I have been beating my head for the last 5-6 hours, trying to find anyone similar to my problem, but I haven't had much luck.
I am having a problem with .SPL files with 0 bytes filling up my spooler directory. These files don't appear all the time, just periodically. But, because I have 700+ users using these file/print servers, their spooler fills up pretty fast.
Configuration: I have a few Win2kSP4 file/print server with eTrust 7.1 antivirus within my domain. I have the Real Time AV scanning set to exclude all .SPL and .SHD files and to skip scanning the print spooler directory on both clients and servers. I also have it set on all clients and servers to not to protect floppy, network drives, and CD-ROMS.
Observation: I ran FileMon on one of the servers and had it look at the spoolss.exe and the spooler directory. When the print job worked, FileMon shows the print job having the file attributes set to "A" and "D" through out the print, and the file deletes successfully. When the print job leaves the *.SPL file, FileMon shows the attributes to be "RA". Sure enough, when looking at the properties of the file within the spool directory, the file is set to Read-Only. The spool directory is NOT set to read only. These files appear with clients that are XPSP1, XPSP2, and Win2K SP4 PRO.
I have scanned one of the server for viruses, but nothing comes up. The signature file is the latest and greatest from Computer Assoc. as of 22 Nov 2005.
Any ideas? Thanks for any help and ideas!