Zone Alarm has started writing thousands of files to disk

Message boards : Questions and problems : Zone Alarm has started writing thousands of files to disk
Message board moderation

To post messages, you must log in.

AuthorMessage
chrisA

Send message
Joined: 7 Jul 09
Posts: 16
United Kingdom
Message 87519 - Posted: 8 Aug 2018, 15:15:07 UTC

I've been running various projects under BOINC for many years with very few problems.

Today, I started receiving warnings that one of my hard drives was running out of space when, in fact, it should still have had plenty of space.

Upon investigation, I discovered a hidden folder called SandBlastBackup. This folder appears to have been created about a month ago and, since then, has had almost 90,000 txt files written to it. Some files are just a few kilobytes, others are a couple of megabytes. Sometimes just a couple of files are written each minute but, on one occasion, over 1300 files were written in a minute. I have opened a random selection of these files and all seem to be BOINC log files of some sort or another. Many of these files "overlap" the information contained in them.

The drive on which these files are being written is the one on which BOINC is running.

I do no recall having done anything that would cause this to happen. I am currently running BOINC 7.8.3 (64 bit) under Windows 10.

Any thoughts on how I can stop this happening would be appreciated. Thanks.
ID: 87519 · Report as offensive
Profile Jord
Volunteer tester
Help desk expert
Avatar

Send message
Joined: 29 Aug 05
Posts: 15480
Netherlands
Message 87520 - Posted: 8 Aug 2018, 16:32:34 UTC - in response to Message 87519.  

SandBlastBackup is NOT a BOINC directory. As far as I can find it's from ZoneAlarm Firewall / SandBlast Agent. That directory holds a copy of all files on disk in case you get hit by ransomware.
ID: 87520 · Report as offensive
chrisA

Send message
Joined: 7 Jul 09
Posts: 16
United Kingdom
Message 87521 - Posted: 8 Aug 2018, 16:37:20 UTC - in response to Message 87520.  

SandBlastBackup is NOT a BOINC directory. As far as I can find it's from ZoneAlarm Firewall / SandBlast Agent. That directory holds a copy of all files on disk in case you get hit by ransomware.



Yes, I found a reference online to ZoneAlarm Firewall too. And I actually use the basic (free) version of ZoneAlarm which, as far as I know, doesn't offer any special ransomware protection. And it only seems to be BOINC log files that are there.
ID: 87521 · Report as offensive
robsmith
Volunteer tester
Help desk expert

Send message
Joined: 25 May 09
Posts: 1283
United Kingdom
Message 87523 - Posted: 8 Aug 2018, 16:42:14 UTC

Adding to Jord's comments.
A quick google suggests that somewhere along the line you have installed SandBlast security software, or part of it. Possibly it arrived as a freebee with something else.
It appears that it might behave in the manner you are describing when it encounters a folder that has a very high number of files written to it without your intervention. It then does some sort of snapshot, writes its own log file and then carries on watching and waiting for the next unattended new file creation, or file update (this behaviour is typical of the way projects running under BOINC work)
ID: 87523 · Report as offensive
chrisA

Send message
Joined: 7 Jul 09
Posts: 16
United Kingdom
Message 87530 - Posted: 8 Aug 2018, 22:04:06 UTC
Last modified: 8 Aug 2018, 22:07:19 UTC

Thanks Jord and RobSmith.

Your comments got me thinking again about this as things had become somewhat more urgent - my drive was completely full and none of the files could be deleted.

I contacted ZoneAlarm support and, to cut a long story short, it appears that even the free version of ZoneAlarm firewall has some antiransomware components to it; it is possible that activity by BOINC was being incorrectly identified as a ransomware attack (pretty much what RobSmith suggested). To delete the files, I would have to uninstall ZoneAlarm and then reinstall - though I was warned that this would probably create a new SandBlastBackup folder which would start filling up with files again.

I did as suggested and as soon as ZoneAlarm was removed, the entire SandBlastBackup folder and its contents disappeared. ZA has now been reinstalled and for some reason that I do not understand, a new SandBlastBackup folder has not been created (yet!). Keeping fingers crossed.

With hindsight, I accept that the Title to this post is completely wrong - BOINC wasn't responsible for writing thousands of files to my hard drive!

Thanks to both of you for your help.
ID: 87530 · Report as offensive
robsmith
Volunteer tester
Help desk expert

Send message
Joined: 25 May 09
Posts: 1283
United Kingdom
Message 87535 - Posted: 9 Aug 2018, 4:48:10 UTC

Sorry to hear of your woes with ZoneAlarm :-(
You've done a good job in tracking this down and thanks for letting the wider community know.
ID: 87535 · Report as offensive
chrisA

Send message
Joined: 7 Jul 09
Posts: 16
United Kingdom
Message 87540 - Posted: 9 Aug 2018, 9:59:20 UTC - in response to Message 87535.  

I was just about to report that, after more than 12 hours, everything was fine and there was no sign of a SandBlastBackup folder anywhere to be seen. I nearly spoke to soon!

I had cause to do a computer restart and, guess what? A SandBlastBackup folder was created and, within 10 minutes, over 800 files had been written to it amounting to nearly 30MB. It is starting to look as if ZoneAlarm free firewall may have to go (after nearly 20 years).

It will be interesting to see whether other BOINC users with ZoneAlarm Free Firewall encounter this problem - I believe it has only become an issue since the latest update of ZoneAlarm. I discovered it relatively quickly because the hidden folder was created on a relatively small partition (just 50GB) which had only 35GB available for SandBlastBackup to fill up. Had it been created on a 2TB drive, I might not have noticed anything untoward for many, many months or even years!
ID: 87540 · Report as offensive
Dr Who Fan
Avatar

Send message
Joined: 10 May 07
Posts: 1350
United States
Message 87546 - Posted: 9 Aug 2018, 15:27:37 UTC - in response to Message 87540.  

I have not used Zone Alarm in about 7 years. One of the reasons I quit using it was for the reason you stated - (using up lots of hard disk space).

Looking at https://www.zonealarm.com/learning-center/threat-emulation/ (To change Threat Emulation settings). I think this is what you need to do.

Hope this helps.
ID: 87546 · Report as offensive
chrisA

Send message
Joined: 7 Jul 09
Posts: 16
United Kingdom
Message 87566 - Posted: 10 Aug 2018, 9:12:58 UTC - in response to Message 87546.  
Last modified: 10 Aug 2018, 9:13:15 UTC

I have not used Zone Alarm in about 7 years. One of the reasons I quit using it was for the reason you stated - (using up lots of hard disk space).

Looking at https://www.zonealarm.com/learning-center/threat-emulation/ (To change Threat Emulation settings). I think this is what you need to do.

Hope this helps.

Unfortunately, as far as I can see, the free version of ZoneAlarm Firewall doesn't allow access to such settings; most seem to restricted solely to the operation of the firewall. But thank you for taking the time to offer the suggestion.
ID: 87566 · Report as offensive

Message boards : Questions and problems : Zone Alarm has started writing thousands of files to disk

Copyright © 2024 University of California.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation.