topic Re: Hidden folder SandblastBackup more than 45 GB files - how to empty in Endpoint

Hidden folder SandblastBackup more than 45 GB files - how to empty

Kim_Moberg — Thu, 09 May 2019 19:01:56 GMT

Hi CheckMates,

Have any one experienced C:\SandBlastBackup\ folder storing more than 45GB files.

Any easy way to clear to save space on machine?

Machines running:

Windows Server 2016 Std.

Endpoint Security Client E80.86 with the following blades - Anti-Malware, Anti-Bot and Thread emulation / Anti-Exploits (testing without Anti-Ransomware, Behavioural Guard and Foreniscs).

What can I do about it?

Thanks

Best regards
Kim

Re: Hidden folder SandblastBackup more than 45 GB files - how to empty

PhoneBoy — Sat, 11 May 2019 21:59:35 GMT

Considering this folder should only be 1GB or so, that's probably worthy of a TAC case.

Re: Hidden folder SandblastBackup more than 45 GB files - how to empty

ProfHastig — Tue, 27 Aug 2019 16:04:41 GMT

Hi Kim,

if it wasn't solved here was a solution:

you should deinstall the checkpoint Ransomware.

You can find uninstall Programm here:

C:\Programme\checkpoint\endpoint security\TPCommon\Cipolla\uninstall.exe
or
C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla

After deinstallation all folders are deleted

Kind regards

Prof Hastig

Re: Hidden folder SandblastBackup more than 45 GB files - how to empty

Roman_Zitzev — Wed, 28 Aug 2019 11:36:45 GMT

Hi Kim,

The issue was fixed for later version,

please upgrade to E81.30 and it will be fixed.

If you wish to stay on the same version, you can remove self-protection and delete the folder,

it will recreate and after some time it may increase to a big size, the reason it happen is because

the backup load was very high due to huge IO that done on windows server, this cause starvation problem

for purging.

If you wish we can do zoom and i can assist in deleting the folder but keep in mind it may increase again.

Better option is to upgrade to the last stable version E81.30.

Thx,

Roman

Re: Hidden folder SandblastBackup more than 45 GB files - how to empty

Eric_Merillat — Fri, 29 May 2020 19:45:08 GMT

Roman,

In several places it has been mentioned to disable self-protection when dealing with the Sandblast Agent and fixing issues. I have not found anything in the documentation or sk articles on how to disable the self-protection in the Sandblast Agent. How would one go about doing this?

Thanks,

Eric

Re: Hidden folder SandblastBackup more than 45 GB files - how to empty

Roman_Zitzev — Sat, 30 May 2020 10:25:53 GMT

Hi,

How to disable self-protection:

Go one of the bellow folders:

1. %temp%

2. C:\Windows\Temp

search for folders with GUID format(example - {3A4A550F-C963-46A6-8900-6966C05EF5E3})

inside there is a file called PassDialog.exe

run it and put the password you set in your END POINT management console.

About the issue;

We prevent this issue from happening in version 83.10

You can install the version and it will prevent the folder to grow above the size you configure in the policy(by default 1 GB)

if you can please collect cpinfo and contact me, i will provide ftp account to upload the data.

romanzit@checkpoint.com

roman