"Ken Blake, MVP" <kblake@xxxxxx> wrote in message
news:c9vh35ld027kvgpi4h35oia1k3jpeec1uo@xxxxxx
Quote:
> On Wed, 17 Jun 2009 03:39:53 -0400, "mazorj" <mazorj@xxxxxx>
> wrote:
....
Quote:
Quote:
>> "3. After the downloads and reboot (not immediately but a few
>> hours
>> later), I started getting messages that my C: drive had zero
>> available
>> bytes. Explorer also reported zero available bytes and so did
>> PowerDesk. Deleting files had no effect.
>> ...
>> Prior to the onset of this problem, my HD was only about 1/3 full
>> so
>> whatever is eating up disk space all of a sudden is doing it at a
>> prodigious rate - in days or even hours.
>>
>> Shadow files may be eating up some space, but what could possibly
>> eat
>> up 2/3 of a 324 GB HD in a few days???
>
> Spyware infection. What anti-spyware programs do you use? Are they
> kept up to date?
> ...
> Ken Blake, Microsoft MVP - Windows Desktop Experience
> Please Reply to the Newsgroup Well, it wasn't malware but you were right, Ken, in that the loss of
"allocation units" was due to C: filling up. It turned out to be
embarrassingly simple, although I had tried all kinds of ways to spot
the mysterious "dark matter" monster file(s) and how they were
created. I used several file management tools to list recently
created files, watched reads/writes with Task Manager and other
monitors, but no luck. It wasn't until I fired up Defrag-a-File
tonight that the answer became apparent. All the space that
previously had shown in white as unused was marked in red as a
fragmented file or files.
Clicking anywhere on this whopping big stretch of red space showed the
same filename - procmon.pmb in C:\Windows. It had been created
6/10/09, the same day I did the monthly MS downloads and right about
the time that my empty disk space suddenly evaporated. It was 200+
GB, which is the amount of available space that had disappeared.
Apparently either something I downloaded triggered the boot monitoring
process that then created this file after I did the post-download
reboot; or I initiated boot monitoring before that reboot (although I
don't remember doing so and can't imagine why I would have).
Bottom Line: procmon.pmb was deleted without any hassle from OS user
rights/protections, the missing available space has been restored and
defragmented, and I assume I'll be no worse off for doing so.
I'm filing this After Action report so that you and the others here
can add this to your personal knowledge base of file management, not
to mention the Defrag-a-File trick. And believe me, after sweating
this one out, I'm not ever going to forget it!