Windows "0 bytes free of 0 bytes" error? malware?

htnakirs

Disciple
This question is unique since it seems google can't throw up a single source mentioning this problem - and its solution.

This is a relatives laptop with Win 8 installed.
What I have observed
A 500 gb HDD was partitioned into 4 NTFS partitions, with unallocated space in between. The disk is dynamic (and not basic - not sure who did this or how it happened)
The message above is seen when viewing C: in My Computer (under Windows EXplorer). But I can see all files under C:.
Under disk management, one can see C: with more than 100 GB allocated space, with more than 60 GB free.

Now, because Explorer identifies 0 bytes free, it comes with associated problems - no new software can be installed, (or uninstalled, because temp files can't be created), no boot time scan can be scheduled, everytime the system boots there is a Explorer error message which says Explorer has faced a "hard error" and needs to restart which it does and presents the desktop (no bsod).

Spigot which is a hijacker is detected, but that can't be the reason for this.

What I have done so far :
Thinking it was malware causing it, I first tried to run a Boot Time scan with Avast, that failed (as mentioned above)
Normal scan with Avast throws no malware worth mention. The two minor events couldn't be fixed (because of the error, I presume)
Disabled pagefile (approx 2 gb) and restarted, still it showed the same error.
Thinking it could be a disk error, ran disk check in Win 8 no errors. Ran chkdsk /f, which was unable to schedule a check on restart ( due to the error)

I removed disk and plugged it into another laptop running Linux, (where the accurate sizes are reported) deleted pagefile and hiberfil (which combined was over 6 GB). But on reconnecting to that laptop, it still shows the error
Plugged into another system running Win 7 and it showed up first as an invalid dynamic disk

AT THIS POINT, I DUG AROUND AND CONVERTED THE DISK TO BASIC USING A HEX EDITOR.

Now, I could see the partitions (lost one enroute, though!), but still the error persists in Win 7
Ran chkdsk in Win 7, no errors reported.

The status at present
The disk is a basic disk, with 2 partitions. The C: still shows the error.

I could take the easy route and format and reinstal, but that would be accepting defeat which is not acceptable.... yet.

So if anyone has any special tips to add let me know.
 

nRiTeCh

Skilled
Try combofix from bleepingcomputers.com.

Also install avast free anti virus and schedule it to do boot scan after reboot.

Post the result.

Your machine is infected hence it has preventing C from any local access though i hope your Windows is booting normally.
 

subhasis

Disciple
hkey_local_machine/system/controlser001/services/atapi
and
hkey_local_machine/system/currentcontrolset/services/atapi
Go to this entries and check out for the value ?
 

htnakirs

Disciple
Sorry for the delay in replying.

I have managed to solve the mystery of the error, and also the reason for the uniqueness of the situation.

Apparently, said relative was fooling around with the partitions and had enabled the Quota function. Disabling it solved the problem of the free space.

Try combofix from bleepingcomputers.com.

Also install avast free anti virus and schedule it to do boot scan after reboot.

Post the result.

Your machine is infected hence it has preventing C from any local access though i hope your Windows is booting normally.

Nothing can be installed or uninstalled due to the error.

I hope you have Admin privilledge on the system ?

Yes

Try malwarebytes I find it to work much better compared to other products.
Can't add anything due to the error.

hkey_local_machine/system/controlser001/services/atapi
and
hkey_local_machine/system/currentcontrolset/services/atapi
Go to this entries and check out for the value ?

I shall report the values.

FWIW, after solving this mystery, I am faced with another. The system will not allow access to any USB drive... not even read access.
From the little googling that I did, there seems to be no effective solution to this as well. The most common solution seems to add rights to the user under the security tab. But in my case on doing this, I get another error message that the changes cannot be saved on the drive.

There is something wrong... but whatever it is cannot be malware since so far, I have been able to use hijackthis and delete unwanted registry entries, plus a boot scan with Avast didn't throw up any serious faults. Also I have been able to set explorer to show all hidden and system files, something malware will not allow.

I am beginning to search through the group policy entries for any insights, but I doubt if I will find anything out of place there.

Any insights on this will also be helpful.
 

subhasis

Disciple
Can you post a screenshot of the error message you are getting , also in disk management does it show unallocated for the USB Drive .
 

htnakirs

Disciple
Sorry for the delay, again.
Thanks for the reply.
I solved this as well. I didn' think the relative would go group policy editing, but somehow he did manage to enable "deny access to usb" there. Probably some software was the culprit.
 
Top