Re: Symantec AV log file grows without bounds

Hi Ted,

Ted Crum wrote:

> No one on CAB-testers had a solution to the question forwarded below.

Another one to look at is 2005122911094548 in the Symantec KB where
turning off Tamper Protection is the workaround. Also, does this still
happen with SAV 10.1.5 MR5 MP1 (the latest MR and MP for 10.1)? If
neither of those options help, send a note to symantec-contacts_at_lists
with the full details of the system in question and we will open a case
with Symantec Platinum Support on this.

--Karl

=======
> Has anyone on Micronet seen such a thing?
>
> Thanks and Happy New Year!
>
> -tc
>

-- 
Ted Crum
tedcrum_at_socrates.berkeley.edu
---------- Forwarded message ----------
Date: Fri, 1 Dec 2006 14:34:00 -0800 (PST)
From: Ted Crum <tedcrum_at_socrates.berkeley.edu>
To: CAB-Testers_at_lists.berkeley.edu
Subject: Symantec AV log file grows without bounds
I have an XP user with the AV component of SCS (SAV 10.1.4), using the 
XP firewall.
His SAV log file grows while the machine is idle at a rate of about a
magabyte a minute. Eventually the log files used all the available disk
space, over 9GB. (I assume the log file is segmented to accomodate Fat
32, thought this machine is NTFS)
The log file contains the following line, repeated with only the first
digits (sequence code, I assume) differing. The line breaks are mine:
240B010D1B18,45,4,14,DIS,SYSTEM,,,,,,,65536,"C:\Program Files\Symantec
AntiVirus\Rtvscan.exe",0,,0,301 1984 C:\\WINDOWS\\system32\\IPSSVC.EXE 32
1684 C:\\Program Files\\Symantec AntiVirus\\Rtvscan.exe C:\\Program
Files\\Symantec AntiVirus\\Rtvscan.exe 0
1,,,,0,,,,,,,,,,,{57413A97-F916-45FB-9E75-8597FE736012},,,,HOME
,,,,,,,,,,,,,,,,,,0,,,,DIS
Uninstalling with NAV and SymNRT and reinstalling were no help; neither
were the instructions in 2003070110593048.
Does anyone have a clue?
Thanks,
Ted Crum
------------------------------------------------------------------------
The following was automatically added to this message by the list server:
For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.berkeley.edu/>.