Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

DWH***.tmp Temp files detected as virus in RU7

Created: 05 Oct 2011 • Updated: 15 Nov 2012 | 5 comments

Hi,

 

Dwh***.tmp file is detected as virus and gives annoying popup again and again.I installed RU7 also still i face this issue. tried to clear the temp files using SymDelTemps by diabling system restore.

 

Any other solution to this issue.

Comments 5 CommentsJump to latest comment

Chetan Savade's picture

Hi,

Release notes for Endpoint Protection and Network Access Control 11

http://www.symantec.com/docs/TECH103087 

Quarantine scan causes Auto-Protect detections in %temp% folder
Fix ID:
1525749
Symptom: DWHWizard.exe starts the quarantine scan and moves quarantined files in to the %temp% folder for scanning. Auto Protect will occasionally detect these infected files.
Solution: After extracting and re-scanning each quarantine item, the TMP file is deleted unless the state is now REPAIRABLE. Repairable files are used later, either to restore to the original location or to save back to Quarantine (REPAIR_ONLY mode). These files should be clean, so Auto-Protect should not detect anything in them.DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

Fix ID: 1925607
Symptom: DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan.
Solution: After extracting a quarantined item to a temp file, the file is deleted immediately after it is processed
 
I would suggest to scan your system in safe mode & check.

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<

Elisha's picture

Part of this issue was addressed in RU7.  However we have reports that RU7 does not solve the issue in all cases.  We have this issue tracked under incident 2067778.  This is planned to be fixed in SEP 11 RU7 MP2.

Note: Removing all files from your client's quarantine folder will prevent this issue from happening.

Elisha's picture

Yes.  SEP 12.1 has an issue here also.  When we fix it in SEP 11 we will also fix it in SEP 12.1.

Chetan Savade's picture

Hi,

According to the fix notes of latest SEP version i.e. SEP 12.1 RU2, issue is resolved with this release.

Repeated detection of DWHxxxx.tmp as a threat
Fix ID: 2718341
Symptom: Repeated detection of DWHxxxx.tmp as a threat when a Defwatch scan runs on Quarantined items.
Solution: Increased Defwatch scan performance and moved the temporary extraction folder from %TEMP% to Application Data to avoid conflicts with Windows Search Indexer.
 
Reference: New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2

Chetan Savade
Sr.Technical Support Engineer, Endpoint Security
Enterprise Technical Support
CCNA | CCNP | MCSE | SCTS |

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<