C-drive keeps filling up

Glad to hear that you've got free space again!  Now, let's see if we can figure out what is writing those files in the first place.

1. Download and run Sysinternals Process Monitor (it is a standalone application).
2. Clink cancel on its Filters dialog.
3. In the Filter menu, make sure that Enable Advanced Output and Drop Filtered Events are both ticked.
4. On the toolbar, in the group of five buttons on the end to the right, make sure that only the second one, Show File System Activity is ticked.
5. Click the Filter button on the toolbar (or press [Ctrl]+[L]) to bring up the Filters dialog.
6. You will see a row of controls at the top of the Filters dialog where you can fashion a rule.  Set them to "Path" "contains" "NetworkService\AppData" then "Include".
7. Click [Add], click [OK], and then click the Clear button on the toolbar (or press [Ctrl]+[X]).

    When a program starts reading/writing files to the Network Service AppData folder, events should start appearing in the list, along with the name of the process that is responsible for the writes.  If nothing appears, make sure that the Capture toolbar button (the third one, it looks like a magnifying glass) doesn't have an "x" over it.  It if does, click on it to enable monitoring.

    Please note that due to the rather loose filter we set, some legitimate events will probably end up in that list as well.  After running for a few minutes on my system, a couple of entries appeared pertaining to a "VirtualStore" from svchost.exe, a Windows component.  The kind of suspicious activity that is filling up that folder on your computer should be hundreds or thousands of events, so it should be obvious.  You can click on the fourth button on the toolbar (next to the Capture button) to toggle auto-scrolling on or off.

    You may be able to figure out the problem on your own by Googling the suspect's name (as long as it isn't svchost.exe).  If not, you can take a screenshot of the suspicious activity and post it here, or save the Process Monitor log by clicking Process Monitor's save button and upload it somewhere, posting a link here.

I've run the Process Monitor and a screenshot is attached below.  All the entries writing to that particular folder are either "System" for "svchost.exe" processes.  Most of the operations read: FASTIO_ACQUIRE_FOR_MOD_WRITE or some other form "FASTIO" operation as well as numerous "IRP_MJ_READ" operations.  I haven't been able to find out what is causing this or how to remove/stop it.  I appreciate all you help in this matter.

Please provide a copy of your System Information file. Type System Information in the Search Box above the start Button and press the ENTER key (alternative is Select Start, All Programs, Accessories, System Tools, System Information). Select File, Export and give the file a name noting where it is located. Do not place the cursor within the body of the report before exporting the file. The system creates a new System Information file each time system information is accessed. You need to allow a minute or two for the file to be fully populated before exporting a copy. Please upload the file to your OneDrive, share with everyone and post a link here. Reports in normal mode preferred. Please say if the report has been obtained in safe mode.

In the same session (that is, you can stop Process Monitor but don't log off),

• Start the Task Manager (right-click in the Task Bar and select "Start Task Manager")
• Click the "View" menu and click "Select columns"
• Find "PID (Process Identifier)" and click to put a check in its box, then click OK

• Select the "Processes" tab and find the instance of svchost.exe that has the same PID as shown in the Process Monitor output.  If you were doing this after getting the screen that you posted above, you'd be looking for PID of 22696.  The actual PID will almost certainly be different the next time you run Process Monitor.
• Right-click on the instance of svchost.exe and select "Go to service(s)."
• Report the services that are highlighted.  Be sure to use the scroll bar to look at everything; the services hosted by an instance of svchost.exe may not be adjacent in the display of services.

Please do as LemP suggested above, but add one more step at the end: Click the PID column header so that the services are sorted by PID.  This will cause all the services hosted by the culprit to be visible on one screen.  Then take a screenshot and post it here.