Hidden folder SandblastBackup more than 45 GB files - how to empty

[Kim_Moberg]

Hi CheckMates,

Have any one experienced C:\SandBlastBackup\ folder storing more than 45GB files.

Any easy way to clear to save space on machine?

Machines running:

Windows Server 2016 Std.

Endpoint Security Client E80.86 with the following blades - Anti-Malware, Anti-Bot and Thread emulation / Anti-Exploits (testing without Anti-Ransomware, Behavioural Guard and Foreniscs).

What can I do about it?

Thanks

Best regards
Kim

[PhoneBoy]

Considering this folder should only be 1GB or so, that's probably worthy of a TAC case.

[ProfHastig]

Hi Kim, 

if it wasn't solved here was a solution: 

you should deinstall the checkpoint Ransomware. 

You can find uninstall Programm here: 

C:\Programme\checkpoint\endpoint security\TPCommon\Cipolla\uninstall.exe
or
C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla

After deinstallation all folders are deleted

Kind regards

Prof Hastig

[Roman_Zitzev]

Hi Kim,

The issue was fixed for later version,

please upgrade to E81.30 and it will be fixed.

If you wish to stay on the same version, you can remove self-protection and delete the folder,

it will recreate and after some time it may increase to a big size, the reason it happen is because

the backup load was very high due to huge IO that done on windows server, this cause starvation problem 

for purging.

If you wish we can do zoom and i can assist in deleting the folder but keep in mind it may increase again.

Better option is to upgrade to the last stable version E81.30.

Thx,

Roman

[Eric_Merillat]

Roman,

In several places it has been mentioned to disable self-protection when dealing with the Sandblast Agent and fixing issues.  I have not found anything in the documentation or sk articles on how to disable the self-protection in the Sandblast Agent.  How would one go about doing this?

Thanks,

Eric

[Roman_Zitzev]

Hi,

How to disable self-protection:

Go one of the bellow folders:

1. %temp% 

2. C:\Windows\Temp

search for folders with GUID format(example - {3A4A550F-C963-46A6-8900-6966C05EF5E3})

inside there is a file called PassDialog.exe 

run it and put the password you set in your END POINT management console.

About the issue;

We prevent this issue from happening in version 83.10

You can install the version and it will prevent the folder to grow above the size you configure in the policy(by default 1 GB)

if you can please collect cpinfo and contact me, i will provide ftp account to upload the data.

romanzit@checkpoint.com

ty

roman