Endpoint Protection

 View Only

  • 1.  DWH***.tmp Temp files detected as virus in RU7

    Posted Oct 05, 2011 04:33 AM

    Hi,

     

    Dwh***.tmp file is detected as virus and gives annoying popup again and again.I installed RU7 also still i face this issue. tried to clear the temp files using SymDelTemps by diabling system restore.

     

    Any other solution to this issue.



  • 2.  RE: DWH***.tmp Temp files detected as virus in RU7

    Broadcom Employee
    Posted Oct 05, 2011 05:52 AM

    Hi,

    Release notes for Endpoint Protection and Network Access Control 11

    http://www.symantec.com/docs/TECH103087 

    Quarantine scan causes Auto-Protect detections in %temp% folder
    Fix ID:     1525749
    Symptom: DWHWizard.exe starts the quarantine scan and moves quarantined files in to the %temp% folder for scanning. Auto Protect will occasionally detect these infected files.
    Solution: After extracting and re-scanning each quarantine item, the TMP file is deleted unless the state is now REPAIRABLE. Repairable files are used later, either to restore to the original location or to save back to Quarantine (REPAIR_ONLY mode). These files should be clean, so Auto-Protect should not detect anything in them.DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

    DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

    Fix ID: 1925607
    Symptom: DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan.
    Solution: After extracting a quarantined item to a temp file, the file is deleted immediately after it is processed
     
    I would suggest to scan your system in safe mode & check.


  • 3.  RE: DWH***.tmp Temp files detected as virus in RU7

    Posted Oct 05, 2011 01:54 PM

    Part of this issue was addressed in RU7.  However we have reports that RU7 does not solve the issue in all cases.  We have this issue tracked under incident 2067778.  This is planned to be fixed in SEP 11 RU7 MP2.

    Note: Removing all files from your client's quarantine folder will prevent this issue from happening.



  • 4.  RE: DWH***.tmp Temp files detected as virus in RU7

    Posted Oct 06, 2011 03:21 PM

    SEP12.1 occasionally has this issue as well.



  • 5.  RE: DWH***.tmp Temp files detected as virus in RU7

    Posted Oct 06, 2011 03:29 PM

    Yes.  SEP 12.1 has an issue here also.  When we fix it in SEP 11 we will also fix it in SEP 12.1.



  • 6.  RE: DWH***.tmp Temp files detected as virus in RU7

    Broadcom Employee
    Posted Nov 15, 2012 06:41 AM

    Hi,

    According to the fix notes of latest SEP version i.e. SEP 12.1 RU2, issue is resolved with this release.

    Repeated detection of DWHxxxx.tmp as a threat
    Fix ID: 2718341
    Symptom: Repeated detection of DWHxxxx.tmp as a threat when a Defwatch scan runs on Quarantined items.
    Solution: Increased Defwatch scan performance and moved the temporary extraction folder from %TEMP% to Application Data to avoid conflicts with Windows Search Indexer.
     
    Reference: New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2