[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

Need Script to Stop Service, Delete Files/Directores, Recreate them Symantec Endpoint Protection

Posted on 2010-04-09
10
Medium Priority
?
2,348 Views
Last Modified: 2013-12-09
Large amounts of temp files are being created in the xfer_tmp and are being detected as threats on several PCs throughout our organization.  Have a list of steps from Symantec to resolve this issue, just need them automated, so I don't have to waste any time running through each one.  Exact details are located here: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009042217073548

Breakdown, we only use Symantec Endpoint Protection on XP, so the only folder we are concerend about is C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp

What the script needs to contain:
 Stop the Symantec Service (smc -stop)
Delete Files/Folders Accordingly -
 DEL /F /Q "C:\Documents and Settings\<NAMEOFUSER>\Local Settings\Temp
 DEL /F /Q C:\temp
 DEL /F /Q C:\WINDOWS\Temp
 DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\"
 DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\"
 DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
 DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
Recreate the Quarantine folder:
 MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"

Finally to start the Symantec service again (smc -start)

I also need it to somehow recognize when the file/directory deleting in each of the above steps is completed.  I can't just have the script run through all the commands when the previous one didn't finish. In some instances, this could take hours as these folders have hundreds of thousands of tmp files adding up to several GB of space.

batch or vb script, doesn't matter, something I can just execute on each of the machines having this issue.  Thanks so much in advnace!

0
Comment
Question by:fireguy1125
  • 3
  • 3
  • 3
  • +1
10 Comments
 
LVL 7

Expert Comment

by:jhalapradeep
ID: 30232196
Hi,

First of all, I hope you have upgraded the SEP version to SEP 11.0 RU5.
As to resolve this issue permanently you will need to upgrade the software first.

Regards,
Pradeep Jhala
0
 
LVL 1

Author Comment

by:fireguy1125
ID: 30232494
Yes, I upgraded to 11.0.5002.333...that is when the issue started occuring, upgrade from 11.0.2 to 11.0.5 has caused all of these problems.
0
 
LVL 7

Expert Comment

by:jhalapradeep
ID: 30234209
Open Notepad

2. Paste the following 4 lines into a text file:

rd /q /s "%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
md "%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
rd /q /s "%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\xfer"
md "%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\xfer"
3. Save the text file as "%ALLUSERSPROFILE%\ClearQuarantine.bat"

4. Create a Scheduled task that runs the following command at least once per day. Set the task to run as the user "NT AUTHORITY\SYSTEM" with no password:

%WINDIR%\system32\cmd.exe /c "%ALLUSERSPROFILE%\ClearQuarantine.bat"

This should do all the work.


Regards,
Pradeep Jhala
0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
LVL 1

Author Comment

by:fireguy1125
ID: 30511838
As per the Symantec website, still need to delete the Temp folders as indicated in my original post.  Also, need to stop the smc service prior to performing these operations, and then restart after these operatings are completed.

Also, how will this script recognize once each folder/files are deleted prior to moving to next command to either re-create or delete other directory?
0
 
LVL 31

Assisted Solution

by:merowinger
merowinger earned 200 total points
ID: 30595568
The script will recognize it. A command will not start before the previous command line has finished.
0
 
LVL 20

Accepted Solution

by:
jimmymcp02 earned 1200 total points
ID: 30631856
test this and post back
copy this is notepad and save it as sepfix.bat make sure you change the as type from .txt to all
 
 
net stop "Symantec Antivirus"
 DEL /F /Q "C:\Documents and Settings\%USERNAME%\Local Settings\Temp"
 DEL /F /Q C:\temp
 DEL /F /Q C:\WINDOWS\Temp
 DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\"
 DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\"
 DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
 DEL /F /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
 MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine"
net start "Symantec Antivirus"
 
0
 
LVL 20

Expert Comment

by:jimmymcp02
ID: 30631951
By the way if you have the setting to prevent symantec from being tampered with it might stop the script from running since the script its trying to run a net stop on the service
0
 
LVL 7

Assisted Solution

by:jhalapradeep
jhalapradeep earned 600 total points
ID: 30731182
Hi,

net stop "symantec antivirus" will not work for symantec endpoint protection

You need to stop smc service for this purpose.

please use this command instead.

"start smc -stop" to stop the service and "start smc -start" to start the service. (without quotes)

Regards,
Pradeep Jhala
0
 
LVL 1

Author Closing Comment

by:fireguy1125
ID: 31762506
jimmymcp02 was most complete with all commands i originally requested

jhalapradeep corrected jimmymcp02 commands to stop service

merowinger answered my question regarding command execution.

Thanks to all! Solution worked with all 3 of you contributing.
0
 
LVL 20

Expert Comment

by:jimmymcp02
ID: 30734674
Like my daugther says "Whats gonna work... Teamwork... Whats gonna work team work!!!"
 
Thanks and glad we could help you.
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this post we will learn how to make Android Gesture Tutorial and give different functionality whenever a user Touch or Scroll android screen.
When you discover the power of the R programming language, you are going to wonder how you ever lived without it! Learn why the language merits a place in your programming arsenal.
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

608 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question