Endpoint Protection

Hello All,

Please help me on this issue.We are using sep 11.0.6 version.we have noticed

under symnatec end point folder I2_LDVP.tmp---msl-2408-2 file is created it is taking 50 GB haridisk space.why this file is created?what could be the cause?

This was a known issue with this version and was fixed in a later release.

SEP 11.x is end of life so you need to get to 12.1.5

https://www-secure.symantec.com/connect/forums/symantec-endpoint-protection-110x-eosl

https://www-secure.symantec.com/connect/blogs/did-you-get-security-memo-symantec-endpoint-protection-11-eosl

Symantec Endpoint Protection 11.0.x End of Support Life

http://www.symantec.com/docs/TECH226804

Large files under "\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\i2_ldvp.tmp" folder.

https://www-secure.symantec.com/connect/forums/how-proactively-prevent-files-getting-accumulated-folder-i2ldvptmp

There is no clue why this file is being created. Could you post the exact location or if possible attach the screenshot.

SEP 11 is end of life you must upgrade to SEP 12.1.

With more research it seems it's a scan related issue.

1. Configure Defwatch: It can be resolved by configuring Defwatch to not rescan quarantine:

2. Disable the Windows Indexing Service
What happens when indexing “touches” a file placed in the %temp% or I2_LDVP.tmp folder that it has not indexed yet?
Large files that are too big to fit in memory are placed in the %temp% or I2_LDVP.tmp folder for scanning. Once the file exists in the folder, indexing needs to update itself and touches the file.
Because the “touch” changes the file it becomes a different file to SAV/SEP and the scanning loop starts.

Symantec's recommendation is to disable Windows Indexing, however if this cannot be implemented for customer reasons, then reconfigure Windows Indexing it to exclude the SAV/SEP files and folders in all locations.

Windows Indexing can be configured to not index specific files and folders.
http://support.microsoft.com/kb/308202

Is there any update?

OR

If issue has been resolved could you mark this thread as a solved with the best answer that helps you :)

Article URL http://www.symantec.com/docs/TECH97520