Re: PSA: Somehow, without action from me, hyberfile.sys got turned on

Zaidy036 wrote:
>> Why else would you be running that failsafe catch-it-fast command?
> 
> Not a problem I have experienced. Just a method if he wanted it off.
> 
> I have a UPS and in case of power failure and it relies on Hyberfill to 
> do a graceful shutdown before it stops running the attached items.

Well, almost every day something is failing because I have 3GB left on a
1TB drive, so it's "always something" because most Microsoft engineers have
likely never tested in their lives a machine so deficient in storage as
mine is (given they likely only ever work on beefy monster machines).

Yesterday it was Brave looping forever, today it was MsMpEng.
It's like trying to find what killed a bug we stepped on with our foot.

If it's not one thing, it's another. 
It turns out that hibernation was just one thing.

1. Check free space
   wmic logicaldisk where "name='C:'" get freespace
2. Check journal 
   fsutil usn readjournal C:
   Kill it immediately as it will literally go on forever.
   Immediately means instantly. It will have a billion lines.
   Instantly means within a microsecond, if you can catch it.
   Otherwise it's too big to even copy a snippet.
   This scan implicated Windows Defender (but that's just the symptom).
3. Identify the process writing the most:
   Get-Process | Sort-Object -Descending -Property PM | Select-Object -First 20
4. Confirm it's Windows defender
   Get-Process -Id 3960 | Select-Object Name,Id,IOWriteBytes,IOReadBytes

   Name      Id IOWriteBytes IOReadBytes
   ----      -- ------------ -----------
   MsMpEng 3960

But you can kill it (which can be done) and delete its files. 
   MsMpEng.exe (Windows Defender)
   Process ID: 3960  
   Private memory: 360 MB  
   Working set: 384 MB

But like hibernation,shadow storage, brave and everything else, it's just a
symptom because Windows' self-healing is atrocious when space is so low
that the journal shows a billion lines per second of file activity.

It's interesting how fragile Windows is when it's starved for C: space.