Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

How To Get Rid Of “vsserv Is Uploading A Large Volume To Fu.nimbus.bitdefender.com” ?

Options
ngsgt
edited January 2011 in Antivirus

I have discovered that VSSERV was uploading a large volume to fu.nimbus.bitdefender.com since 18th November 2010, and the last questions to BitDefender Technical Support have not been answered since 28th November 2010.


Can anyone tell me how to get rid of it ? It used up a lot of my internet quota.

Comments

  • I have discovered that VSSERV was uploading a large volume to fu.nimbus.bitdefender.com since 18th November 2010, and the last questions to BitDefender Technical Support have not been answered since 28th November 2010.


    Can anyone tell me how to get rid of it ? It used up a lot of my internet quota.


    Does it just happen to me ? No anyone else encounters it ? Or just is unaware of it ?


    VSSERV uploads to 149.bitdefender.com instead of fu.nimbus.bitdefender.com now, with smaller volume each time but more frequencies. (many times a day vs once several days) :blink::wacko::huh::unsure::blink:

  • Does it just happen to me ? No anyone else encounters it ? Or just is unaware of it ?


    VSSERV uploads to 149.bitdefender.com instead of fu.nimbus.bitdefender.com now, with smaller volume each time but more frequencies. (many times a day vs once several days) :blink::wacko::huh::unsure::blink:


    Download updates are common, but how about upload ? Hundreds mega bytes uploads per month ?


  • Download updates are common, but how about upload ? Hundreds mega bytes uploads per month ?


    VSSERV uploads to both 149.bitdefender.com and fu.nimbus.bitdefender.com now, many times a day, hundreds mega bytes per month.

  • @nqsqt - first, which BD product are you using - Antivirus Pro, Internet Security or Total Security? Next, What is your OS - WinXP, Vista or Win7 and is it 32-bit or 64-bit?


    Lastly, how are you seeing (determining) this upload activity? Are you viewing some OS system logs? A third party program? BD logs? If you can explain that, I may be able to test my own PCs to see if I have or do not have this type of activity.


    You may have already checked this, but there are 3 BD option settings that may have something to do with upload activity:


    Go to General-->Settings and make sure both checkboxes under Virus Report Settings are unchecked:


    post-35640-1296308887_thumb.jpg


    Next, go to Antivirus-->Quarantine-->Settings button and uncheck Automatically Submit Files:


    post-35640-1296308903_thumb.jpg


    Finally, go to Update-->Settings and under Advanced Settings uncheck both Enable update sharing (P2P) and Upload BitDefender files from this PC. (The 2nd option should actually gray-out when you uncheck the 1st box):


    post-35640-1296308915_thumb.jpg


    Awaiting your reply,

  • @nikki605


    The product is Antivirus Pro, Win7 32 bit. May be you can check out the correspondence with


    Subject: Re: [Ticket ID:201011181005329] New open ticket


    (It is not convenient and lengthy to post it here)


    Internet traffic quota is crucial for me, so I use a third party program to monitor it. When I notice an abnormal traffic, I close all the opened programs one by one immediately, so I can be sure which program is causing that traffic.


    I have unchecked all those checkboxes. (There is nothing in Quarantine, can BD Automatically Submit Files ? )


    In the last few days, upload is two third of internet traffic !!! Which I have never encountered since I used internet !

  • @nqsqt - I'm a volunteer Mod here on the forum, not a BD employee, so I don't have access to trouble tickets. ;)


    I'm sure one of the BD tech support folks will be able to help you further. :)


    Regards,

  • csalgau
    csalgau ✭✭
    edited January 2011
    Options

    Hello,


    I've been told that under the posted ticket id you have been requested a number of times to send some files but you are only complaining about the continued upload. It is fairly difficult to help users troubleshoot a problem if they do not cooperate, especially when there is only one reporter.


    Given the lack of information, I can only speculate on the cause. While your computer may be uploading large quantities of data, it is quite impossible for us to actually track you just by knowing your upload quota or a few files.


    I've asked that anything sent in reply to that ticket be forwarded to me. Please collect a few random executable files from your drive(for example explorer.exe, iexplore.exe, rundll32.exe, a few from your program files directory...), archive them(please password protect with "infected"), and attach the archive to a reply to the last email you received for the ticket you mentioned.


    Thank you for cooperating:)

  • ngsgt
    edited February 2011
    Options

    @nikki605 – Thank you for your kind attention.


    Hello,


    I've been told that under the posted ticket id you have been requested a number of times to send some files but you are only complaining about the continued upload.


    ..............................................


    @Catalin Salgau – You may have the wrong information.


    I have been told only once to submit BD Support Tool generated files and have sent it on 9th November 2010.


    To be clear, I extract all the correspondence at the following.


    I have sent 6 executable files (including the 3 files you mentioned) according to your instruction, and hope that it will be forwarded to you.


    > > >>From: ngsgt


    > >> > Sent: Thursday, November 18, 2010 5:51 PM


    >> >> Content: I note that as if VSSERV is uploading a large volume to


    >> >> fu.nimbus.bitdefender.com today, is that right ?


    >>> > From: "BitDefender Customer Care" <support@bitdefender.com>


    >> >> Sent: Friday, November 19, 2010 3:27 AM


    > >> >


    > >> > Dear Customer,


    > >> >


    > >> > Thank you for choosing BitDefender! In order to troubleshoot the issue you are


    > >> > encountering we would like you to follow the steps below:


    > >> >


    > >> > 1. Click on Start and then choose My Computer/Computer.


    > >> > 2. Browse to C:\Program Files\BitDefender\BitDefender 2011


    > >> > - considering that BitDefender was installed on the default C partition


    > >> > 3. Double-click on the supporttool.exe file (or just supporttool with the red


    > >> > thumbnail) - if you are using Vista or Windows 7, right-click on the


    > >> > supporttool application file and select Run as Administrator


    > >> > 4. Click on Next, wait a few minutes for the progress bar to complete and then click on Finish


    > >> > 5. A file will be created on your desktop.


    > >> > 6. Send us in reply to this email the file created.


    > >> > 7. Include a detailed description of the issue you are encountering and a


    > >> > screenshot of the error message, if there is one.


    > >> > and attach it to the reply to this email.


    > >> >


    > >> > We will analyze the information you sent and then reply with a possible


    > >> > solution in the shortest time.


    >> > ---------------------- Original Message ---------------------


    >> > From: ngsgt


    >> > Sent: Friday, November 19, 2010 12:29 PM


    >> > Attachment: BDSP_WIN7-PC_2010_11_19_12_04.zip


    >> >


    > >> Thank you for the prompt reply. The attachment is the file created.


    > >>


    > >> Thank you for your kind attention.


    > > From: "BitDefender Customer Care" <support@bitdefender.com>


    > > Sent: Friday, November 19, 2010 3:22 PM


    > >


    > > Thank you for your reply. Please go to this page


    > > http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx and download the autoruns file.


    > > Extract the contents of the downloaded file, run the 'autoruns.exe' and


    > > uncheck the following services (go to Services tab):


    > >


    > > hpqgpc01.exe


    > > hpqste08.exe


    > > hpqbam08.exe


    > >


    > > After this close the autoruns.exe file.


    > > Please restart your computer and check if you encounter the same issue.


    > > Regarding the archive you can see in it also the help file for more


    > > information regarding the application.


    > > It is a useful one in case some processes enter into conflict and you can keep it.


    > >


    > > We are looking forward to hearing from you!


    > > From: ngsgt


    > > Sent: Friday, November 19, 2010 6:31 PM


    > >


    > > Thank you for the prompt reply.


    > >


    > > I have done the procedure according to your instruction and did not find those services


    > > ( hpqgpc01.exe, hpqste08.exe, hpqbam08.exe ).


    > > Were those HP printer softwares uploading quite a large volume to


    > > fu.nimbus.bitdefender.com ?


    > >


    > > Thank you for your kind attention.


    > > > From: ngsgt


    > > > Sent: Friday, November 19, 2010 6:32 PM


    > > >


    > > > VSSERV is uploading to fu.nimbus.bitdefender.com again today.


    > > > I have done the procedure according to your instruction and did not find those


    > > > services ( hpqgpc01.exe, hpqste08.exe, hpqbam08.exe ).


    > > > Were those HP printer softwares causing VSSERV to upload quite a large volume


    > > > to fu.nimbus.bitdefender.com ?


    > > >


    > > > I intend to discuss the case in public forum, but that may causing a great


    > > > impact, so your help is much appriciated.


    > > >


    > > > Thank you for your kind attention.


    > > From: "BitDefender Customer Care" <support@bitdefender.com>


    > > Sent: Thursday, November 25, 2010 9:50 PM


    > >


    > > Please accept my apologizes regarding the delay of the answer. Nimbus is our


    > > server in Cloud. It is used for Antiphishing as well as for Search Advisor for


    > > which the check is done only in cloud.


    > >


    > > This was implemented in order not to check locally on your computer. All the


    > > analysis is performed on our servers which are updated each minute and nimbus


    > > receives this result. It has a lot of advantages, among which there are:


    > >


    > > - our servers contain large databases which would take a lot of space on your computer


    > > - databases are updated more often than the product installed on your computer


    > > which it offers a higher accuracy for finding threats - it does not take from the bandwidth


    > >


    > > Search Advisor improves your online threat protection by alerting you about


    > > phishing or untrusted web pages directly from your search results page.


    > > Search Advisor works with any web browser and checks the search results


    > > displayed by the most popular search engines:


    > > ● Google


    > > ● Yahoo!


    > > ● Bing


    > > Search Advisor indicates whether a search result is safe or not by placing a


    > > small status icon before the link.


    > > Green circle with a check mark: You can safely access the link.


    > > Red circle with an exclamation mark: This is a phishing or untrusted web page.


    > > You should avoid opening the link. If you are using Internet Explorer or


    > > Firefox and you try to open the link, BitDefender will automatically block the


    > > web page and display an alert page instead. If you want to ignore the alert


    > > and access the web page, follow the instructions in the alert page.


    > >


    > > For further questions, please do not hesitate to reply to this email!


    > >From: ngsgt


    > >Sent: Sunday, November 28, 2010 2:46 PM


    > >


    > >Thank you for the answer.


    > >


    > >It is the large volume that matter, for it used up a lot of my internet quota. It has already


    > >uploaded about 40 MB when I discovered for the first time and may upload much more if I


    > >did not interrupt by restarting the computer. It has occurred 4 times in 9 days.


    > >


    > >The questions are:


    > >


    1. Does Antiphishing or Search Advisor need to upload such a large volume?


    2. I have used the Antivirus software for more than 3 months, why that it just begins to upload now? Is it a new feature?


    3. Can I disable that feature?


    > >


    > >Thank you for your kind attention.


    > --------------------------------------------------


    > From: <ngsgt>


    > Sent: Thursday, December 09, 2010 3:10 PM


    >


    > Thank you for the answer.


    >


    > It is the large volume that matter, for it used up a lot of my internet


    > quota. It has already uploaded about 40 MB when I discovered for the first


    > time and may upload much more if I did not interrupt by restarting the


    > computer. It has occurred 8 times since November 18.


    >


    > The questions are:


    > Does Antiphishing or Search Advisor need to upload such a large volume?


    > I have used the Antivirus software for more than 3 months, why that it just


    > begins to upload now? Is it a new feature?


    > Can I disable that feature?


    >


    > Thank you for your kind attention.


    From: ngsgt


    Sent: Monday, January 31, 2011 9:10 PM


    Attachment: Executable.zip


    > Please forward to Catalin Salgau

  • Under BD Options-->Preferences, you can turn off both Search Advisor and Antiphishing to see if that reduces the amount of internet traffic. I have Search Advisor turned OFF on all my PCs. Just my personal preference.


    From the BD User's Guide, here is what each of those options do. It is up to each user to decide how important each option is to them:


    16. Antiphishing Protection


    BitDefender Antiphishing prevents you from disclosing personal information while


    browsing the Internet by alerting you about potential phishing web pages.


    BitDefender provides real-time antiphishing protection for:


    ● Internet Explorer


    ● Mozilla Firefox


    ● Yahoo! Messenger


    ● Windows Live (MSN) Messenger


    16.1. Configuring the Antiphishing White List


    You can configure and manage a white list of web sites that will not be scanned by


    the BitDefender Antiphishing engines. The white list should contain only web sites


    you fully trust. For example, add the web sites where you currently shop online.


    Note


    You can easily add web sites to the white list from the BitDefender Antiphishing


    toolbar integrated into your web browser. For more information, please refer to


    “Managing the BitDefender Antiphishing Protection in Internet Explorer and Firefox”


    (p. 76).


    To configure and manage the antiphishing white list:


    ● If you are using a supported web browser, click the BitDefender toolbar and choose


    White List from the menu.


    ● Alternatively, follow these steps:


    1. Open BitDefender, click Options in the upper-right corner of the window and


    choose Expert View.


    2. Go to Antivirus > Shield.


    3. Click White List.


    To add a site to the White List, provide its address in the corresponding field and


    click Add.


    If you want to remove a web site from the white list, click the corresponding Remove


    button.


    Click Save to save the changes and close the window.


    17. Search Advisor


    Search Advisor improves your online threat protection by alerting you about phishing


    or untrusted web pages directly from your search results page.


    Search Advisor works with any web browser and checks the search results displayed


    by the most popular search engines:


    ● Google


    ● Yahoo!


    ● Bing


    Search Advisor indicates whether a search result is safe or not by placing a small


    status icon before the link.


    Green circle with a check mark: You can safely access the link.


    Red circle with an exclamation mark: This is a phishing or untrusted web


    page. You should avoid opening the link. If you are using Internet Explorer or Firefox


    and you try to open the link, BitDefender will automatically block the web page and


    display an alert page instead. If you want to ignore the alert and access the web


    page, follow the instructions in the alert page.


    17.1. Disabling Search Advisor


    To disable Search Advisor:


    1. Open BitDefender, click Options in the upper-right corner of the window and


    choose Preferences.


    2. Go to Security Settings.


    3. Use the switch to turn off Search Advisor.


    You may want to download the complete BD User's Manual (pdf format) for reference. There is more information on these and all the other BD option settings.


    Regards,

  • Under BD Options-->Preferences, you can turn off both Search Advisor and Antiphishing to see if that reduces the amount of internet traffic. .....


    @nikki605


    - I have already tried those options (when I was told about Search Advisor and Antiphishing) but did not work, it seems that they are not related. Logically, if it was caused by Search Advisor or Antiphishing then there must be many BD users have the same problem.


    - As Catalin Salgau said there is only one reporter, may it mean that no other BD user (with Search Advisor and Anti Fishing Options turn on or off) encounters the same case?


    - In the first 3 months using BD everything was fine, why that it just began after 3 months?


    - After my report, the remote location change from fu.nimbus.bitdefender.com to 149.bitdefender.com, with smaller volume each time but more frequencies. (many times a day vs once several days). Now, sometime, both are the remote locations but more often it is 149.bitdefender.com.

  • @ngsgt - I know you have sent the SupportTool log files once already, but please follow the procedure below to have BD tech support investigate your issue further.


    1. First please unplug the Internet cable from your computer or disable the Wireless adaptor if you are using one. This prevents the supporttools files from being automatically uploaded.


    2. Click on Start and then choose My Computer/Computer.


    3. Browse to:


    C:\Program Files\BitDefender\BitDefender 2011


    - considering that BitDefender was installed on the default C partition


    4. Double-click on the supporttool.exe file - if you are using Vista or Windows 7, right-click on the supporttool application file and select Run as Administrator


    5. Click on Next, wait a few minutes for the progress bar to complete and then click on Finish


    6. A file will be created on your desktop. Please move it to a location of your choice (i.e. move it on your c:\ drive)


    7. Reconnect your internet cable (only after you have moved the file to the new location)


    8. Upload the created file HERE


    9. Include a detailed description of the issue you are encountering and a screenshot of the error message, if there is one.


    10. Send a PM (Private Message) with the download link to DanyDan of tech support. Include a link to this topic and give him as much detail as possible about your PC - exact symptoms, hardware (CPU type/speed, Memory installed, etc.), OS and version, 32-bit or 64-bit, any other security software installed or previously uninstalled. Any other relevant configuration information.


    It may take several days for them to analyze the files and respond depending on their workload, so please be patient.


    Regards,

  • Information update:


    - I have uploaded the SupportTool log files again and sent PM to DanyDan on Feb 6, including hardware configuration (CPU type/speed, Memory installed, etc.), OS and version.


    - VSSERV uploads to 149.bitdefender.com (sometime to fu.nimbus.bitdefender.com simultaneously) for less than 20 seconds each time, (if using small bandwidth, it will last for minutes), many times a day, hundreds MB per month.

  • OK, great :) Give DanyDan some time to investigate the log files and get back to you.


    Regards,

  • Hello,


    Please provide me with the full name, version and a download link for the third party software you use to monitor your Internet traffic so I can make the tests with the same software.


    Do you have the AVC feature disabled or enabled ? How about IDS ? Please make the following test:


    - disable AVC and IDS from Antivirus -> Advanced Settings;


    - check to see if there are changes in the upload traffic;


    - an autorun log as explained below:


    a) Please go to this page:


    http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx


    and download the autoruns file.


    B) Extract the contents of the downloaded file and run the 'autoruns.exe' file;


    c) Wait for the list to be filled with all the processes and then make sure that you have the Everything tab selected in the upper part;


    d) Click on the Disk icon right under File and chose any location folder on your computer;


    e) Save the file with a specific name (your name, computer name, a random name, which one you want) and then upload it HERE


    f) send me a PM with the download link


    Looking forward to your answer!


    Regards,

  • New questions:


    - I update BD every day. It used to be less than 30 MB, but in the last 2 weeks there were at least 6 daily update downloaded more than a hundred MB each time. (shown under BD update tab, Downloaded: xxxxxx kB). Is that change normal?


    - VSSERV sometime makes several connections with 80.86.110.21 which is the IP address of Ines group. Does BD use Ines network?

  • Hello,


    When a product update is released, the new files may have several MB so yes, I find it normal from time to time to have a bigger update to be downloaded. To better understand and check the files you download each time you update BitDefender, I would recommend you to keep the update module on "Prompt before downloading updates" and each time you will see a pop-up window asking you if you wish to download and install the latest released updates.


    Regarding the IP query be kindly informed that indeed one of the network we use is the Ines one so you can rest assure that the VSSERV is making legit connections.


    If you have any further queries feel free to contact us anytime!

  • Thank you for the answer, here is another one. It has happened several times:


    There was a triangle with exclamation mark on BD icon in Notification area. When clicked,


    General tab->Security Status: WARNING: 1 issue is affecting the security status of this PC. View All Issues->Real-time protection is disabled. If try to fix, Status: Failed. But when view under Antivirus tab: Real-time protection is enabled.


    What was the status then? Disabled or enabled? (The triangle with exclamation mark on BD icon still exist)


    The next day, everything was fine: There was no triangle with exclamation mark on BD icon in Notification area. PROTECTED. No issues are affecting the security status of this PC.

  • Hello,


    If the issue persist please post in this topic so we can start investigating.

  • ngsgt
    Options

    The issue in the last question reappear again this morning (March 2, 2011)

  • Hello,


    I have sent you the steps to resolve the issue you encounter. You will have to rename two files within BitDefender folder. Follow the steps enclosed in my email and confirm if the issue is now resolved.


    Ticket ID: 201011181005329.


    Kind regards,

  • ngsgt
    Options

    There is even no any TCP connection established by VSSERV now but it changed to UDP, there are several uploads (less then 20 seconds but high bandwidth each time) everyday and I can not be sure whether it is caused by VSSERV or not.


    The issues I reported on Feb 22 2011 and Feb 25 2011 did occurred again:


    1. I have enabled "Prompt before downloading updates" option, it did prompt before downloading signatures update (less than 30 MB) but did Not prompt when downloading update of hundred MB. (shown under BD update tab -> Status: Downloading xxxxxxx.xxx and Downloaded: xxxxxx kB )


    2. The issue I reported on Feb 25 2011 occurred again several times but at longer intervals.


    Feb 25 2011, 05:48 AM


    There was a triangle with exclamation mark on BD icon in Notification area. When clicked,


    General tab->Security Status: WARNING: 1 issue is affecting the security status of this PC. View All Issues->Real-time protection is disabled. If try to fix, Status: Failed. But when view under Antivirus tab: Real-time protection is enabled.


    What was the status then? Disabled or enabled? (The triangle with exclamation mark on BD icon still exist)


    The next day, everything was fine: There was no triangle with exclamation mark on BD icon in Notification area. PROTECTED. No issues are affecting the security status of this PC.

  • Unknown
    Options

    Hello,


    There was a triangle with exclamation mark on BD icon in Notification area. When clicked,


    General tab->Security Status: WARNING: 1 issue is affecting the security status of this PC. View All Issues->Real-time protection is disabled. If try to fix, Status: Failed. But when view under Antivirus tab: Real-time protection is enabled.


    What was the status then? Disabled or enabled? (The triangle with exclamation mark on BD icon still exist)


    The next day, everything was fine: There was no triangle with exclamation mark on BD icon in Notification area. PROTECTED. No issues are affecting the security status of this PC.


    - it may happens on slow PC (not necessary older PC but slow PC in terms of having multiple entries present at PC start-up) for the VSSERV service to load a little slower. That is why you are notified that the real time protection is disabled but you see it enabled in the product - it was loaded AFTER the first checkup for any eventual issues. There is a simple way to verify if the Real Time Protection is working, as explained below:


    n order to check if BitDefender is now working properly on your system, please follow the steps below:


    Open this link:


    http://www.eicar.org/85-0-Download.html


    and scroll down to the lower part where the downloads are. Download any of those test files to your computer, open it and check if the BitDefender Real-Time Protection will block/delete the file providing you a pop-up for that action.


    If the Real Time protection is working properly (if it blocks the test file), our product is protecting your PC properly.


    You can read more details about Eicar test file here:


    http://en.wikipedia.org/wiki/EICAR_test_file


    Should you need any further assistance, please do not hesitate to contact us.


    Have a nice day !

  • ngsgt
    Options

    The issues I reported on Feb 22 2011 and Jul 8 2011 :


    I have enabled "Prompt before downloading updates" option, it did prompt before downloading signatures update (less than 30 MB) but did Not prompt when downloading update of hundred MB. (shown under BD update tab -> Status: Downloading xxxxxxx.xxx and Downloaded: xxxxxx kB )


    did occurred again but with a slight different:


    It prompted before download: Signatures update 7xxx kB, but after download, it showed Downloaded: 124274 kB (more than 17 times the stated volume!!!)


    Please DO tell me WHY?


    As internet traffic volume is crucial for me, the accuracy of download volume means a lot.

  • ngsgt
    Options
    I explained in that topic that it was already a duplicate of another one of your posts. So now by starting this new topic, you have triple posted the same issue.


    QUOTE


    Duplicate of http://forum.bitdefender.com/index.php?s=&...st&p=117073


    Topic closed. Please don't double-post.


    I am now closing this topic as triple posting and giving you a warning about it.


    Please continue posting in the original topic: http://forum.bitdefender.com/index.php?s=&...st&p=117073


    Regards,


    There is no any ANSWER for this issue! So I supposed that it might be in different topic. (Download VS Upload)

  • rootkit
    Options

    Hello :)


    The discussion will continue over here:


    http://forum.bitdefender.com/index.php?sho...c=31263&hl=


    Thank you.

This discussion has been closed.