Virus definition folder for Endpoint Protection 11 uses too much disk space

Article:TECH102927  |  Created: 2007-01-15  |  Updated: 2014-11-21  |  Article URL
Article Type
Technical Solution



The virus definition folder located in \Program Files\Common Files\Symantec Shared\VirusDefs contains many temporary folders named tmpXXXX.tmp (where XXXX are hexadecimal characters).

These temporary folders take up a large amount of disk space.


The virus definitions may be corrupted.


Note: To check if the virus definitions are corrupted, download and run a "scan for common issues" with SymHelp. 

WARNING: Do not clear the VirusDefs folder if LiveUpdate Administrator (LUA) 2.1 is installed. This will cause LUA to report that engine updates are corrupt until the next set of engine updates is released.

To solve this issue, follow these steps:

  1. Stop the Symantec Management Client service:
    1. Go to Start > Run
    2. Type smc –stop
    3. Click OK.
  2. Stop the Symantec Endpoint Protection service:
    1. Go to Start > Run
    2. Type services.msc
    3. Right-click on Symantec Endpoint Protection service and select Stop.

  3. Navigate to <local drive>:\Program Files\Common Files\Symantec Shared\Virusdefs
    1. Delete any numbered folders.
    2. Delete all files and folders with a ".tmp" extension.
  4. Install a new set of definitions by manually updating definitions using the Intelligent Updater.
  5. Restart the Symantec Endpoint Protection Service in services
  6. Restart the Symantec Management Client service
    1. Go to Start > Run
    2. Type smc –start
    3. Click OK

Technical Information
A utility has been created to accomplish the above described procedure automatically. The SymDelTmps utility will search and delete

temporary files and zero byte.dax files that are the result of a corrupt database or definition set. To obtain the utility, contact Symantec Technical support at:


Legacy ID


Article URL

Terms of use for this information are found in Legal Notices