Endpoint Protection

 View Only

  • 1.  Some *.qsp file generating in PC

    Posted Mar 26, 2011 04:58 AM

    Hi,

    I am using Symantec Endpouin Protection 11.0 corporate edition. I am facing some issue related to some virus. Everytime when antivirus scan started some files are generated with rendom name.qsp in c:\Windows\Temp folder and it consume lots of space of C Drive as well as lots of files are generated in qurantine folder. When i try to delete this *.qsp file it gives me "access dined error" and it will not deleted. So, Please help to solve this issue.

    Thanks

    Kack



  • 2.  RE: Some *.qsp file generating in PC

    Posted Mar 28, 2011 11:21 AM

    What version of SEP are you running? Check out this posted solution.

    http://www.symantec.com/connect/forums/why-it-so-difficult-get-rid-ofwork-qsp-files

     

    Moving this thread to the Endpoint Protection forum.

     

    Best,

    Thomas



  • 3.  RE: Some *.qsp file generating in PC

    Posted Mar 29, 2011 06:37 AM

    Hi Kack,

     

    That issue is largely resolved in the latest release of SEP 11 (RU6 MP3) and will be entirely resolved in the forthcoming SEP 12.1   I recommend upgrading as soon as is possible!

     

    Thanks and best regards,

     

    Mick



  • 4.  RE: Some *.qsp file generating in PC

    Trusted Advisor
    Posted Mar 29, 2011 09:07 AM

    Hello,

    Please Work on the Following Steps.

    Stop the Symantec service

    • Symantec Endpoint Protection

      • Click Start, then Run
      • Type: smc -stop
      • Click OK

    Deleting the files

    NOTE: The following instructions are to be done from the Command Prompt as attempting to perform the deletions from the Windows user interface may result in delays and application hangs due to the large amount of files that can reside in these locations. Please note that these instructions will delete the files in the targeted directories, not the directories themselves. Do not remove the directories themselves, only the contents of those directories.

     

    Open the Command Prompt

    Deleting files from User Temp folder

    • Click Start, then Run
    • Type: cmd
    • Click OK

    1. Type the following command in Command Prompt. (The following string will vary depending on the user name.) Replace "<NAMEOFUSER>" with the username of the desired Windows user you wish to empty the temp folder for:

     

  • For Windows 2000/XP/2003
     

  • DEL /F /Q "C:\Documents and Settings\<NAMEOFUSER>\Local Settings\Temp"

  •  

  • For Windows Vista/7/2008
     

  • DEL /F /Q "C:\Users\<NAMEOFUSER>\AppData\Local\Temp"

    • 2. Deleting the contents of the temp folder at the root of C:\

    • Type the following command in Command Prompt:

      DEL /F /Q C:\temp

    3. Deleting the contents of the Windows Temp folder

    • Type the following command in Command Prompt:

      DEL /F /Q C:\WINDOWS\Temp

    4. Deleting the contents of the xfer and/or xfer_temp directories

    • Type the following command in Command Prompt:
        • Windows 2000/XP/2003
          DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\"

          DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\"

        • Windows Vista/7/2008
          DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp\"

          DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer\"

     

    The Quarantine Folder

    NOTE: The following instructions are to be done from the Command Prompt as attempting to open the Quarantine folder in the Windows user interface may result in delays and Windows Explorer application hangs due to the large amount of files that can reside there.

     

    Delete the Quarantine Folder

    Type the following commands in the Command Prompt:

    • Windows 2000/XP/2003
      DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"

      RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"

    • Windows Vista/7/2008
      DEL /F /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"

      RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"

    Recreate the Quarantine Folder

    Type the following command in Command Prompt:

    • Windows 2000/XP/2003
      MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
    • Windows Vista/7/2008
      MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine"

    Start the Symantec service

    • Click Start, then Run
    • Type: smc -start
    • Click OK

     

     

  • If you have frequent recurrences of this issue and would like to disable re-scanning of the quarantine folder please follow these steps:

    • Disable re-scanning of quarantine files.

    From the SEP-Manager:
    - Edit the Antivirus and Antispyware policy of affected clients.
    - In the policy editor click "Quarantine" on the left-hand menu.
    - On the general tab click "Do nothing" under the heading "When new Virus Definitions Arrive"