W2K Server: Programs think C: is full

Lately I've been experiencing some weird problems on my Windows 2000 Server system. Programs are logging "disk full" errors and recent installations have failed due to similar errors. Windows 2000 Server is installed on the C partition which is 3 GB, and there is currently 300MB free. Despite this, many programs that use the C drive are eventually generating disk errors. I've moved all programs that write new files (that are easily movable) to another drive and they're running fine now. Basically, I can't add ANYTHING to the C drive unless I reboot, after which there is a window of a couple minutes in which I can move files onto the drive. I tried installing a virus scanner to no avail until I was able to install it during that window, and all it picked up was CodeRed. After that window has closed any program I attempt to install generates an error and quits if it tries to write to the C drive. This is EXTREMELY frustrating and I can't find a single thing wrong.

For example, PHP in particular was causing problems as it writes a tiny session file to it's session data directory each time a session is created, and PHP was installed on the C drive. Every few minutes I'd see a slew of "unable to write file" type errors in the PHP error log. I moved PHP to the F drive and sessions work fine now.

I've tried moving large files off the C drive and the errors continue like I had never done it. I don't even get a chance to replace that deleted data, it's instantly ignored. The ONLY way I've found to be able to move files onto the C drive is to reboot and act quickly before it locks me out again.

Can anyone give me some ideas of what could possibly be causing this and what I could try to find/fix the problem? I'm all out of ideas right now.

 

all it picked up was CodeRed

Well, the behavior you describe can be the result of our old buddy the Code Red Worm (or it's brother, the Code Red II worm). Are you sure you got rid of the thing?

 

Hmm.... it definitely shouldn't be there anymore. Just to be sure I went over to symantec.com and ran the CodeRed removal tool and it came up empty. I'm now running McAfee VirusScan Enterprise 7.0 on the server and it hasn't picked up any traces of CodeRed either. The only viruses it found were in the mail folders, now on the F drive since they were having problems being on C.

 

Are you running any other third-party software (like Backup Exec )? Do you have quotas enabled for any users?

 

Interesting article. I don't have any backup programs running and I've never used quotas on the C drive (just F). The last programs I've installed were SQL Server 2000 which I've downloaded and installed the latest Service Pack for, and Exchange Server 5.5 which got stuck during installation. It's not in the uninstall list so I can't remove it yet it won't let me re-install it. It's possibly a result of this problem. Other than that I haven't added any new software in a long time.

I had another problem with my server being unresponsive a day or two after installing both those programs and I uninstalled them in case they were the cause. That seemed to fix it. Installing SP3 for SQL Server seems to have gotten it working and Exchange Server crapped out just as it was finishing installation for the second time. I'm not sure if any of that has something to do with this problem but prior to that it was running okay.

 

Well, think I've figured out why Exchange wouldn't install. I've done some research on the error message and it seems to be related to the files perfc009.dat and perfh009.dat. The articles I found said to make sure they weren't read only and that no other processes were using them. They weren't read only and I could delete them so they weren't open by another process. One article said that Exchange renames these files to *.bak and recreates them (uh-oh), and when I took a look at them perfh009.dat had a file size of 0. Gee, I wonder if it's supposed to be like that?

Just another fine example of how this #$%# problem is screwing up my system. I can probably get Exchange Server installed by rebuilding the file from the Windows CD (after I find it), however this doesn't help me find the source of the disk problem. Heck, I don't even WANT Exchange, I just came across an old copy and was curious since I've never seen it before. All I want is to get my C drive back.

 

Jus stabbing in the dark here, but is there any chance this disk problem is residual from Code Red? Now that I think about it I had to install Active Directory as well in order to install Exchange. Even though the virus is gone, could this be leftover from when it was around?

 

It certainly could be. This page has some good information and links to places with more.