My Windows folder is 24GB in size, why?
Hello, I am having some problems with one of my computers and I am looking for some help. I have 2 computers that are almost identical, they are both Dell Dimension 2400’s running Windows XP Home Addition. The main difference between the 2 is that one has a 40GB hard drive w/ 1GB Ram while the other has a 80GB hard drive w/ 768MB Ram. For the most part, they both have the same programs installed on them and I don’t think the slight differences can account for the problem that I am having. Here is the problem; In Windows Explorer, the size of the “WINDOWS” folder on one computer is 2.42GB yet; the size of the same “WINDOWS” folder on the other computer is 24.0GB (almost 10 times as big). Being that the one that is extremely oversized is on the computer that only has a 40GB hard drive, you can see that it does not leave very much room on the hard drive for anything else and I am sure that that is what is causing said computer to run extremely slow when asked to do anything. I am not sure what is causing this but I have found some folders inside the “WINDOWS” folder on one computer that is not on the other. For starters, I had over 300 folders (yes, that was 300) with folder names that were “$NtUninstallKBXXXXXX$” where the “XXXXXX” is a six digit number (Ex. 951978). The folders had “Last Modified Dates” that extended all the way back to 2004 (around the time I bought the computer) up to the present time. I deleted all of them (saw no adverse affects) and freed up better than 1GB of space but I now see that I am having new ones being created every time I connect to the Internet. The other computer has no such folders like this and it is plain to see that there must be other unnecessary files or folders that account for the extra 20+GB of space being used up. So, my question to you is how can I go about eliminating all unneeded files and folders in the oversized “WINDOWS” folder so that I can free up more space without damaging any of the programs that are installed? And, what settings need to be changed so that this doesn’t continue in the future? Also, is it possible to put “WINDOWS” back to its original configuration when it wasn’t using up so much space? I guess it all boils down to the main question of “What should I do to solve this problem?” Any help will be greatly appreciated and if you need any details not provided, please let me know and I will get them to you as soon as I can. Thank you for your time and attention to this matter.1 person needs an answerI do too
April 25th, 2010 7:17pm

“$NtUninstallKBXXXXXX$” are uninstall files. You will not see any adverse effects until you decide to uninstall a program and receive the error message no uninstall file exits. Never just start deleting files or folders unless you are absolutely sure what you are deleting. This was a huge mistake. I hope you can recover them from the recycle bin. If not, you can try system restore. Unless they were windows files, however, it will not restore them. My suggestion to you is to download, update and choose a quick scan with Malwarebytes. At the conclusion of the scan a log file will be created. Copy and paste the log file in your reply. mbam direct dld Regards, JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 25th, 2010 7:54pm

Hi Joel, Thanks for the reply. I am not too worried about not being able to uninstall anything on the computer because (over the years) I have already uninstalled and deleted all that I could to try and free up disk space. There isn't anything left on the computer that I don't want to keep. Being that I have 2 computers, practically identical, bought (new) around the same time, running the same OS and other software, can you explain why 1 had over 300 “$NtUninstallKBXXXXXX$” folders and the other had zero? I figured if one could run without them, the other should too. So far, no problems. I downloaded the program you suggested and ran a scan. The log file is below and what infections where found have been corrected. I honestly don't see how this will solve my problem, but I am willing to try anything. If one of the infections were causing the excessive file size of the Windows folder, how is removing it going to delete all those unneeded files? It might stop adding more but I don't see it getting rid of the ones it already created. Anyway, thanks for your help. I know I have a lot to learn in this field and I hope your response to this will allow me to get a little closer to that goal. Ron P.S. I visited your website to vote but am not sure how. Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 4035 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 4/25/2010 1:53:33 PM mbam-log-2010-04-25 (13-53-33).txt Scan type: Quick scan Objects scanned: 116461 Time elapsed: 14 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 2 Registry Data Items Infected: 1 Folders Infected: 5 Files Infected: 6 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d7adf7c1-14fb-4110-b2df-187884cac12a} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Registry Defender (Rogue.Registry.Defender) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\SYSTEM32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\19312495 (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Program Files\MyWay (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\Registry Defender (Rogue.Registry.Defender) -> Quarantined and deleted successfully. C:\Program Files\Registry Defender\backup (Rogue.Registry.Defender) -> Quarantined and deleted successfully. C:\WINDOWS\SYSTEM32\UpMedia (Adware.SmartShopper) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\SYSTEM32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\19312495\formobj2.dat (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Program Files\Registry Defender\report.csv (Rogue.Registry.Defender) -> Quarantined and deleted successfully. C:\Program Files\Registry Defender\backup\11_2_2007.reg (Rogue.Registry.Defender) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent) -> Quarantined and deleted successfully.
April 25th, 2010 10:23pm

First, thanks for visiting my website. The website is not at all a part of MS Answers. the voting is done here on this site. I charge a fee on my site to do what I do here for free. The difference is the amount of time it takes to accomplish the task and, of course, on the site I do the work myself as opposed to giving instructions. Some are just not comfortable performing the necessary steps which is completely understandable. Time is also a factor for many since their computer is their livelihood they need it up and running fast with no time to wait a day or two for a reply on a forum such as this. I gotta say, however, the peeps who answer here are pretty efficient and very knowledgeable. As to your computer, click on the link below and download JDiskReport. Run it and locate the files/folders which are using the most space. These very well could be offline files. We will know more when you analyze the disk space. http://www.jgoodies.com/freeware/jdiskreport/index.html Regards, Joel Edit: Note that you can specify the Windows folder making it the only folder to be analyzed. You will then know for certain what is using all the space. The program is very informative for issues such as this. Also, I wanted to ask you if the computer has a recovery option and, if so, have you ever used it? Sometimes deciding which battle to fight is the toughest battle of all….. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 26th, 2010 2:00am

I have used the "System Restore" function in the past (quite a while since the last time). To be honest, I have had problems with this one computer since it first came out of the box. And none with the other. After running the Disk Report, it appears that the Windows folder is 24.2GB (62.7% of total space) and 19.8GB of that are ".msp" files located in the "Installer" folder. Below is a list of the most recent ones added to the computer. By the times and dates, I can see that these files are being added to my computer whenever I am connected to the Internet (I have dial up). Any ideas on what to do or what is going on inside this machine? If you need anything else, just let me know Thanks for your help, Ron 50 most recently modified files in C:\WINDOWS\Installer No. Name File Size Modified 1 C:\WINDOWS\Installer\c3f012.msi 176 KB Apr 25, 2010 8:06 PM 2 C:\WINDOWS\Installer\c3f00d.msi 564 KB Apr 25, 2010 8:05 PM 3 C:\WINDOWS\Installer\8966fc.msp 18.3 MB Apr 25, 2010 7:00 PM 4 C:\WINDOWS\Installer\1394c1a.msp 18.3 MB Apr 24, 2010 9:11 PM 5 C:\WINDOWS\Installer\a644e1.msp 18.3 MB Apr 24, 2010 10:26 AM 6 C:\WINDOWS\Installer\64af83.msp 18.3 MB Apr 23, 2010 8:58 PM 7 C:\WINDOWS\Installer\12e64a8.msp 18.3 MB Apr 23, 2010 11:38 AM 8 C:\WINDOWS\Installer\255e87.msp 18.3 MB Apr 22, 2010 11:32 PM 9 C:\WINDOWS\Installer\64a7f1.msp 18.3 MB Apr 22, 2010 6:36 PM 10 C:\WINDOWS\Installer\9c385e.msp 18.3 MB Apr 22, 2010 9:04 AM 11 C:\WINDOWS\Installer\1a1693d.msp 18.3 MB Apr 21, 2010 9:18 PM 12 C:\WINDOWS\Installer\1109c54.msp 18.3 MB Apr 21, 2010 11:05 AM 13 C:\WINDOWS\Installer\14dfb25.msp 18.3 MB Apr 20, 2010 11:30 PM 14 C:\WINDOWS\Installer\10fca3f.msp 18.3 MB Apr 20, 2010 11:01 AM 15 C:\WINDOWS\Installer\15ff7a3.msp 18.3 MB Apr 19, 2010 9:43 PM 16 C:\WINDOWS\Installer\12ff3f3.msp 18.3 MB Apr 19, 2010 11:38 AM 17 C:\WINDOWS\Installer\481a8e.msp 18.3 MB Apr 18, 2010 8:23 PM 18 C:\WINDOWS\Installer\cc14fe.msp 18.3 MB Apr 18, 2010 7:01 PM 19 C:\WINDOWS\Installer\a8f76e.msp 18.3 MB Apr 17, 2010 1:36 PM 20 C:\WINDOWS\Installer\6d8cad.msp 18.3 MB Apr 17, 2010 8:24 AM 21 C:\WINDOWS\Installer\109ed45.msp 18.3 MB Apr 16, 2010 9:47 PM 22 C:\WINDOWS\Installer\a6e1a.msp 18.3 MB Apr 16, 2010 2:49 PM 23 C:\WINDOWS\Installer\3745b.msp 18.3 MB Apr 16, 2010 1:34 PM 24 C:\WINDOWS\Installer\37456.msp 18.3 MB Apr 16, 2010 1:31 PM 25 C:\WINDOWS\Installer\563e00.msp 18.3 MB Apr 16, 2010 10:03 AM
April 26th, 2010 5:05am

Hello rwb181, Some googling shows that the .msp files can be either this: "the Windows Installer patch is a self-contained package that contains information regarding the specific versions of the application to which the patch is applicable, as well as information on the differences between the versions" Or this: "MSP file is a Monochromatic (black and white) image file created by Microsoft Paint. The MSP format is apparently being replaced by the more versatile Microsoft Windows BMP format." Since it would be wacky for your computer to generate Installer patches four times a day and patch files of a such a regular size, I would be inclined to think they are Paint files instead. Since the files are generated only when you are on the internet, my suspicius side thinks that maybe a rogue program on your computer is taking screen shots and storing them here. Your malwarebytes run did find some malware on the computer, after all. If you right click one of the .msp files and open it with MS Paint, and it comes up looking like a Black and White screen shot, you would have confirmed my suspicions. If that is the case, then backup and offload your data from the computer, and use the recovery discs to blow away the current installation of Windows and put down a fresh format and installation. By the way the other files "ntuninstall" are uninstallation files for Windows Updates. Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97
Free Windows Admin Tool Kit Click here and download it now
April 26th, 2010 4:41pm

Good instructions given by Dan. I am inclined to agree with his suspicions. This is especially true in light of the dates these files were created. As you can see, most were recent. As to reformatting, it is certainly a viable option. Or, in the alternative. you could simply delete the most recent files dating back to April 16th, then attempt to look for updates to your installed applications. Mostly you will be concerned with windows updates.Sometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
April 26th, 2010 7:45pm

Hi Dan and Joel, I did a search on .msp files also and discounted the Paint one because it was referring to an older file format and because of the location that the files were being stored at (the Windows/Installer folder) on my computer. To view the .msp files in Windows Explorer, I had to go into Tools/Folder Options and uncheck the box next to “Hide Protected operating system files (Recommended)”. Inside the Installer folder is 1 folder named “$PatchCache$” with another folder inside it named “Managed” that is faded out when viewed. Then there are about 50 folders with names like “{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}”. Inside them are, for the most part, executable (.exe) files, .mst files, or .ico (icon?) files. Most have only 1 .mst file or a small group of .exe files. The .mst files appear to be from companies that I have software from (Eastman Kodak for my Easy Share Software, Hewlett-Packard for my printer, stuff like that). I also see a lot of InstallShield from InstallShield Software Corp. The only other folders in the Installer folder are 1 named “BWKDLogs” (empty), “MSN Messenger 7.5.0311” (1 .msi file), and “tsclientmsitrans” (.mst files,.vbs files, a .dll file, and a .bat file). Inside the rest of the Installer folder is a long list of .msp files that have “Windows Installer Patch” located under their names along with a smattering of .mst and .msi files mixed in. As I mentioned in the previous post, the .msp files occupy almost 20GB of space. Is it possible that Windows is trying to do some sort of update or upgrade that just isn’t getting done? It seems to keep on downloading Windows Installer Patch files every chance it gets and I am (almost) willing to bet that after a given period of time, the “$NtUninstall$” folders will start to appear again. I hope this insight into my Windows folder has helped the two of you. If not, please let me know what you do need. I am grateful for your help, it is starting to look like this extremely long aged problem I have had with this computer might be near an end. Ron P.S. I forgot to mention that I did try to open one of the files with Paint and got this message “Paint cannot read this file. This is not a valid bitmap file, or its format is not currently supported.”
Free Windows Admin Tool Kit Click here and download it now
April 26th, 2010 8:35pm

Hello rwb181, Nice sleuthing work on the .msp files :-) But it's still wacky that this one installation of Windows wants to generate that many .msp files. Generating such big files must bog down the system somewhat. Is there any other unusual computer behavior that you can think of that could be associated with a wacked-out Windows installer? Based on what I have seen while searching on this issue, I don't have a good feeling about uncovering the magic solution. In the end it's likely that a repair reinstallation of XP using your Dell OS Reinstallation disc (or possibly winnt32.exe within the Dell \i386 folder if it is still on your HDD) will be the solution. A repair preserves your programs and data (but back up anyway!!) and replaces the existing Windows with a fresh installation of Windows, which will need to be updated of course. Before you do that, wait till joelj1964 posts, he may have a better idea :-) Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97
April 26th, 2010 9:03pm

Hi again, Here is some more information that might be helpful; As far as the dates, I only listed the most recent. I should have mentioned that there are a total of 1,434 files in the Installer folder and that the vast majority (by a long shot) of them are exactly 18,760 KB in size (identical?) and that the dates on them go back as far as 12/02/07. It would appear that something happened back then and this computer is still trying to finish it. I honestly can't remember what it could have been. I am starting to think that the problem is in the Windows XP installation or, possibly, in the service pack updates that took my computer from 1 to 2 and then 3. Hope this helped, let me know what you think I should do or what other diagnostics I can perform to isolate this problem. Ron Edit: Hi Dan, Just read your latest post. Wacked out behavior? Come to mention it, yes. The computer is always slow to react, sometimes, very slow. Another that is probably more helpful, if I go into the Control Panel and into Add or Remove Programs, I can't Add/Remove any Windows components. When I click on the option, I get this message "Setup Library ocgen.dll could not be loaded, or function OcEntry could not be found. The specific error code is 0x7e". I forgot all about that problem, it has been a long while since I made the attempt. Me thinks we are getting closer.
Free Windows Admin Tool Kit Click here and download it now
April 26th, 2010 9:18pm

Sorry about breaking this up. The only other problem I can think of is with my HP printer/scanner. I haven't used it for a long time but when I did, I would have problems getting the scanner part to initialize. Somehow a device driver was lost (I am sure it was my doing) and it keeps asking for it but, I can't provide it because I have lost the installation disk and could never find a copy of the driver it is asking for on the Internet. If I repeatedly click on the "Cancel" button, it eventually gives up asking and initializes the scanner anyway. I am starting to think that it is a good thing that I am not too close to either one of you, I would probably get a good whack in the arm and be called "You Idiot". Ron
April 26th, 2010 9:49pm

Hello Ron; As much as I wish I weren't, I am completely puzzled by your computer's behavior and beginning to think I fresh install of windows would be the both the easiest and best solution. I personally have no other options to offer you. Perhaps Dan has a solution other than this. I will certainly keep this topic marked and keep tabs on the progress and/or solution(s). Best of wishes with this and I am sorry I was not able to provide more assistance to you. Regards, JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 26th, 2010 10:32pm

No need to apologize, I am very grateful for your time and efforts in helping me with this matter (you too, Dan). Should I do a complete re-install or try to do a repair first, like Dan suggested? The things I would want to keep, for the most part, are already backed up on a flash drive but, my son has a lot of music files on the computer. Will re-installing windows erase them? I'll wait to see what you and Dan have to say before I get started. In the mean time, I'll dig out the original disks that came with the machine. Thanks for your help, Ron
April 27th, 2010 12:25am

I can only tell you what I would do if it were my computer. Since you have all relevant data backed-up, I would do a complete format and reinstall. This would ensure you would rid any type of infection you may have. Regards, Joel Sometimes deciding which battle to fight is the toughest battle of all….. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 27th, 2010 1:30am

Could this possibly be the problem? I left automatic updates turned on but turned off the automatic install feature so I could see what updates were wanting to be installed. Last night, and again this morning, I had an update for "Microsoft .NET Framework 1.1 Service Pack 1 (Update 1 of 1)". Both times, the initialization part went okay but it didn't complete the update, I got a statement that it couldn't be finished. After that, I went into Windows Explorer and had another .msp file that was 18,760 KB. Here is something else that seems strange. I have dial up and to download 18.7 MB of data it would take a good 2 hours or more yet, the time and dates on the latest .msp files are only minutes apart. Last night, I have one at 10:05 PM, 10:25 PM, and 11:03 PM (about the times I let the update run). And this morning, another one about 20 minutes ago (again, after I ran the updates). I am thinking that this file is the same file that is being renamed (over and over) to try the update process again after the first attempt failed. I went to the website that talks about this update but, felt a little intimidated after reading the instructions about trying to uninstall and re-install the NET Framework. Do you think I should go this route or just dump the whole thing and start over. This way, I might not have to re-install all the different software. Ron
April 27th, 2010 2:50pm

Hi Ron; Sounds like you may be on to something here. Read the article on the link below regarding the installation of NetFramework 1. file:///C:/WINDOWS/Microsoft.NET/Framework/v1.1.4322/1033/repairRedist.htm JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 27th, 2010 3:11pm

Hi Joel, I can do that, sounds much more straight forward and understandable than what I was reading. I do have a couple of questions though. "Obtain the original installation source". When I started this computer for the first time, everything was already installed (no set-up disks to run or anything like that). Does that mean that the "installation source" would be my hard drive? Or is it on one of the disks that came with the machine? The command line gives 3 different files (dotnetfx.exe, msiexec.exe, and ntfix.msi), I did a search on my computer and found the following for "msiexec.exe" MSIEXEC.EXE C:\I386 63KB 08/29/02 msiexec.exe C:\WINDOWS\SYSTEM32 77KB 04/13/08 msiexec.exe C:\WINDOWS\ServicePackFiles\i386 77KB 04/13/08 msiexec.exe C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e 77KB 04/13/08 Is one of these the one I am looking for? I did a search for the other 2 files and found nothing. I assume that I need all three of these files located somewhere on my computer (either on the hard drive or on a disk in the disk drive) for the repair to work, is that correct? And if so, is there a specific place they need to be located? From looking at the command line, it looks like I need to know where the "dotnetfx.exe" file is located, the "msiexec.exe" needs to be directly on the hard drive (not in any folder), and I am not sure about the last file. Ron
April 27th, 2010 4:11pm

It refers to one of the disc that came with your machine. Perhaps you should consider just ordering a windows xp pro disc with sp3 and be done with it. This would eliminate all that junk manufacturers put on the computer at the time of shipping as well. I personally have no desire for all that. If I want something on my computer I will put it...lol. I have a friend who owns a computer shop but I really do not know if he sells the disc or not. I can ask him if you'd like. Seems like the easiest solution to me.. just re-installing I mean. Let me know. I will be happy to ask him for you. Regards, Joel Sometimes deciding which battle to fight is the toughest battle of all….. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 27th, 2010 4:36pm

Thanks for the offer. You can ask him if you want, that way at least I would have an idea of what the disk might cost. At the moment, I'd like to try and do a re-install of the NET Framework. I'll go through the disks I have and see what's what. I was talking to my son and he informed me that there are also some software programs that he downloaded from the Internet that he doesn't want to lose. Some are pretty big in size so, if I could solve this problem by re-installing the NET Framework, we won't have to re-download the programs or worry about losing any of his music or videos. I'll let you know what I find, it might take a while. Ron
April 27th, 2010 6:13pm

Not a problem. I would like to suggest Mozy.com for saving your pics, music and other important data. There is a paid version and a free version. The free version provides you with 2gb of free storage. I use it myself and it works great. http://mozy.com/ Regards, JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 27th, 2010 6:24pm

Hi Joel and Dan, Here is what I have learned since last posting. Back in December of 2007, Windows Updates downloaded the Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) update. When I next shut down my computer, Windows Update tried to install it and failed. The computer then configured Windows Update to try again the next time updates were run and being that Windows Updates was set to “Automatic”, that was every time the computer was shut down (which is at least once each day with most days being multiple times). Each time it did this, among other things, it created an .msp file (18,760KB) in my WINDOWS\Installer folder. Also, since Windows Updates was set to Automatic, I was never informed of the failed update attempt and it just continued to happen over and over. That is what happened to my free space. I have changed the settings on Windows Updates so I can stop this particular update from trying to install for the present moment and have deleted all of the .msp files in question except the most recent one. I also ran my disk cleaner, defragmenter, and such things to tidy up the hard drive and look for any bad stuff. My free space went from 12% to 55% (4.5GB to 21GB). I also ran the .NET Framework repair but that didn't help. I booted the system this morning, let it sit idle for a while before performing any tasks, connected to the Internet ,and then waited for that to become idle. After that, I let Windows Update try to install the update in question and as expected, it failed. I then ran a search of the hard drive for any files that were modified today and from that list, I have compiled a text document of each portion of each log that was modified during this time. Would either of you be willing to look at it? I am hoping that, by doing so, you can determine what the best course of action would be to solve this problem. It’s a long file and I don’t see any way to attach it so, I guess I would have to send it to you? Thanks for your help. Ron
April 30th, 2010 10:10pm

I am not certain what, if anything, the file would reveal. Nevertheless, I would like to see it. You can use filemail.com to send the file. It will prompt you to enter an email address to the person you are sending the file to. However, you can simply leave that blank, upload the file, click send and the upload will begin. Leave that tab open until the upload is complete. A link to the page will be generated which you can copy and paste in your reply here. Thanks for keeping me informed. Great job by the way analyzing all of this. Kudos to you!! http://filemail.com Regards, JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
April 30th, 2010 10:42pm

Here is the link, I hope it is helpful. http://www.filemail.com/dl.aspx?id=OMUIXQGJFQHFUST Ron
May 1st, 2010 3:31am

As I suspected I am not knowledgeable enough to make any significant determination viewing the log. I can tell you that aswMaiSv is the mail scanner for Avast. Unless you use a computer based email program such as Outlook you can safely disable the mail scanner permanently choosing not to have Avast monitor that shield which will prevent the little yellow triangle from appearing on the Avast tray icon. the email scanner is beneficial only if you use a pc based email program. It provides no protection for web based emails such as Yahoo or MSN Also, it appears you have something running in the background which is using the files. I would ask if you have scanned your computer for malware with anything other than Avast? While Avast is certainly an excellent av, no av has a 100% detection rate. I use and recommend Malwarebytes for added protection. I'm simply taking stabs at a solution here but I have seen stranger things. Regards, JoelSometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
Free Windows Admin Tool Kit Click here and download it now
May 1st, 2010 7:16pm

Hi Joel, About the program running in the background, what log file did you see it in? I’ll take a look and maybe I can figure out what it is. As for Avast, it has 7 modules listed to protect different sub-systems on the computer; Internet Mail, Network Shield, P2P Shield, Standard Shield, Web Shield, Instant Messaging, and Outlook/Exchange. I terminated the last 2 and am thinking I don't need Network Shield either (if they are referring to a network of computers here in my home that are connected together). I’m not sure about P2P Shield. I previously downloaded Malwarebytes Anti-Malware (free version) and have since run both a quick scan and a full scan (twice) and the only bad files found were those I posted above from the first scan. I also ran a complete scan with Avast and it didn't find anything either. In addition to those two, I ran Windows Malicious Software Removal Tool (full scan), Windows Defender (full scan), Spybot-Search & Destroy, and Spyware Doctor. The first two didn’t find anything, Spybot and Spyware Dr. each found a couple of tracking cookies (which they usually do after I have been on the Internet). I also have Spyware Guard that runs in real time. My clean up tools (besides Disk Cleanup and Disk Defragmenter) are Advanced System Care, Smart Defrag, and Systweak BoostXP. Looking through the Windows Update log I see these entries that show the title and id of the problem update; 2010-04-30 09:19:02:531 996 f1c Agent * Updates to install = 1 2010-04-30 09:19:02:906 996 f1c Agent * Title = Microsoft .NET Framework 1.1 Service Pack 1 2010-04-30 09:19:02:921 996 f1c Agent * UpdateId = {6F5DC828-0F05-4577-9A8A-74AB1CBE00A9}.106 And then a little later these entries that give the failed error codes; 2010-04-30 09:19:55:718 3904 f50 Handler : WARNING: Command line install completed. Return code = 0x00000643, Result = Failed, Reboot required = false 2010-04-30 09:19:55:718 3904 f50 Handler : WARNING: Exit code = 0x8024200B 2010-04-30 09:19:55:718 3904 f50 Handler ::::::::: 2010-04-30 09:19:55:718 996 f20 AU >>## RESUMED ## AU: Installing update [UpdateId = {6F5DC828-0F05-4577-9A8A-74AB1CBE00A9}] 2010-04-30 09:19:55:718 996 f20 AU # WARNING: Install failed, error = 0x80070643 / 0x00000643 Then this entry that, I assume, sends a report about the failed attempt; 2010-04-30 09:20:00:718 996 210 Report REPORT EVENT: {A300DC32-57EC-40C8-B1AE-2409299D6184} 2010-04-30 09:19:55:718-0500 1 182 101 {6F5DC828-0F05-4577-9A8A-74AB1CBE00A9} 106 80070643 AutomaticUpdates Failure Content Install Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.1 Service Pack 1. And then, later on when the failed update is being set up to try again, I see this entry; 2010-04-30 09:20:28:562 996 210 DnldMgr * All files for update were already downloaded and are valid. Is it possible that even though the downloaded files for the update are considered “valid”, they might have been damaged (or incomplete) in some way when first downloaded from the Internet (it was most likely done over more than one connection period) and that is what is causing the update attempt to fail each time? And if so, could removing the downloaded update file from my computer so that it could be re-downloaded (or possibly, no longer needed being that it is such an old update) solve the problem? Or, what about removing .NET Framework 1.1 itself and having it re-installed? I'm not sure how that action would affect my computer. I look forward to your inputs (or anyone else’s for that matter). Ron
May 2nd, 2010 6:05pm

I forgot to ask you about something. I noticed that a number of the logs that were giving some kind of error, failed, or denial notice had “WBEM” either in the file name or in the location on my hard drive. Doing a search, I find files (and folders) with these letters in my Windows System32, Service Pack Files, and Software Distribution folders. Any idea what this program might be? Is it possible that this is the culprut? Somehow preventing the update to succeed (and that the update files might be okay)? Ron
Free Windows Admin Tool Kit Click here and download it now
May 2nd, 2010 6:28pm

Thanks Ron for the post. I will do some research and get back with you later in the day. Regards, Joel PS.. At this point I personally see nothing to loose by uninstalling Net FrameWork 1.1. If it were my computer I would download Windows installer clean-up tool and uninstall Net FrameWork 1.1. I would remove all files associated with the failed downloads and all duplicates which were taking up the space. Then reinstall and let the updates try again. The download page below. You have to look for the download link as it is about middle ways down. http://support.microsoft.com/kb/290301Sometimes deciding which battle to fight is the toughest battle of all.. Please visit my website @ http://repairbotsonline.weebly.com/ If I can take the time to answer you can take the time to vote to enable others to find solutions easier.
May 2nd, 2010 6:58pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics