Endpoint Protection

I installed SEP 11.0.6 on one of our machines running Windows 7 x64 and keep getting a DWH.....tmp virus being detected in the TEMP directory. I know that this was an issue in previous versions, but can't seem to be able to find a resolution. Any ideas on how to get rid of it?

Hello ALyman,

Try following the instructions in the following document. If you are unable to clear out any of the directories mentioned, you may try following the instructions in Safe Mode.

• Large amounts of temp files are being created in the xfer_tmp or 7.5/xfer folder and are being detected as threats.
• http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2009042217073548
   

That, coupled with running RU6 (or RU6a), has fixed it for most people I've encountered with that issue.

Regards,
James

Here is a good article that gives reasons for this issue: http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/5acc619d5a30571b882573980069a3cd?OpenDocument. Although as you said this should be fixed in the version you are running. I haven't heard of this happening at all in RU6...

Since we have not seen this in your version could you call in and make a case? If you do please post your case number so we can follow it.


Thanks
Grant

Hello ALyman,

Have you been able to try the document I linked you? If so, did it resolve your issue?

Regards,
James

Hi,

This mostly happens if the virus definitions get corrupt.

You can follow the below mentione steps.

1] Un-install SEP from add/remove program.
2] Delete all the symantec folder.
- c:\Program Files\Symantec\
- c:\Program Files\Common Files\Symantec Shared
- c:\Documents and Settings\All Users\Application Data\Symantec
3] Re-isntall the client as un-managed client. Then make is managed.

this should solve your problem if not then.

Run cleanwip & Re-isntall the client.

Same problem happened when I went from RU5 to RU6a? I'm also running windows 7 x64? Keep getting trojan's being found with DWH*.tmp files being created in the temp directory. Will try above to see if it resolves

The solution that I marked that seemed to correct the issue wasn't really correct in the file locations as it was meant for an earlier version of Windows, but I just searched for the same folders in the Windows 7 x64 version. I think that the issue stems from the xfer folders. I haven't seen anymore popups, but I'll keep my fingers crossed.