On Sun, 28 Jun 2009 03:39:02 -0400, "mazorj" <mazorj@xxxxxx>
wrote:
Quote:
>
> "Ken Blake, MVP" <kblake@xxxxxx> wrote in message
> news:c9vh35ld027kvgpi4h35oia1k3jpeec1uo@xxxxxx Quote:
> > On Wed, 17 Jun 2009 03:39:53 -0400, "mazorj" <mazorj@xxxxxx>
> > wrote:
>
> ... Quote:
Quote:
> >> "3. After the downloads and reboot (not immediately but a few
> >> hours
> >> later), I started getting messages that my C: drive had zero
> >> available
> >> bytes. Explorer also reported zero available bytes and so did
> >> PowerDesk. Deleting files had no effect.
> >> ...
> >> Prior to the onset of this problem, my HD was only about 1/3 full
> >> so
> >> whatever is eating up disk space all of a sudden is doing it at a
> >> prodigious rate - in days or even hours.
> >>
> >> Shadow files may be eating up some space, but what could possibly
> >> eat
> >> up 2/3 of a 324 GB HD in a few days???
> >
> > Spyware infection. What anti-spyware programs do you use? Are they
> > kept up to date?
> > ...
> > Ken Blake, Microsoft MVP - Windows Desktop Experience
> > Please Reply to the Newsgroup >
> Well, it wasn't malware but you were right, Ken, in that the loss of
> "allocation units" was due to C: filling up.
Glad to hear it wasn't malware. Yes, as I tried to explain, using
allocation units *means* the drive is filling up. That's what
allocation units are.
Quote:
> It turned out to be
> embarrassingly simple, although I had tried all kinds of ways to spot
> the mysterious "dark matter" monster file(s) and how they were
> created. I used several file management tools to list recently
> created files, watched reads/writes with Task Manager and other
> monitors, but no luck. It wasn't until I fired up Defrag-a-File
> tonight that the answer became apparent. All the space that
> previously had shown in white as unused was marked in red as a
> fragmented file or files.
>
> Clicking anywhere on this whopping big stretch of red space showed the
> same filename - procmon.pmb in C:\Windows. It had been created
> 6/10/09, the same day I did the monthly MS downloads and right about
> the time that my empty disk space suddenly evaporated. It was 200+
> GB, which is the amount of available space that had disappeared.
>
> Apparently either something I downloaded triggered the boot monitoring
> process that then created this file after I did the post-download
> reboot; or I initiated boot monitoring before that reboot (although I
> don't remember doing so and can't imagine why I would have).
>
> Bottom Line: procmon.pmb was deleted without any hassle from OS user
> rights/protections, the missing available space has been restored and
> defragmented, and I assume I'll be no worse off for doing so.
>
> I'm filing this After Action report so that you and the others here
> can add this to your personal knowledge base of file management, not
> to mention the Defrag-a-File trick. And believe me, after sweating
> this one out, I'm not ever going to forget it!
Thanks very much. I hadn't been aware of this issue, but I just read
some more about it here:
http://forum.sysinternals.com/forum_posts.asp?TID=12517
--
Ken Blake, Microsoft MVP - Windows Desktop Experience
Please Reply to the Newsgroup