Hi,

Release notes for Endpoint Protection and Network Access Control 11

http://www.symantec.com/docs/TECH103087 

Quarantine scan causes Auto-Protect detections in %temp% folder
Fix ID: 1525749
Symptom: DWHWizard.exe starts the quarantine scan and moves quarantined files in to the %temp% folder for scanning. Auto Protect will occasionally detect these infected files.
Solution: After extracting and re-scanning each quarantine item, the TMP file is deleted unless the state is now REPAIRABLE. Repairable files are used later, either to restore to the original location or to save back to Quarantine (REPAIR_ONLY mode). These files should be clean, so Auto-Protect should not detect anything in them.DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

DWHxxxx.tmp files are scanned and re-detected when new definitions arrive or during a scheduled scan

Part of this issue was addressed in RU7.  However we have reports that RU7 does not solve the issue in all cases.  We have this issue tracked under incident 2067778.  This is planned to be fixed in SEP 11 RU7 MP2.

Note: Removing all files from your client's quarantine folder will prevent this issue from happening.

SEP12.1 occasionally has this issue as well.

Yes.  SEP 12.1 has an issue here also.  When we fix it in SEP 11 we will also fix it in SEP 12.1.