• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Kudos0

Some anomalous files under Norton eating up HDD space

A few hours ago Windows suddenly gave me a popup saying my C drive is running low on HDD space, I checked my drives and my C drive had 1.72MB left!

So I poked around and used an old program I had, WinDirStat (it's great btw, gives you a visual idea of where your space went) and noticed a large chunk of anomalous files. 18GB of it.

Folder:

C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-885EF591126E7}\NAV_18.1.0.37\CmnClnt\ccSubSDK\

Contains 9998 files with names {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx}, where x = (0-9, A-F) and a single submissions.idx file

File size ranges from 16 bytes to 4.6 MB

My system is running Windows 7 Ultimate x64, Intel Core2 quad Q9550, Norton AntiVirus 18.5.0.125

Are these supposed to be there? Are they safe to remove?

Thanks in advanced

Replies

Kudos0

Re: Some anomalous files under Norton eating up HDD space

Hi Welcome to Norton community!

Try doing these to clear up system space

press windows key + R

and type in cleanmgr and then open More option under system restore clcik cleanup and then proceed with the entire cleanup!

Also you could use softwares such as CCleaner from Pirform

http://download.cnet.com/ccleaner/

use this to free up HDD space !

check to see if this reduces a bit of space!  

Midou
Kudos0

Re: Some anomalous files under Norton eating up HDD space

Hi again 

these file are from 18.1

so i think you could remove them to see if it solves the problem !

also if the problem still does get solved you could uninstall norton via control panel and run removal tool twice

http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN&ln=en_US

and download install the latest version from here 

http://www.norton.com/nav11also please change Update setting to Smart update On.(If switched off)
Midou
Kudos0

Re: Some anomalous files under Norton eating up HDD space

Please be careful .... 18.5 is built upon 18.1

I have 18.1 sub-folders/files with today's date.  

NIS21.6 VistaSP2 FF32 IE9 Compaq A931NR
Kudos0

Re: Some anomalous files under Norton eating up HDD space

that was a bad suggestion I guess to delte the file  

but a clean install will help I hope!

Midou
Kudos0

Re: Some anomalous files under Norton eating up HDD space

Thanks Midou and bjm_ for your input.

I've ran the Windows disk cleanup and ccleaner. They did free up some space but the aformentioned files are still there.

Also I should note that the dates of these files are recent, earliest one dating 10/03/2011 and the most recent ones about half an hour ago (Date modified)

I will try the clean install later today.

Also, スネーーークバイト!! :D

Kudos2

Re: Some anomalous files under Norton eating up HDD space

These files are all related to submissions to Symantec and should clear themselves up once sent. If the times are all within the past week than they are as they should be although I'm concerned that there are so many of them. If you look in Norton's security history at the Norton Error Reporting section, is there anything listed there? If the files go back more than a week it may be that there are problems submitting data to the Symantec servers, or, that you haven't been online and idle long enough to get the submissions dequeued.

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

Yes indeed there is an entry under Norton Error Reporting in Security History.

The exported .mcf is 9.3mb I'm not sure if I can upload that as an attachment, so I attached a screenshot instead.

I usually leave my PC on when I'm at work so there should be plenty of idle time for Norton to get to work, and I'm always connected to the internet.

Kudos0

Re: Some anomalous files under Norton eating up HDD space

It's interesting that this error occurred on February 21st but didn't get successfully submitted until March 3rd, and, that it's the only entry in your Norton Error Reporting section. It looks like your system is having a hard time getting these sent to Symantec.

The specific event that you have provided is the equivalent to error 8921, 301. It indicates that a file that was  downloaded via LiveUpdate had an unexpected type. Are you running behind some sort of firewall or network filter? The fact that submissions aren't being uploaded and download errors have been detected makes me think that there is something up with your network. Could this one event have managed to make it through because you used this machine at an alternate location or connected to a different network on the 3rd?

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

The only firewall I have is the Windows one. I haven't made any changes to network settings in that timeframe nor have I accessed the internet with another network (it's a desktop, behind a router though). Also did not see anything out of the ordinary surrounding those dates in Event Viewer.

Some more details on the error (right click entry -> copy)

Category: Norton Error Reporting
Date & Time,Risk,Activity,Status,Error Type,Error Time,Error ID,Error Class,Product Name,Product Version,Process ID,Thread ID,Process Name,Process Version,Process Timestamp,Module Name,Module Version,Module Timestamp,Module Offset,Hash Code,Component Name,Component Id,Error Code,Severity,Error File
03/03/2011 02:08,Info,Norton Error Reporting Submission,Submitted,Error Condition Detected,21 February 2011 20:28,{67290B6C-4056-4D2B-8160-5D2D084B3394},0xC2C9EC8D,Norton AntiVirus,18.5.0.125,0x7E4,0x15B0,ccSvcHst,10.1.0.37,24 November 2010 00:12,NUMEng,18.5.0.125,04 December 2010 06:48,0x11997,0xD46E40C4,NUMEng,0x0,0xA0100007,Low,"C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\CmnClnt\ErrorInstances\C2C9EC8D\67290B6C-4056-4D2B-8160-5D2D084B3394.dat, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\CmnClnt\ErrorInstances\C2C9EC8D\67290B6C-4056-4D2B-8160-5D2D084B3394.dat.tmp, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\{55505D2F-0570-4DD7-B26B-771D6F24865A}.etl, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\SQ_{B70D6A3C-CB53-4F98-97F3-CB0C79B5E904}.plist, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\SQ_{43885A29-6ED6-46E2-996C-0AC8294F39A9}.dlist"
Category: Norton Error ReportingDate & Time,Risk,Activity,Status,Error Type,Error Time,Error ID,Error Class,Product Name,Product Version,Process ID,Thread ID,Process Name,Process Version,Process Timestamp,Module Name,Module Version,Module Timestamp,Module Offset,Hash Code,Component Name,Component Id,Error Code,Severity,Error File03/03/2011 02:08,Info,Norton Error Reporting Submission,Submitted,Error Condition Detected,21 February 2011 20:28,{67290B6C-4056-4D2B-8160-5D2D084B3394},0xC2C9EC8D,Norton AntiVirus,18.5.0.125,0x7E4,0x15B0,ccSvcHst,10.1.0.37,24 November 2010 00:12,NUMEng,18.5.0.125,04 December 2010 06:48,0x11997,0xD46E40C4,NUMEng,0x0,0xA0100007,Low,"C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\CmnClnt\ErrorInstances\C2C9EC8D\67290B6C-4056-4D2B-8160-5D2D084B3394.dat, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\CmnClnt\ErrorInstances\C2C9EC8D\67290B6C-4056-4D2B-8160-5D2D084B3394.dat.tmp, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\{55505D2F-0570-4DD7-B26B-771D6F24865A}.etl, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\SQ_{B70D6A3C-CB53-4F98-97F3-CB0C79B5E904}.plist, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Incoming\SQ_{C234BE82-EEE6-41DF-8DAD-9B2B2E14F8A4}\SQ_{43885A29-6ED6-46E2-996C-0AC8294F39A9}.dlist"

Should I try the reinstall afterall?

Thanks

Kudos0

Re: Some anomalous files under Norton eating up HDD space

Thanks for the details. This detailed for is actually preferred over the screenshot you provide previously. Regardless, I managed to get all of this information by reading the screenshot :)

Reinstalling may solve your problems but it seems to me that there probably is some other Internet connectivity issue going on. Do you ever have 'odd' behavior when browsing web sites?

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

I don't remember experiencing particularly odd behaviour. Might get disconnected to my modem/ISP once in a while but resetting the modem/router would fix that in a minute or two.

Is there some sort of diagnostics tool I could run to check my connection?

Also the size of the folder has grown by about 100mb since the initial post.

Kudos0

Re: Some anomalous files under Norton eating up HDD space

I talked with the submissions team and I need to make some corrections to my previous comments.

1st) The Norton Error Reports use a different mechanism and these aren't the results of errors.

2nd) The Security History section for these files is mostly the Norton Community Watch section. In there you should see entries for each of these files.

3rd) The files aren't deleted immediately after the submissions complete. They are removed after two weeks. If you see entries that are more than two weeks old then, as mentioned previously, there is an issue submitting.

What kinds of entries are you seeing in the Norton Community Watch section? This still seems like a very large number of submissions...

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

At the moment, there are about 2 pages of entries. Mostly "Norton Community Watch Feedback" and a few "IPS Detection Statistical Submission", earliest of which dates 27 March (3 days ago), they are all labelled as "Submitted."

Having said that, I do remember seeing a lot of "Pending" entries before (by a lot I mean multiple pages), but I've cleared the security history entries while trying to fix the issue. The export I made did not seem to include those entries.

Kudos0

Re: Some anomalous files under Norton eating up HDD space

How old are the files in the folder that you were examining?

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

Going by date modified, the oldest is dated March 10, 2011 and the most recent would be 2 hours ago.

If going by date created, the oldest is dated 21 October, 2010 (submissions.idx only), the rest match the dates mentioned above.

Kudos0

Re: Some anomalous files under Norton eating up HDD space


mehistaken wrote:

Going by date modified, the oldest is dated March 10, 2011 and the most recent would be 2 hours ago.

If going by date created, the oldest is dated 21 October, 2010 (submissions.idx only), the rest match the dates mentioned above.


The .idx file's date is probably fine. You probably installed / upgrade around that time.

The March 10th dates don't seem that far off but they certainly are more than two weeks old. I'll ask somebody from the submissions team to take another look at this thread. I suspect that they'll want to work more closely with you to understand what's really going, is that alright?

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

That's alright with me. I managed to free up some space by other means so it's not too much of an issue anymore.

Will do what I can to help resolve this, thank you for your time!

Kudos0

Re: Some anomalous files under Norton eating up HDD space

Can you try something and see if this helps? 

Go to main user interface -> Performance -> Norton Tasks -> and manually start the submissions job by pressing on the ‘play’ button by ‘Norton Community Watch’

Please get information about the system clock and 'the' folder state before running the job and information about 'the' folder after the run in case we need to do further analysis.

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Some anomalous files under Norton eating up HDD space

I did as suggested, the 'task' took less than a second to complete.. with little change to the folder.

The submissions.idx file did chage (date modified) and the total folder size has increased, details follow:

1) the file size of submissions.idx did not change

2) the date modified was not updated immediately after i click the 'play' button. I attempted the manual submission at 2:46, the date modified stamp on the file is 2:50.

3) the number of files in the folder and their sizes did not change, but the total size of the folder increased

(I did a dir > output redirect in command prompt and compared the file list of before and after the manual submission)

Any other info I should provide?

Kudos0

Re: Some anomalous files under Norton eating up HDD space

hello. if you can still help us out with more information, i've pmed you with some instructions.

thank you.

-ryo

Kudos0

Re: Some anomalous files under Norton eating up HDD space

I am going to chime in on this.

I saw the same type of activity on my PC from NIS 2011 and it was all related to the Community Watch feature. It was always doing something and definitely cluttering up my log file.

What was the last straw for me about the feature was when I saw it constantly uploading 15 files at a time from my hard drive. Most of these were secure OS system files and the like. I viewed that as an invasion of my privacy - plain and simple. I had no problems with detected malicious files being uploaded for analysis, but there was no way all these files being uploaded were suspect. Sorry but no security product should be uploading files just for database propagation and statistical analysis.

I turned off Community Watch and my PC log activity was dramatically reduced and so was the load on my PC.

Replies are locked for this thread.