BleepingComputer.com: Vista System Restore

I was working on a friends Dell Inspiron laptop that was "missing" system32/Rundll.exe file, and one of the first "fixes" I tried was running a Recovery disc and during that process, I believe it said it could not repair, but asked if I'd like to restore to different point. I chose yes, and soon after the hard drive was all of a sudden 98% full.

I got the original issue resolved (running RKill and MBAM to clean out some rogue AVs),
and would like to know if there is a way to check how much space System Restore is actually using, and how to reduce it, if that is the problem.

It has 120G hard drive, 10G being used in Recovery partition.
Windows Vista Home Premium SP1, just updated to SP2 last night.
If you need more info, I'll be happy to provide it.

Thanks ahead!

Download and run Disk Space Reporter if you want to know where all the hard drive space is being used.

Personally, I'd just do a clean install of Vista (after a malware infection and having other problems, it is the only logical solution, in my opinion).

I'd say the malware corrupted something and is "bloating" the files on the hard drive somehow. The easiest thing to do is a clean install. Otherwise, I'd recommend you please post a in the Am I infected? What do I do? sub-forum (to fully rule out malware as a possibility).

Thanks for the advice! I will try Disc Space Reporter.
I can't do a clean install, since there are no install discs to use.
But... the product key is OEM, and I do have an Dell Installation disc from another Dell computer, but don't beleive I could do it that way. (?) Plus I think it is an XP disc.

anyway... I did already post in the "Am I Infected" forum, and that was what led me to RKill and MBAM, as well as SuperAntiSpyware. I did add at the end of THAT thread that I would like to post a hijackthis log (or whatever else), just to make sure it is clean. Not sure if I just do that...?

I just thought of something...
If I do end up needing to do a clean install, can this be done by using the Recovery Partition?
It has Drive D as that partition, and if I remember correctly (I'm not at home right now), it has 10G dedicated and is about half full.
Would there be all the data needed to do a complete restore/recovery/install?

AustinTerry, on May 3 2010, 11:38 AM, said:

Okay, I see your topic here: http://www.bleepingcomputer.com/forums/topic314085.html

If you wish to be positively sure you have eradicated all the malware, then, yes, you should create a new log topic. Be warned though, it will take a few days to get your first reply, and will likely take about as long to be officially declared clean (depending on whether or not anything is found). If you make a log topic, do not post anywhere else about this computer until you are done with the logs (when you helper says "Done" and closes the topic). Posting in two places about the same computer can result in conflicting advice. Also, do not reply to your topic until it is taken by an MRT member (follow their instructions).

AustinTerry, on May 3 2010, 11:58 AM, said:

Yes, that is an option. You'll have to check the documentation that came with the computer to know how to access the recovery partition and restore to factory conditions. It won't be a true clean install...only a factory restore.

Let me know what you decide to do.

Yeah, I thought I was done with the "Am I Infected" topic, but I will post the logs in the Logs forum just to make sure the friends computer is clean before I return it to him.

While I wait for a reply, I guess I can be looking to see why the HDD is so full.

I won't post on this topic anymore until the Malware issue is complete.