# My computer memory is disappearing



## mibp (Jul 9, 2007)

My computer memory seems to be disappearing everytime I turn my comuter on. The C drive is now down to about 500 MB and in the last few weeks it has gone from being about 12 % free space to now being 1% free space of memory. 

I am not sure what to do but any help is appreciated Thanks.


----------



## Frank4d (Sep 10, 2006)

What is the total size for your hard drive (used plus free)?


----------



## mibp (Jul 9, 2007)

My c drive has 30 GB and my D drive has about 43 GB. But it is the c drive that just keeps disappearing.


----------



## Frank4d (Sep 10, 2006)

I would start with Disk Cleanup (Start > Programs > Accessories > System Tools > Disk Cleanup). Then delete cookies and history in your web browser.

That should free up a lot of space. Then if it starts rapidly decreasing again we need to figure out what is causing it.


----------



## mibp (Jul 9, 2007)

I do that a disk clean up every week as was told to by computer staff when first got my laptop and also i run a defrag but it now doesnt really defrag as there isnt enough space to do so.


----------



## Frank4d (Sep 10, 2006)

You could also delete old System Restore points. Or an application similar to Norton Go-Back may be eating up space.

Treesize may be useful for determining what is using the most space: http://www.jam-software.com/freeware/index.shtml


----------



## mibp (Jul 9, 2007)

Ok thanks. How do i find the system restore files i can delete. 

I have also run the treesize free V 2.1 but I am unsure what to do with the information. Sorry about the lack of knowledge on my part about what to do with things.


----------



## Knotbored (Jun 5, 2004)

Also empty your recycle bin


----------



## mibp (Jul 9, 2007)

Recycle bin is empty.

Still not sure about the system restore things.


----------



## Frank4d (Sep 10, 2006)

Deleting old restore points is all or nothing, but is safe to do if your PC is running OK. You would go to Control Panel and click System. On the System Restore tab there is a checkbox for turn off System Restore, then click apply. This will delete all system restore points. Then uncheck the box to turn system restore back on.

Another thing that eats hard drive space is Windows updates uninstall folders. These are typically located in C:\Windows and are named similar to $NtUninstallKBxxxxxx$. If yout PC is running ok and you are sure you don't want to uninstall any Windows updates (most people don't), these can be safely deleted.


----------



## WhitPhil (Oct 4, 2000)

Frank4d said:


> Deleting old restore points is all or nothing.


Under Disk Cleanup, More Options Tab, System Restore, Cleanup button.

This will remove all but the last restore point.


----------



## WhitPhil (Oct 4, 2000)

A couple of other areas to review:

1. System Restore size - Run Msconfig, System Restore, Settings and reduce the size to around 1 GB,
2. IE > Browser Cache - Reduce to around 15MBs
3. Recycle Bin - Right Mouse, Properties and adjust the size


----------



## Frank4d (Sep 10, 2006)

Yeah that's safer, good to keep at least one restore point.


----------



## mibp (Jul 9, 2007)

OK thanks have done most of these things now. I now have about 6% free memory which is a big start. 

I am still working on finding the c:/ windows uninstall things.

Thanks


----------



## mibp (Jul 9, 2007)

Ok so it has been a day and a bit since I did all the things to free up memory and now my memory is now back down to being about 2 % free memory again. I havent saved anything on my computer in the last few days so I dont understand where the memory keeps going.


----------



## Frank4d (Sep 10, 2006)

Aside from accidentally leaving a TV recorder running for hours (I have done this), I have no idea. Maybe it is time to check for a virus or other malware.

Click here to download HJTInstall.exe: http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?page=download
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.


----------



## mibp (Jul 9, 2007)

The link doesnt seem to work.


----------



## Frank4d (Sep 10, 2006)

I edited the link.


----------



## jerry_1987 (Jul 10, 2007)

search on google for hijack this..and u will get one official website of hijack this(freeware) u can download from der.


----------



## mibp (Jul 9, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04:53, on 12/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
D:\Tunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Plustek\OpticBook 3600\Am32Plus.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live Toolbar\msn_sl.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?linkid=677
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: txthlpBHO Class - {060235DC-6D84-47BD-95D7-A4EF5099A59D} - C:\PROGRA~1\TEXTHE~1\READAN~1\TE3219~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Tunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Action Express (OpticBook 3600).lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Device Detector 2.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: RemOwner.cmd
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?65f328a3868e489e9127c30335e852b6
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?65f328a3868e489e9127c30335e852b6
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: DM1Service - OLYMPUS Corporation - C:\Program Files\Olympus\DeviceDetector\DM1Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

--
End of file - 7892 bytes


----------



## Frank4d (Sep 10, 2006)

When you ran Treesize, what were the names of the 2-3 three largest folders and their sizes? Also, do you know what "RemOwner.cmd" is?


----------



## mibp (Jul 9, 2007)

I cant think what the RemOwner.cmd ( or whatever it is called) is.


----------



## mibp (Jul 9, 2007)

The tree size thing the largest folders

25,176MB Windows
4,472 MB Program Files
541MB Documents and Settings

Is this the information I was meant to give?


----------



## Frank4d (Sep 10, 2006)

The Windows directory should be more like 4,000-6,000 MB, so that is where the problem is. Next to find out what is causing it to be so large, you need to dig a little deeper.

Use TreeSize and click the + next to the Windows folder. Post back the names and sizes of the largest 2-3 folder indented under it.


----------



## mibp (Jul 9, 2007)

Under the Windows folder in tree size the three biggest folders are:

22,599 MB Installer
1,218 MB system32
194 MB SoftwareDistribution


----------



## Frank4d (Sep 10, 2006)

Sorry this is taking so long, but we are making progress. "Installer" should be much smaller (it is about 750MB here).

Cllick the + next to the "Installer" folder. Post back the names and sizes of the largest 2-3 folders indented under it.


----------



## mibp (Jul 9, 2007)

22,518MB [Files]
46MB $PatchCache$
16MB MSN Messenger 8.1.0178
16MB MSN Messenger 8.1.0106


----------



## Frank4d (Sep 10, 2006)

Almost there. Open a command prompt (cmd) and type: DIR C:\Windows\Installer > C:\dir.txt

That will create a text file dir.txt in C:\ which is a directory listing of all files in the Installer folder. Post that file here as an attachment.


----------



## mibp (Jul 9, 2007)

Here is the attatchment


----------



## Frank4d (Sep 10, 2006)

Hmmm... a whole bunch of files that are each 97MB.  Let me see what I can do with these.


----------



## Frank4d (Sep 10, 2006)

23.4 GB of these files are from MS Office Update. When Office gets updated the installer puts these files here so you can uninstall the updates later, and also keeps track of what updates have already been installed.

I haven't been able to find a documented cause or fix anywhere. We can delete them, the downside of which is that you won't be able to uninstall MS Office using Add and Remove Programs, and may not be able to install Office service packs. And the downside of keeping them is that you are out of hard drive space. Doing so won't delete Office, it only deletes the uninstaller files. It's up to you.

To delete them you would open C:\Windows\Installer and sort the list by Type. Then highlight the "Windows Installer Patch" (MSP extension) files, and hit delete. Since this is going to free 70% of your hard drive, it would be a good idea to do a Defrag afterward.

I don't trust one of your other files "RemOwner.cmd" (I work under the assumtion it is probably not good if Google has never heard of it). Can you search for its location, make a copy, and change the extension on the copy to TXT. Then attach it here.


----------



## mibp (Jul 9, 2007)

Ok thanks. So i delete all the windows installer patch and then defrag. 

Is this problem going to happen again and again?


----------



## mibp (Jul 9, 2007)

I search for the RemOwner.cmd and it is apparently a Windows NT command. I am not sure how to copy the info into a txt file. I try and find out.


----------



## IanM1981 (Feb 19, 2008)

Remowner.cmd


I'd imagine your computer came from Microlink. Remowner is used during their loading system as part of the preconfiguration and personalisation that they do when setting up the machine and loading extra software. The file itself should have self deleted but does leave a registry entry in the startup items.


----------

