Symantec was tracking down an issue on my machine and left a tracing program running. After they had “closed” my case, I found C:\Symlogs\Norton_WPP_Logs\_Boot_Norton_Tracesession02.etl would flush and start at each boot and continually gather data until eventually it filled all available disk space. They were, later, no help in determining what the previous tech had initiated to create this file.
I finally tracked it down to a Global Logging Trace Session that runs from the registry each time I reboot.
Deleting the entire
registry key resolved my issue
Reboot and delete C:\Symlogs folder
Oh, and by the way… I used WinDirStat initially to determine that it was the .etl file filling my disk
Oh, and I thought it was interesting that HijackThis did not spot GlobalLogger. hmm