up vote 4 down vote favorite
share [g+] share [fb]

I found this folder the other day when I got a "drive full" notice. It was full of files randomly named like the folder itself (see pic below). I deleted all I could, but there was 1 file that was being used, and that remains and is growing. What's the best way to go about identifying what process/program is responsible?

enter image description here

link|improve this question
93% accept rate
1  
Use sysinternals process monitor to see what program is accessing that file. In the mean time set it to read only to stop it from growing. – Kyle Oct 12 '11 at 19:30
Boot into safe mode and see if the growth stops, if it does, suspect your AV software is causing it. – Moab Oct 12 '11 at 20:48
I smell a virus. – Bigbio2002 Oct 14 '11 at 17:46
Post that as an answer. – ChrisF Oct 18 '11 at 15:34
@ChrisF - Good idea. Done. – Flotsam N. Jetsam Oct 18 '11 at 16:19
show 1 more comment
feedback

3 Answers

up vote 5 down vote accepted

Use the SysInternals task manager program: Process Explorer.

In the Process Explorer interface there is a search command that you can use to search for this file path. Process Explorer will then show you the executable(s) working in this directory and creating these files.

Then run an internet search for the name of the process(es) working in this directory to determine whether they are malware or not.

link|improve this answer
When I used Process Explorer, I found it wasn't being used anymore. I was able to delete without any problem. The only thing I had done prior that might relate are several reboots and making it "read-only" as Kyle suggested. Thanks for your answer. If it happens again I know where to start. – Flotsam N. Jetsam Oct 12 '11 at 22:31
I'm glad that it worked for you. – music2myear Oct 12 '11 at 22:32
feedback
up vote 4 down vote

-k -q are parameters, so I suspect you have a virus and this file are the results of executing the name.

Try Process Explorer and Process Monitor to see what process accesses the file.

link|improve this answer
feedback
up vote 0 down vote

It happened again. I didn't actually need SysInternals. I just opened Task Manager, found what was using the most memory (this thing was churning 200MB files out every sec) and it was obvious. Turns out the culprit was Eraser running an erase task on unused disk space. The option to delete cluster tips was checked--not sure if that's important. No virus though. Here's an image of exactly what it does:

enter image description here

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.