4

I found this folder the other day when I got a "drive full" notice. It was full of files randomly named like the folder itself (see pic below). I deleted all I could, but there was 1 file that was being used, and that remains and is growing. What's the best way to go about identifying what process/program is responsible?

enter image description here

  • 1
    Use sysinternals process monitor to see what program is accessing that file. In the mean time set it to read only to stop it from growing. – Supercereal Oct 12 '11 at 19:30
  • Boot into safe mode and see if the growth stops, if it does, suspect your AV software is causing it. – Moab Oct 12 '11 at 20:48
  • I smell a virus. – Bigbio2002 Oct 14 '11 at 17:46
  • Post that as an answer. – ChrisF Oct 18 '11 at 15:34
  • @ChrisF - Good idea. Done. – Flotsam N. Jetsam Oct 18 '11 at 16:19
5

Use the SysInternals task manager program: Process Explorer.

In the Process Explorer interface there is a search command that you can use to search for this file path. Process Explorer will then show you the executable(s) working in this directory and creating these files.

Then run an internet search for the name of the process(es) working in this directory to determine whether they are malware or not.

  • When I used Process Explorer, I found it wasn't being used anymore. I was able to delete without any problem. The only thing I had done prior that might relate are several reboots and making it "read-only" as Kyle suggested. Thanks for your answer. If it happens again I know where to start. – Flotsam N. Jetsam Oct 12 '11 at 22:31
  • I'm glad that it worked for you. – music2myear Oct 12 '11 at 22:32
4

-k -q are parameters, so I suspect you have a virus and this file are the results of executing the name.

Try Process Explorer and Process Monitor to see what process accesses the file.

1

It happened again. I didn't actually need SysInternals. I just opened Task Manager, found what was using the most memory (this thing was churning 200MB files out every sec) and it was obvious. Turns out the culprit was Eraser running an erase task on unused disk space. The option to delete cluster tips was checked--not sure if that's important. No virus though. Here's an image of exactly what it does:

enter image description here

  • I suppose that's one say to wipe free space. – music2myear Mar 15 '17 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.