Removing temporary files left by Symantec LiveUpdate

We discovered a bug in LiveUpdate® version 3.0.1 and earlier, a component of Symantec® Norton AntiVirus® for Macintosh® version 9.x, under Mac® OS X 10.3 Panther®. This FAQ provides a procedure for removing temporary files left by LiveUpdate after updating your Symantec Norton AntiVirus virus definitions or product files with LiveUpdate.

This FAQ applies to LiveUpdate version 3.0.1 and earlier and Mac OS X 10.3 Panther.

What is LiveUpdate?

LiveUpdate is a key component of Norton AntiVirus. It is used to find and install updates for virus definitions, the Norton AntiVirus application, and LiveUpdate itself.

The bug in LiveUpdate version 3.0.1 and earlier

LiveUpdate version 3.0.1 and earlier leave files in your /private/var/tmp directory that should be removed after installing updates to Norton AntiVirus. These files have file names beginning with tmp. For example: tmp.0.o4fNWL or tmp.3.CJvicH.

These are temporary files downloaded by LiveUpdate from Symantec's servers. They contain updates for virus definitions, the Norton AntiVirus application, or LiveUpdate itself. Once the updates have been installed, LiveUpdate should delete these temporary files from your /private/var/tmp directory. Unfortunately, it does not. Over time, these files accumulate, wasting valuable disk space.

Depending on how often you run LiveUpdate to update virus definitions, and the frequency of updates to Norton AntiVirus or LiveUpdate that are released by Symantec, the space occupied by these leftover, temporary files can be considerable. Over 40 Mb of such files were found in the /private/var/tmp directory of Dr. Smoke's Mac.

Status of the bug

We reported this bug to Symantec in December 2003. One year after reporting the bug, were notified by Symantec that the bug has been fixed in LiveUpdate version 3.0.2. Here is the text of their notification to us:

  • "LiveUpdate 3.0.2 creates and removes files within /private/tmp instead of within /private/var/tmp, which also means that if LiveUpdate or the computer crashes before LiveUpdate gets a chance to remove the temporary files, the OS (operating system) will remove them when the computer is restarted. But LiveUpdate 3.0.2 does not get rid of the temp files created by LiveUpdate 3.0.0 and 3.0.1, so they'll have to remove those files according to the instructions [on The X Lab page]."

Accordingly, you should run LiveUpdate to install LiveUpdate version 3.0.2 on your Mac. However, you will still need to use the procedure below to remove the temporary files left by prior versions of LiveUpdate.

Removing the temporary files left by LiveUpdate

Use the following procedure to safely remove leftover, temporary files after running LiveUpdate v3.0.1 or earlier.

1. Open a new Finder window: select Finder > File > New Finder Window, or press Command-N in Finder.
2. In Finder, select Go > Recent Folders... or press Command-Shift-G.
3.

In the resulting sheet, type the following exactly as written into the Go to the folder field:

  1. /private/var/tmp
4. Click Go. The Finder window displays the contents of the /private/var/tmp directory.
5. In Finder, press Command-2 to place the window in List View.
6.

Trash any files or folders in this Finder window whose file names begin with tmp. and whose dates correspond with the last time you ran LiveUpdate.

Note that one or more of the folders may display the no access badge: a white minus sign (-) within a red circle, as seen in the following screen shot:

This badge indicates that you do not have the required permissions to open the folder. When dropping such a folder in the Trash, you will be prompted to authenticate your intent to trash the folder by typing your Admin password.
7. Empty the Trash.
8. Close the Finder window opened in step 1.

Did you find this FAQ helpful? You will find a wealth of additional advice for preventing or resolving Mac OS X problems in Dr. Smoke's book, Troubleshooting Mac® OS X.
Use of this site signifies your agreement to the terms of use.