C disk filling up by itself

[Malnutrition]

https://pchelpforum.net/r/how-to-free-up-space-on-my-solid-state-drive-hard-drive.231/

[Bruce]

@Data838 - any progress?

[Data838]

Wow, your site was down, so I’m glad you’re back.

I launched Indexing Options, it said that nothing was happening, nevertheless I left it for approx. 4 hours and still nothing happened.

@Data838 - any progress?

[Bruce]

Where are we with the C:\ filling up?
Have you done WizTree again and compared the results from before?

[Bruce]

@Data838 - still need help?

[Data838]

Yes, sorry, I had quite a complicated week, so I couldn’t get back here, although I saw your response. For some time the amount of free space in the C disk stayed the same, and now I see that I have lost some 3 GB again. There aren’t any new files, I haven’t downloaded anything new either.

[Malnutrition]

@Data838 would you like to check the machine with FRST as we did before. Seemed to help you last time. ???

[Bruce]

3GB could be pagefile, hibernation file, temp files, browser cache - to name the most common.
I wouldn’t be concerned if only 3GB has changed in one week.

Run CCleaner to clean up the crap.

[Data838]

@Data838 would you like to check the machine with FRST as we did before. Seemed to help you last time. ???

Thank you. Tbh, it never really stopped, because it kept filling the disk as before. The difference is that every time I restarted my laptop, it regained the space that was filled up. Now, I still can’t get back some 10-12 GB.

I didn’t have time to run CC cleaner because of some programs I can’t close but will do it for the next time. If I remember correctly, you needed 2 FRST files posted, so I attached them to my post.

[Malnutrition]

There are a lot of things running on your machine…

Do you use one drive?
Do you use bitlocker?
Do you use Edge?
Are you a gamer?

There are these…

[COLOR=rgb(184, 49, 47)]S3 CaptureService; C:\WINDOWS\System32\CaptureService.dll [130560 2021-12-27] (Microsoft Corporation)

The primary role of CaptureService.dll is to facilitate screen capture capabilities within the Windows environment, particularly for applications that call upon the Windows.Graphics.Capture API. This service allows these applications to capture screen content efficiently and reliably.

---

I’d like you to run this tool, disable anything you are not using. Go thru the list and check each box that you are not using, or it might be easier to check everything, then re enable anything if you are missing something you like.

https://www.w10privacy.de/english-home/

---

---

Percentage of memory in use: [COLOR=rgb(184, 49, 47)]82%[/COLOR][COLOR=rgb(184, 49, 47)]

Need to free up some ram as well, I imagine the machine is a bit sluggish. Uninstall Any Unwanted Software And Apps: There are two programs to manage your Apps and Software:

GeekUninstaller: ============> Click Here.
O&O App Buster: =.=========> Click Here:

Remove any items from startup that are not needed.. Keep only a couple that you use most, you can not run everything at one time and you can start anything you like at anytime. Disabling from start will save resources.

Check startup apps. ============> Click Here
What’s in startup. ============ > Click Here
TaskSchedulerView.============> Click Here

Then rerun FRST and post new logs.[/color][/COLOR]

[Malnutrition]

From your logs. Are you aware of this?
[COLOR=rgb(184, 49, 47)]Is this a work/business computer?

FirewallRules: [Microsoft-Windows-DeviceManagement-CertificateInstall-TCP-Out] => (Allow) %SystemRoot%\system32\dmcertinst.exe
FirewallRules: [Microsoft-Windows-DeviceManagement-deviceenroller-TCP-Out] => (Allow) %SystemRoot%\system32\deviceenroller.exe
FirewallRules: [Microsoft-Windows-DeviceManagement-OmaDmClient-TCP-Out] => (Allow) %SystemRoot%\system32\omadmclient.exe

https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune

https://www.microsoft.com/en-us/secu...crosoft-intune

[COLOR=rgb(184, 49, 47)]Microsoft Intune: Microsoft Intune provides a feature called [COLOR=rgb(184, 49, 47)]Remote Help, which is a cloud-based solution designed for secure help desk connections. This feature [COLOR=rgb(184, 49, 47)]allows support staff to remotely connect to a user’s device, enabling them to [COLOR=rgb(184, 49, 47)]view the device’s display and, if permitted by the user, take full control of the device. This capability is particularly useful for IT support teams who need to assist users with troubleshooting and resolving issues on their devices.

Do you have company portal installed?

https://apps.microsoft.com/detail/9wzdncrfj3pz?hl=en-US&gl=US

https://www.android.com/enterprise/enrollment/[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR]

[Data838]

There are a lot of things running on your machine…

Do you use one drive?
Do you use bitlocker?
Do you use Edge?
Are you a gamer?

There are these…

[COLOR=rgb(184, 49, 47)]S3 CaptureService; C:\WINDOWS\System32\CaptureService.dll [130560 2021-12-27] (Microsoft Corporation)

The primary role of CaptureService.dll is to facilitate screen capture capabilities within the Windows environment, particularly for applications that call upon the Windows.Graphics.Capture API. This service allows these applications to capture screen content efficiently and reliably.

---

I’d like you to run this tool, disable anything you are not using. Go thru the list and check each box that you are not using, or it might be easier to check everything, then re enable anything if you are missing something you like.

https://www.w10privacy.de/english-home/

---

---

[/COLOR]

[COLOR=rgb(184, 49, 47)]
A lot of things to work on . I’ll answer the first part of your post for now and later will try to go through everything related to the memory in use.

So, the answer to the first 3 questions is no. As to gaming, I do play games but they aren’t heavy ones like GTA for instance. E.g., the last game I downloaded was last year and it was about 350 MB.

I tried to paste C:\WINDOWS\System32\CaptureService.dll into File Explorer but it wants an app form my apps list that could open it, so I’m not sure how to proceed with this.

Yes, and I also ran CCleaner, though I think there wasn’t anything particular that was cleaned, just usual stuff.

Thank you.[/color]

[Data838]

From your logs. Are you aware of this?
[COLOR=rgb(184, 49, 47)]Is this a work/business computer?

FirewallRules: [Microsoft-Windows-DeviceManagement-CertificateInstall-TCP-Out] => (Allow) %SystemRoot%\system32\dmcertinst.exe
FirewallRules: [Microsoft-Windows-DeviceManagement-deviceenroller-TCP-Out] => (Allow) %SystemRoot%\system32\deviceenroller.exe
FirewallRules: [Microsoft-Windows-DeviceManagement-OmaDmClient-TCP-Out] => (Allow) %SystemRoot%\system32\omadmclient.exe

https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune

https://www.microsoft.com/en-us/secu...crosoft-intune

[COLOR=rgb(184, 49, 47)]Microsoft Intune: Microsoft Intune provides a feature called [COLOR=rgb(184, 49, 47)]Remote Help, which is a cloud-based solution designed for secure help desk connections. This feature [COLOR=rgb(184, 49, 47)]allows support staff to remotely connect to a user’s device, enabling them to [COLOR=rgb(184, 49, 47)]view the device’s display and, if permitted by the user, take full control of the device. This capability is particularly useful for IT support teams who need to assist users with troubleshooting and resolving issues on their devices.

Do you have company portal installed?

https://apps.microsoft.com/detail/9wzdncrfj3pz?hl=en-US&gl=US

https://www.android.com/enterprise/enrollment/

[/COLOR][/COLOR][/COLOR][/COLOR][/COLOR]

[COLOR=rgb(184, 49, 47)][COLOR=rgb(184, 49, 47)][COLOR=rgb(184, 49, 47)][COLOR=rgb(184, 49, 47)][COLOR=rgb(184, 49, 47)]
Thank you for your post.

It’s a personal laptop.

I’m not sure what to do with the FirewallRules and 2 other links ?

Is the help provided only if it’s a work computer?[/color][/color][/color][/color][/color]

[Malnutrition]

For now just uninstall anything you feel can go, disable the startup apps, startups and scheduled task with tools provided.

If this is not a work computer then there is no need for Microsoft intune software. During this process we will search for remnants of the software and disable associated services. Although the software is not malicious, it could be used for malice intent especially if you did not install or know anything about it.

After you have completed these task, we will hold off on FRST scan. I want to use another tool first. But you are running FRST from your downloads folder and it should be on your desktop, any of these tools I have you run you should always right click and run as Administrator in order for them to function properly.

Download ZHP Suite to your desktop.
Unzip it there.
Right Click Run as admin.
Hit the scanner button.
Once it is complete a file name ZHPdiag.txt will be on your desktop.
Attach it.

[Malnutrition]

I’m not sure what to do with the FirewallRules and 2 other links ?

Nothing, this was to show you what is running on your machine. Also, to verify you do not have or have had any software installed that correlates to Microsoft Intune

So you clean up a bit then run ZHP suite for me and post the log created