Large numbers of .tmp files are being created in the xfer_tmp or 7.5/xfer folder

Large numbers of .tmp files are being created in the xfer_tmp or 7.5/xfer folder and are being detected as threats.

Question/Issue:
After Symantec Endpoint Protection detects an infection, the xfer_tmp folder generates a large number of temporary (.tmp) files. How can I get this to stop?

After Symantec AntiVirus detects an infection, the 7.5\xfer and/or 7.5\xfer_temp folders starts generating numerous temporary (.tmp) files. How can I get this to stop?

After a migration from Symantec AntiVirus to Symantec Endpoint Protection the xfer_tmp folder starts generating a large number of .tmp files. How can I get this to stop?

Symptoms:
Large numbers of temporary (.tmp) files are generated in any of the following locations:

Symantec Endpoint Protection

  •  
    •  
      • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp
      • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer
    •  
      • C:\Program Data\Symantec\Symantec Endpoint Protection\xfer_tmp

    • Windows 2000/XP/2003
    Windows Vista/7/2008

Symantec AntiVirus

    NOTE: The following file locations may still be relevant in a migration scenario from Symantec AntiVirus to Symantec Endpoint Protection

 

  •  
    •  
      • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer
      • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp
    •  
      • C:\Program Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer
      • C:\Program Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp


    • Windows 2000/XP/2003
    Windows Vista/7/2008

Solution:


To take advantage of code improvements which make such detections much less likely, please ensure that the latest release of SEP 11 or SAV is installed on the client .
If such detections continue after deleting old .tmp files and updating to SAV_CE 10.1 MR9 or SEP 11 RU6a, see the following:

Stop the Symantec service

  •  
    • Click Start, then Run
    • Type: smc -stop
    • Click OK
    • Click Start, then Run
    • Type: services.msc
    • Click OK
    • Right-click and Stop the Symantec AntiVirus or Symantec Endpoint Protection service

    • Symantec Endpoint Protection
    Symantec AntiVirus

Deleting the files

    NOTE: The following instructions are to be done from the Command Prompt as attempting to perform the deletions from the Windows user interface may result in delays and application hangs due to the large amount of files that can reside in these locations. Please note that these instructions will delete the files in the targeted directories, not the directories themselves. Do not remove the directories themselves, only the contents of those directories.Open the Command Prompt
  •  
    1. Type the following command in Command Prompt. (The following string will vary depending on the user name.) Replace “<NAMEOFUSER>” with the username of the desired Windows user you wish to empty the temp folder for:
      •  
        • Windows 2000/XP/2003
          DEL /F /Q “C:\Documents and Settings\<NAMEOFUSER>\Local Settings\Temp”
        • Windows Vista/7/2008
          DEL /F /Q “C:\Users\<NAMEOFUSER>\AppData\Local\Temp”
    2. Deleting the contents of the temp folder at the root of C:\

      •  
        • Type the following command in Command Prompt:DEL /F /Q C:\temp
    3. Deleting the contents of the Windows Temp folder

      •  
        • Type the following command in Command Prompt:DEL /F /Q C:\WINDOWS\Temp
    4. Deleting the contents of the xfer and/or xfer_temp directories
      •  
        • Type the following command in Command Prompt:
          •  
            • Windows 2000/XP/2003
              DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\” 

            • Windows Vista/7/2008
              DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp\”DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer\” 

        • Type the following commands in command prompt:
          •  
            • Windows 2000/XP/2003
              DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp”

              DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer”
               

               

            • Windows Vista/7/2008
              DEL /F /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer”DEL /F /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp”DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp”

              DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer”

        • Symantec Endpoint Protection
        Symantec AntiVirus

        NOTE: For migrations from Symantec AntiVirus to Symantec Endpoint Protection, be sure that the below locations do not also exist

    • Click Start, then Run
    • Type: cmd
    • Click OK

    • Deleting files from User Temp folder

The Quarantine Folder

  •  
    •  
      •  
        • Type the following commands in the Command Prompt:
          •  
            • Windows 2000/XP/2003
              DEL /F /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine”RD /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine” 

            • Windows Vista/7/2008
              DEL /F /S /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine”RD /S /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine” 

      •  
        • Type the following commands in Command Prompt:
          •  
            • Windows 2000/XP/2003
              DEL /F /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”RD /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine” 

            • Windows Vista/7/2008
              EL /F /S /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”RD /S /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine” 

      • Symantec Endpoint Protection
      Symantec AntiVirus

      NOTE: For migrations from Symantec AntiVirus to Symantec Endpoint Protection, be sure that the below location does not also exist

    •  
      •  
        • Type the following command in Command Prompt:
          •  
            • Windows 2000/XP/2003
              MD “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine”
            • Windows Vista/7/2008
              MD “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine”
      •  
        • Type the following command in Command Prompt:
          •  
            • Windows 2000/XP/2003
              MD “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”  

            • Windows Vista/7/2008
              MD “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”

      • Symantec Endpoint Protection
      Symantec AntiVirus

    • NOTE: The following instructions are to be done from the Command Prompt as attempting to open the Quarantine folder in the Windows user interface may result in delays and Windows Explorer application hangs due to the large amount of files that can reside there.

    Delete the Quarantine Folder
    Recreate the Quarantine Folder

Start the Symantec service

  •  
    • Click Start, then Run
    • Type: smc -start
    • Click OK
    • Click Start, then Run
    • Type: services.msc
    • Click OK
    • Right-click and Start the Symantec AntiVirus or Symantec Endpoint Protection service



 

 


Tags: ,

This entry was posted on Tuesday, August 3rd, 2010 at 23:24 and is filed under Symantec. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a Reply

You must be logged in to post a comment.