Endpoint Protection Small Business Edition

C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\CmnClnt\ccSubSDK

I had another problem with a desktop running Symantec.cloud.

In this case, after removing the service, attempting to reinstall the service, it was necessary to physically uninstall the product.

And following Support's past information, I ran the Norton Removal tool.

When it seemed to hang on Removing Folder Subtrees, I took a look at the log, which pointed to the above named folder - and Windows couldn't count them fast enough. 

I looked at my own computer and there are 185; on another computer 325; yet on a third, there are over 6,250!

What is going on here?!?

Are they random file names? What extension?

Thanks for making me sort my folder and take a closer look.

All of them GUID-like, except for one:  submissions.idx

Please don't tell me that ccSubSDK stands for "submitted, Symantec don't know"...

Looks like it's for file reputation-like submissions. Is there any info showing in the clients Security or System log in regards to submissions?

Could you please pass on the exact location for these files?

It is in the very first line of the original post...

C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.5.0.19\CmnClnt\ccSubSDK

And one client's desktop has 7430 files in this folder!

Brian, I don't know what event IDs or keywords to use for a filter.

I'm going to have to open a case with support for this.

Edited to say:

Opened 08754007 on 5/14/2015 @ 10:55.

As of 5/15/2015 @ 15:25 there has been no activity on it....

Apologies for the delay. I have requested cocern team to pickup this case.

Meanwhile can go through similar thread reported on Norton community.

http://community.norton.com/en/forums/some-anomalous-files-under-norton-eating-hdd-space

You are referring to an article about the consumer product from 2011.

I absolutely do not see how that helps me with the Small Business Edition in 2015, despite the acknowledgement that the underlying technology is similar.

After 4 days, no one has touched the case I opened.

And I just found another client computer that has 13,950 files in this folder.  This is on a computer that is on 24x7.

One of the submission files - issued today - included an icon file displayed in IE for a web site that has been in use since the system was installed more than two years ago.

That same icon file is used on four other computers at this site.  Why - in heavens name - would this need to be subjected to any kind of review after all of this time?

I believe there is something very wrong with the Symantec Insight processing if this is taking place.

Early last week I called support using the aforementioned ticket because it was still pending.  The technician informed me that he could not pick it up, but could not explain exactly why.

He did spend some time reviewing a few of the computers affected with this problem.  He pretty much narrowed it down the NCW feature that was somehow erroring out and wanted to review additional information offline.

To date I have not received any kind of follow-up, nor has the case been updated with any further status.

And if, in fact, there is some kind of problem with the NCW component in the Symantec.cloud product, I sure hope a developer explains how it can be fixed without the caveat of my having to reinstall the product...