Dealing with XS baggage

A colleague was surprised to find that the WinSxS folder on his Windows Vista PC was occupying over 7GB of disk space.

Intrigued, I looked on my own PCs. Windows XP had a WinSxS folder with a modest 36.5MB, Windows 7 beta totalled 3.8GB, but Vista easily topped the bill with an impressive 8.22GB, comprising 41,644 files in 11,070 folders.

There have been reports of this increasing to over 30GB. And in normal circumstances the folder can easily constitute over half of the Windows footprint.

So, can some of this space be reclaimed and, if so, how?

The WinSxS folder is where every operating system file is stored, in what is known as the ‘component store’.

You’ll find everything in here from executables to video files. You will also find different versions of the same file ­ I had six versions of Explorer.exe on my PC.

One of the biggest changes from XP to Vista was the move from an INF-described operating system to a component basis.

INF files for drivers are text files that contain the name, location, version and Registry information, whereas components each consist of one or more binaries (such as .exe or .dll files), a catalogue file and an XML file that tells the system how files should be installed.

The advantages are that if any application needs a particular version of a DLL, then that version will be available ­ as we see, new versions are accumulated alongside the old, rather than replacing them.

Also, if you decide to add a Windows component, you will get the latest version rather than the original released to manufacturing (RTM) version.

You may also notice that many files in the WinSxS subfolders are duplicated elsewhere, typically in the System32 folder.

But Microsoft says these duplicates are ‘hard-linked’ and there is only one copy of each file on the system.

Joseph Conway, senior support escalation engineer at Microsoft Enterprise Platforms Support said in a Technet blog: “There is only one instance (or full data copy) of each file in the OS, and that instance is located in the WinSxS folder.”

However, in another blog, Michael Beck, a program manager in the Microsoft core OS deployment feature team, said: “…nearly every file in the WinSxS directory is a hard link to the physical files elsewhere on the system ­ meaning that the files are not actually in this directory.”

Clear as mud
So it seems Microsoft has no consistent view as to where the files really are.

Unfortunately, neither Windows Explorer nor the Command Prompt ‘Dir’ command can tell the difference between real files and hard links.

This is a failure on Microsoft’s part because the operating system can’t return accurate information about its own file and folder system.

Beck admits: “The fact we make it tricky for you to know how much space is consumed in a directory is definitely a fair point.”

There is a third-party tool designed to differentiate between files and hard links. It’s called Sizesxs.

Alas, we couldn’t get it to work with Vista as it produced a ‘not a valid Win32 application’ message, but it did work with the Windows 7 beta.

So, what can you do about this folder’s appetite for disk space? The answer is very little.

You can’t move it to another partition because, as Beck said, “Windows Vista only supports the WinSxS directory on the physical drive in its originally installed location".

Some websites may encourage you to delete files and folders from WinSxS, or offer tools to help.

Personally, I wouldn’t. You might get away with it ­ but you could find that certain applications are dependent on particular versions of a DLL and stop working.

And you could break Windows Update or Installer. Vista does (or so Microsoft claims) remove files that are no longer needed when you uninstall programs, but this may not happen immediately.

If you have installed Vista Service Pack 1, then you can run the clean-up utility.

This makes SP1 permanent, so you will no longer be able to remove it.

However, it will remove all files that were replaced by SP1 versions.

You’ll find the utility at Windows\System32\Vsp1cln.exe, or you can just type the name of the executable into the Vista search box.

This will open a command prompt asking you to confirm that you want to make SP1 permanent ­ type ‘Y’ and the clean-up will commence.

On my Vista PC this shrunk the reported size of the WinSxS folder by about 1.2GB, removing some 3,000 files and 1,400 folders.

Oh no, it’s a virus
This month I got a virus that came from infected media ­ in this case a DVD. In a moment of imbecility I double-clicked on an exe file, and the damage was done.

Following a reboot AVG anti-virus sounded the alert, but couldn’t eradicate it.

System Restore wouldn’t work, MSconfig wouldn’t run and neither would Regedit or the Task Manager.

Spybot Search and Destroy got rid of some more, and reported that Registry editing had been disabled.

However, it failed to reinstate the latter.

Microsoft Windows Defender seemed blissfully unaware that anything was happening.

Eventually, I identified the villain as Regsvr.exe. Despite the plausible name, this is not a Microsoft Windows file ­ though Regsvr32.exe is.

Another clue is that although the file is an executable, it has a folder icon, which is another reason to turn off ‘Hide extensions…’ from Folder Options, View.

After deleting several copies of Regsvr.exe and disabling its start-up entry, I thought I’d fixed the problem.

But two issues remained. First, although MSconfig and the Task Manager were back, I still couldn’t run Regedit. Registry editing tools had been ‘disabled by my administrator’.

A trip to the Group Policy Editor revealed that under User Configuration, Administrative Templates, System, the ‘Disable Registry editing tools’ entry was set to ‘Not configured’.

This is as it should be, but Regedit was still disabled. The trick is to enable the entry, then disable it again (or reset it to ‘Not configured’).

This round-tripping corrected the problem and access to Regedit was restored.

The other problem was that when XP started it complained that it couldn’t find Regsvr.exe.

This is because it had been deleted. But if you disable a Startup item from MSconfig, it still tries to find it and complains if it can’t. Disabled start-up items are still stored on the PC, otherwise you would not be able to re-enable them.

The answer is to run Regedit and go to HKEY_LOCAL_MACHINE\Software \Microsoft\SharedTools\MSConfig\startupreg. Each disabled item will have its own sub-key here, and deleting this will remove the reference and get rid of the annoying message.

The absence of Windows Defender
Further to the previous mention of Windows Defender and Software Explorer, several readers were puzzled by the absence of this in XP.

Eddie Hill, Allan McKendrick and John Lewcock all said that. despite being up to date with Windows Updates, there was no trace of either on their XP PCs.

I assumed that Windows Defender was delivered as part of XP’s update schedule, but it isn’t ­ - you need to download it.

As well as managing start-up programs better with Software Explorer, Defender also claims to provide real-time protection against spyware, pop-ups and ‘other unwanted software’.

Further confusion was caused by previous comments on the Task Manager.

I said that pressing Ctrl, Alt & Del in XP takes you straight there. In fact it only does this if you have the Welcome screen enabled ­ if not it takes you to the Windows Security dialogue where another button starts the Task Manager.

My thanks to Derek Souter for helping to clarify this and for pointing out that Ctrl, Shift & Esc always takes you straight to the Task Manger, as does right-clicking on the Taskbar and choosing Task Manager.