My C drive is around 80gb and, this morning, I was using around 45gb (there was about 35gb free). I left my PC running when I went to work. When I got home, there was a balloon in the lower right corner which read: You are running very low on disk space on C. To free space on this drive by deleting old or unnecessary files, click here. I thought this was odd so checked My Computer and it told me I had 3mb space left. I really didn't understand this, so decided to restart, hoping this would sort it. When my computer restarted, a few error windows popped up, informing me that various applications could not start as the system was shutting down. Then, a window with a black background appears, with: C:\Documents and Settings\Administrator>shutdown -s -s -2 appears. The message repeats itself over and over at a rapid speed. The scroll bar in this window reduces in size massively in just one second. Then, my system shuts down, completely by itself. I can't keep the thing on for long enough to even begin trying to find out what's wrong with it. I don't know what's causing this at all. But it's very irritating. I've tried browsing to see if anyone has a similar problem but can't find anything. Any help would be greatly appreciated. Thank you.

[Reply or follow-up to this message]

How about safe mode? It sounds like a batch file is running with the shutdown command.

[Reply or follow-up to this message]

Thanks for your reply Deb. I managed to get my computer running by very quickly crossing off the 'shutdown command' that appears. I am currently running a few virus scanners to see what I can find. Unfortunately, I'm not very clued-up when it comes to computers and I've never really had a problem like this before. My computer is still telling me I have no space left on C. I have deleted a few files and freed up around 400mb. This appears to be enough to stop the 'Low disk space' balloon from appearing, but I really want to know what has used my free 35gb space up in just one day, without my knowledge. And I wanna fix it. I will inform you of the virus/spyware scan results and the results of a startup in safe mode.

[Reply or follow-up to this message]

Also, I have tried running a system restore, but my computer has no system restore dates, other than my last startup (around 20 minutes ago). I don't understand this either as I've had system restore activated ever since I got my computer. Thanks for all your help.

[Reply or follow-up to this message]

The virus/spyware scans found nothing. The box that the error message "C:\Documents and Settings\Administrator>shutdown -s -t -2" appears in has "c:\windows\system32\cmd.exe" as its title. I am really stumped here and would really appreciate any help anyone can offer me,

[Reply or follow-up to this message]

well that's a command prompt screen. 

What scans have you run? Have you ran an online antivirus/spyware scan such as Trendmicro?


http://housecall.trendmicro.com/

[Reply or follow-up to this message]

I ran AVG Free Edition, AVG Antispyware and Avast Antivirus. I also ran Spybot S&D. I will try your recommendation and let you know. Thanks.

[Reply or follow-up to this message]

Boot to Safe Mode. Open Windows Explorer and navigate to

C:\Documents and Settings\youruserid\Local Settings\Temporary Internet Files.

Delete everything there. Ditto for C:\Documents and Settings\youruserid\Local Settings\Temp.

Right click on the Recycle Bin, select Properties. Reduce the space to 2%.

Open System Restore, click on "System Restore Settings". Select your hard drive then click the Settings button. Move the slider to reduce the space to 400 or 500MB.

That should free up some space but it you went from 35GB free to 3MB free there is something wrong or you have a serious malware infection. If you can, download and install SequoiaView. That will give you a good visual picture of what is occupying all the space on your hard drive.

[Reply or follow-up to this message]

Thank you, Rich Kurtz. I installed SequoiaView. The file that seems to be taking up the most space is C:\WINDOWS\Help\Mswnsk95.chm (30gig). The size of this file is 30gb. The date under 'Date Modified' is December 5, 2007, 9.51pm. Both of these factors seem consistent with my problem. I have browsed both my dad's and my brother's computers and cannot locate this file on either. Could this be a/the source of my problem? I'll do a little 'Googling' on [B]Mswnsk95.chm[/B]. Thanks.

[Reply or follow-up to this message]

"chm" is normally a help file of some kind. 30GB seems a tad large for a help file. It's either some kind of malware you've picked up or some software install that has gone nuts. Delete it. Doesn't matter if some program needs it or not, it should definitely not be there and absolutely not that size.

Do you have Windows Update set to run automatically? If so, perhaps something it downloaded went nuts and created that file.

If it comes back then you have some malware on your computer, so follow directions at any of the following sites. The folks there are dedicated to malware removal and will be able to help you determine if your system is infected and if so how to clean it up. They require that you register but they are all free. Also be patient as they are usually very busy:

GeeksToGo
WhattheTech (formerly Tom Coyote)
Spyware Beware

[Reply or follow-up to this message]

Thanks.

A Google search on this supposed help-file retrieves nothing what-so-ever. I have since deleted the file and restarted my computer. However, at startup, I still receive the shutdown command prompt. I had to do a few restarts... had to physically place a plasticine marker on my monitor over the 'x' of the command prompt so I could keep clicking there to bypass it on the next startup!

The file, however, does seem to be the one that was taking up all of my space as I now have 33.7gb of space again and I am not noticing any problems as of yet. But as I said, a Google search retrieved nothing and the file was not present on either my dad's or my brother's computers.

So now, I need to fix this damn shutdown command prompt.

[Reply or follow-up to this message]

I noticed various users saying you should only ever have one antivirus installed whilst trying to find other threads about similar problems and have since uninstalled Avast. I have had a look through the startup processes and those I don't recognise I have listed below and Googled. "C:\WINDOWS\SoftwareDistribution\Datastore\Logs\edb 0002.bat" - couldn't really find any information on this, except for in a couple of Polish user forums. No help there then. "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t - I've been told this is rooted in 'Common Files' and has something to do with Java updates, but I'm not sure about the '-t' at the end of it. What does this mean? Forgive my naivety! Other than these, I can't really see anything that odd. Everything else relates to a program I have installed or various drivers. I'm going to disable both of these startup processes and try a restart. I have also disabled a bunch of processes for a few programs (Real Player automatic updates, etc... nothing important). I'll be back.

[Reply or follow-up to this message]

A good sign...

The computer managed to start twice without the need of rapid clicking at 'point x', literally. I performed 2 restarts to make sure the first one wasn't a fluke. In other words, the shutdown command didn't appear this time.

System Configuration Utility appeared, informing me I'd made changes to the way Windows starts but I'm gathering that this is normal.

2 restarts in a row with no hassle. The joy! So I'm guessing the problem lay within one of these processes? I'd still like to, in some way, figure this out with Icrontic's help, if I may.

Here's a list of everything I disabled:
edb0002.bat
NeroCheck.exe - Nero burning ROM update check
QTTask.exe - Quicktime update check
SaiSmart.exe - Gamepad profiler application
jusched.exe - Java update check
winampa.exe - Winamp application
LASTFM~1.exe - Last.fm application

Currently in a good mood. I'll go to work happy now, unlike yesterday...

[Reply or follow-up to this message]

It would be a good idea to run the check disk utility and do a disk defragment. If you have one back up your data to a usb hard drive so that if your internal HD goes crazy again you'll at least have your data backed up.

[Reply or follow-up to this message]

Congratulations!

[Reply or follow-up to this message]

Matt, I would say the edb002.bat file was the culprit. Did you look at the file to see what it has in it? That would be interesting to know.

dwtrig20.exe has something to do with MS's Dr. Watson stuff so is okay, but definitely does not need to start at boot time so disabling it is a good idea.

jusched.exe is the Java Update Scheduler and doesn't need to start at boot time either. You can check the Java site once a month or so to see if any update is available.

[Reply or follow-up to this message]

Unfortunately not, I just wanted to get the file off of my computer. It definitely was the culprit, as I've since had no problems at all. I just still don't understand how it got there in the first place. But thanks for all of your help, everyone. I will stick around and try to help others.

[Reply or follow-up to this message]

A customer/friend had the same problem, the file edb002.bat contains hundreds of lines of the shutdown command. The file was suspected to have been installed from a COD4 mod.


On Friday, December 7, 2007 at 6:12 pm, Rich Kurtz wrote:
>Matt, I would say the edb002.bat file was the culprit. Did you look at the file to
>see what it has in it? That would be interesting to know.
>

dwtrig20.exe has something to do with MS's Dr. Watson stuff so is okay, but definitely
>does not need to start at boot time so disabling it is a good idea.
>

jusched.exe is the Java Update Scheduler and doesn't need to start at boot time
>either. You can check the Java site once a month or so to see if any update is available.

[Reply or follow-up to this message]

"COD4 mod"??? Call Of Duty 4? mod = module = program = executable?

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum