Member Avatar for miko

Hello Specialists,

Since a few days the system process of XP starts writing on my C drive at a speed of more than 1 GB an hour. Within Explorer the file can't be seen, although within Properties on Drive level the space occupance is shown. After reboot the diskspace is released and the process starts all over again.

Any clue.

Michiel Koekkoek

The Netherlands

  • 2 Contributors
  • 1 Reply
  • 90 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by coolraj003

Dani AI

Generated

For : the pattern you describe (C: fills with an invisible file and space is released only after reboot) is most often caused by a file that was created and then deleted while a handle to it remained open in kernel space. Windows does not free the space until the last handle is closed, so Explorer will not show the file even though the volume reports the used space. That handle is commonly owned by the System process (PID 4) because a kernel driver or file-system filter is doing the writing.

To diagnose, run Sysinternals Process Explorer (as Administrator), locate the System process (PID 4) and use Find -> Find Handle or DLL (Ctrl+F) to search for open handles on C:. Alternatively use Sysinternals Handle from the command line to list handles held by PID 4 and redirect the output to a text file before rebooting so you can inspect it. If the handle points to a driver, the writer is likely a driver/filter (antivirus, backup, filesystem filter). Useful tools: Process Explorer, Handle, Autoruns.

As suggested, scan for malware; if you suspect a kernel component, use an offline or rescue scanner (for example, Microsoft Safety Scanner) or bootable rescue media. Do not attempt to terminate the System process — stop or remove the offending driver/service instead, and gather handle output first so the exact culprit can be identified.

Member Avatar for coolraj003

What is the process that starts writing on your drive and what sort of file does it create? Have you tried running some anti spyware or anti virus software and found anything unusual with the outcome?

Raj

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.