Misc stuff

SPLiteH2240

vssadmin resize shadowstorage /for=x: /on=x: /maxsize=500MB

Large numbers of .tmp files are being created in the xfer_tmp or 7.5/xfer folder and are being detected as threats.

Question/Issue:
After Symantec Endpoint Protection detects an infection, the xfer_tmp folder generates a large number of temporary (.tmp) files. How can I get this to stop?

After Symantec AntiVirus detects an infection, the 7.5\xfer and/or 7.5\xfer_temp folders starts generating numerous temporary (.tmp) files. How can I get this to stop?

After a migration from Symantec AntiVirus to Symantec Endpoint Protection the xfer_tmp folder starts generating a large number of .tmp files. How can I get this to stop?

Symptoms:
Large numbers of temporary (.tmp) files are generated in any of the following locations:

Symantec Endpoint Protection

•  
  •  
    • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp
    • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer
  •  
    • C:\Program Data\Symantec\Symantec Endpoint Protection\xfer_tmp

Windows 2000/XP/2003
Windows Vista/7/2008

Symantec AntiVirus

NOTE: The following file locations may still be relevant in a migration scenario from Symantec AntiVirus to Symantec Endpoint Protection

•  
  •  
    • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer
    • C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp
  •  
    • C:\Program Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer
    • C:\Program Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp

  
  

Windows 2000/XP/2003
Windows Vista/7/2008

Solution:

To take advantage of code improvements which make such detections much less likely, please ensure that the latest release of SEP 11 or SAV is installed on the client .
If such detections continue after deleting old .tmp files and updating to SAV_CE 10.1 MR9 or SEP 11 RU6a, see the following:

Stop the Symantec service

•  
  • Click Start, then Run
  • Type: smc -stop
  • Click OK
  • Click Start, then Run
  • Type: services.msc
  • Click OK
  • Right-click and Stop the Symantec AntiVirus or Symantec Endpoint Protection service

Symantec Endpoint Protection
Symantec AntiVirus

Deleting the files

NOTE: The following instructions are to be done from the Command Prompt as attempting to perform the deletions from the Windows user interface may result in delays and application hangs due to the large amount of files that can reside in these locations. Please note that these instructions will delete the files in the targeted directories, not the directories themselves. Do not remove the directories themselves, only the contents of those directories.Open the Command Prompt

•  
  1. Type the following command in Command Prompt. (The following string will vary depending on the user name.) Replace “<NAMEOFUSER>” with the username of the desired Windows user you wish to empty the temp folder for:
     •  
       • Windows 2000/XP/2003
         DEL /F /Q “C:\Documents and Settings\<NAMEOFUSER>\Local Settings\Temp”
       • Windows Vista/7/2008
         DEL /F /Q “C:\Users\<NAMEOFUSER>\AppData\Local\Temp”
  2. Deleting the contents of the temp folder at the root of C:\
     
     •  
       • Type the following command in Command Prompt:DEL /F /Q C:\temp
  3. Deleting the contents of the Windows Temp folder
     
     •  
       • Type the following command in Command Prompt:DEL /F /Q C:\WINDOWS\Temp
  4. Deleting the contents of the xfer and/or xfer_temp directories
     •  
       • Type the following command in Command Prompt:
         •  
           • Windows 2000/XP/2003
             DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\” 

           • Windows Vista/7/2008
             DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp\”DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer\” 

       • Type the following commands in command prompt:
         •  
           • Windows 2000/XP/2003
             DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp”DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp”
             DEL /F /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer”
              

              

           • Windows Vista/7/2008
             DEL /F /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer”DEL /F /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\xfer_tmp”DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp”

             DEL /F /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer”
             

     Symantec Endpoint Protection
     Symantec AntiVirus

     NOTE: For migrations from Symantec AntiVirus to Symantec Endpoint Protection, be sure that the below locations do not also exist

  • Click Start, then Run
  • Type: cmd
  • Click OK

Deleting files from User Temp folder

The Quarantine Folder

•  
  •  
    •  
      • Type the following commands in the Command Prompt:
        •  
          • Windows 2000/XP/2003
            DEL /F /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine”RD /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine” 

          • Windows Vista/7/2008
            DEL /F /S /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine”RD /S /Q “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine” 

    •  
      • Type the following commands in Command Prompt:
        •  
          • Windows 2000/XP/2003
            DEL /F /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”RD /S /Q “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine” 

          • Windows Vista/7/2008
            EL /F /S /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”RD /S /Q “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine” 

  Symantec Endpoint Protection
  Symantec AntiVirus

  NOTE: For migrations from Symantec AntiVirus to Symantec Endpoint Protection, be sure that the below location does not also exist

  •  
    •  
      • Type the following command in Command Prompt:
        •  
          • Windows 2000/XP/2003
            MD “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine”
          • Windows Vista/7/2008
            MD “C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine”
    •  
      • Type the following command in Command Prompt:
        •  
          • Windows 2000/XP/2003
            MD “C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”  

          • Windows Vista/7/2008
            MD “C:\ProgramData\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine”
            

  Symantec Endpoint Protection
  Symantec AntiVirus

NOTE: The following instructions are to be done from the Command Prompt as attempting to open the Quarantine folder in the Windows user interface may result in delays and Windows Explorer application hangs due to the large amount of files that can reside there.

Delete the Quarantine Folder
Recreate the Quarantine Folder

Start the Symantec service

•  
  • Click Start, then Run
  • Type: smc -start
  • Click OK
  • Click Start, then Run
  • Type: services.msc
  • Click OK
  • Right-click and Start the Symantec AntiVirus or Symantec Endpoint Protection service

Pick a user that fails to end up in Junk. Go in his Outlook and make sure his own address is not added to trusted senders or to his own contacts and that the checkbox trust emails from my contacts is selected.
It could be that ME moves them to Junk but when you open Outlook it sees them in trusted lists and moves the emails to Inbox.

Open Exchange Management Console -> Right Click Organization Configuration -> Click Modify Configuration Domain Controller -> Check Use Default Domain Controller

Profwiz3

Link

A: The default network properties will force the Network Name resource to attempt to register itself with a DNS Server. This may result in slower than expected iSCSI resource group movement between Windows Storage Server 2008 cluster nodes. The recommendation is to remove the DNS registration requirements by adjusting the appropriate network properties.

1. Open the Network Sharing Center on one of the Windows Storage Server 2008 systems.

2. Select Manage network connections.

3. Select Properties for the iSCSI Network.

4. Select Properties for Internet Protocol Version 4 (TCP/IPv4).

5. Select the Advanced tab.

6. Select the DNS tab.

7. Deselect the Register this connection’s addresses in DNS.

8. Close the Properties for the iSCSI Network.

9. If there are any additional iSCSI networks, repeat Step 3 to 8 for each one.

Link

Yes. To improve performance, it’s recommended that you disable NetBIOS over TCP/IP on your cluster network NIC and other dedicated-purpose NICs, such as for iSCSI and Live Migration. NetBIOS isn’t used in Server 2008 R2 clusters.

To disable NetBIOS over TCP/IP, access the IPv4 properties of your network adapter. To do this, open the Network and Sharing Center, select Change Adapter Settings, right-click the network connection, and select Properties. Select Internet Protocol Version 4 (TCP/IPv4) and click the Advanced button in the displayed dialog.

Select the WINS tab and select the Disable NetBIOS over TCP/IP. Perform this on all network connections that aren’t general purpose management/connectivity NICs, and perform it on all nodes in the cluster.

Additionally, make sure you enable jumbo packets on all network adapters, if you haven’t done so already.

Make sure you don’t disable Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks on the NIC used for CSV—they’re requirements. You could disable these for networks used for iSCSI and other dedicated purposes.

Link

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

   .cpl File       Control Panel Tools
   ————————————————
   Access.cpl      Accessibility
   Appwiz.cpl      Add/Remove Program
   Desk.cpl        Display
   Desk.cpl        Printers      
   Fax.cpl         Fax wizard
   Hdwwiz.cpl      Add/Remove Hardware
   Intl.cpl        International
   Joy.cpl         Game controller
   Liccpa.cpl      Licensing
   Main.cpl        Mouse
   Mlcfg.cpl       Mail
   Mmsys.cpl       Sound and multimedia
   Modem.cpl       Phone and Modem
   Ncpa.cpl        Network and connectivity
   Netcpl.cpl      Network and Dial-up Connectivity
   Nwc.cpl         Netware client connectivity
   Odbccp32.cpl    Open database connectivity
   Powercfg.cpl    Power management
   Sticpl.cpl      Scanner and camera
   Sysdm.cpl       System
   Telephon.cpl    Dialing rule and modem
   Timedate. cpl   Date Time and Time zone
   Wspcpl.cpl      WSP Client
   Wspcpl32.cpl    WSP Client