   Bob

[kpac]

It's alright.

if running XP, you need to have at least SP1a installed as well.

if is a powerful word.

Only joking with ya. You can start here: http://www.computerhope.com/forum/index.php/topic,46313.msg290095.html#msg290095

[Bobh]

Kpac -
OK   I started and checked my programs.  I only deleted 1 which was log of some kind.  I got to downloading CCleaner and it said to put it on my desktop.  How do I do that.  I have seen other instructions in the past that said download to the desktop but I have never done that.

[Bobh]

Kpac  -
Have to leave now for a social event.  Will try to finish tomarrow.  Thanks for your help and time.   Bob
 

[BC_Programmer]

Yes, using Nortan being one reason.

Okay seriously, yes I think you do have a virus. notepad.exe (see my last post) should be in "C:\Windows", from what I can see, not "C:\Windows\System32\". I would recommend visiting the Virus and Spyware board now.

And yet, on both my Vista and XP PC, notepad resides in both System32 and Windows.

But carry on.

[Bobh]

Kpac -
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/13/2009 at 10:51 AM

Application Version : 4.26.1004

Core Rules Database Version : 3938
Trace Rules Database Version: 1881

Scan type       : Complete Scan
Total Scan Time : 00:20:54

Memory items scanned      : 667
Memory threats detected   : 1
Registry items scanned    : 5155
Registry threats detected : 32
File items scanned        : 18322
File threats detected     : 31

Adware.SystemSearchDispatch
   C:\PROGRAM FILES\SYSTEM SEARCH DISPATCHER\1.2.0.750\SSD.DLL
   C:\PROGRAM FILES\SYSTEM SEARCH DISPATCHER\1.2.0.750\SSD.DLL
   HKLM\Software\Classes\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\InprocServer32
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\InprocServer32#ThreadingModel
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\ProgID
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\Programmable
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\TypeLib
   HKCR\CLSID\{CDBFB47B-58A8-4111-BF95-06178DCE326D}\VersionIndependentProgID
   HKCR\ExplorerBar.FunRedirector.1
   HKCR\ExplorerBar.FunRedirector.1\CLSID
   HKCR\ExplorerBar.FunRedirector
   HKCR\ExplorerBar.FunRedirector\CLSID
   HKCR\ExplorerBar.FunRedirector\CurVer
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}\1.0
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}\1.0\0
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}\1.0\0\win32
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}\1.0\FLAGS
   HKCR\TypeLib\{883DFC00-8A21-411d-956C-73A4E4B7D16F}\1.0\HELPDIR
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CDBFB47B-58A8-4111-BF95-06178DCE326D}
   HKU\S-1-5-21-3206373129-98774604-3863853047-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CDBFB47B-58A8-4111-BF95-06178DCE326D}
   C:\Program Files\System Search Dispatcher\1.2.0.750\Data\eacore.mx
   C:\Program Files\System Search Dispatcher\1.2.0.750\Data\URLDynamic.mx
   C:\Program Files\System Search Dispatcher\1.2.0.750\Data\URLStatic.mx
   C:\Program Files\System Search Dispatcher\1.2.0.750\Data
   C:\Program Files\System Search Dispatcher\1.2.0.750\unins000.dat
   C:\Program Files\System Search Dispatcher\1.2.0.750\unins000.exe
   C:\Program Files\System Search Dispatcher\1.2.0.750
   C:\Program Files\System Search Dispatcher
   HKCR\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1}
   HKCR\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1}\ProxyStubClsid
   HKCR\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1}\ProxyStubClsid32
   HKCR\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1}\TypeLib
   HKCR\Interface\{480098C6-F6AD-4C61-9B5C-2BAE228A34D1}\TypeLib#Version

Adware.DesktopSmileyToolbar
   HKU\S-1-5-21-3206373129-98774604-3863853047-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617ECA9-488D-4BA2-8562-9710B9AB78D2}
   HKU\S-1-5-21-3206373129-98774604-3863853047-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{5617ECA9-488D-4BA2-8562-9710B9AB78D2}

Adware.MediaAccessStartup
   C:\Program Files\Media Access Startup\1.3.0.790\Data\config.md
   C:\Program Files\Media Access Startup\1.3.0.790\Data
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome\content\HPAddOn.js
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome\content\HPAddOn.xul
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome\content
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome\HPAddOn.jar
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome
   C:\Program Files\Media Access Startup\1.3.0.790\FF\chrome.manifest
   C:\Program Files\Media Access Startup\1.3.0.790\FF\components\HPFFAddOn.dll
   C:\Program Files\Media Access Startup\1.3.0.790\FF\components\HPFFAddOn.xpt
   C:\Program Files\Media Access Startup\1.3.0.790\FF\components\HPFFHelperComponent.js
   C:\Program Files\Media Access Startup\1.3.0.790\FF\components
   C:\Program Files\Media Access Startup\1.3.0.790\FF\install.rdf
   C:\Program Files\Media Access Startup\1.3.0.790\FF
   C:\Program Files\Media Access Startup\1.3.0.790\HPCommon.dll
   C:\Program Files\Media Access Startup\1.3.0.790\HPIEAddOn.dll
   C:\Program Files\Media Access Startup\1.3.0.790\hppx.exe
   C:\Program Files\Media Access Startup\1.3.0.790\MAHelper.exe
   C:\Program Files\Media Access Startup\1.3.0.790\unins000.dat
   C:\Program Files\Media Access Startup\1.3.0.790\unins000.exe
   C:\Program Files\Media Access Startup\1.3.0.790
   C:\Program Files\Media Access Startup

Adware.JuicyAccess
   HKU\S-1-5-21-3206373129-98774604-3863853047-1000\Software\DoubleD
   HKLM\Software\DoubleD
   HKLM\Software\DoubleD\DoubleD

[Bobh]

Kpac -
Malwarebytes' Anti-Malware 1.37
Database version: 2271
Windows 6.0.6000

6/13/2009 11:47:04 AM
mbam-log-2009-06-13 (11-47-04).txt

Scan type: Quick Scan
Objects scanned: 70133
Time elapsed: 3 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[patio]

Again D: is supposed to be nearly full...it's a Recovery partititon...