HI,

Check this artical

http://www.symantec.com/business/support/index?page=content&id=TECH170667

There is a hotfix available from Microsoft that addresses this memory leak in crypt32.dll. See the following Microsoft technical article:

http://support.microsoft.com/kb/959658 ("A memory leak problem occurs when you run an application that uses the HttpSendRequest function of the WinHTTP API or of the WinINet API to send Secure Sockets Layer requests in Windows XP Service Pack 3"). 

This hotfix is only for customers experiencing this issue and is available from Microsoft by request only. Please discuss the ramifications with Microsoft before deciding to deploy this hotfix. Other updates may be applied to crypt32.dll, but the hotfix in KB959658 will enforce an older developmental branch. You can even apply updates and this hotfix in any order, and you will still wind up with a hotfixed DLL. This may cause some confusion because the version differences aren't readily apparent. For example, if the update in KB2616676 has already been applied, crypt32.dll version will be 5.131.2600.6149 and applying the hotfix in KB959658 and rebooting, this version number is the same. To see the difference, you must go to the file properties version tab for crypt32.dll and highlight "File Version" to see more versioning details. For example:

Hotfixed: 5.131.2600.6149 (xpsp3_sp3_qfe.110906-1620)

No Hotfix: 5.131.2600.6149 (xpsp3_sp3_gdr.110906-1620)

As an alternative to applying the Microsoft hotfix, you may do one of the following:

• In the Symantec Endpoint Protection TruScan settings, disable the "Scan new processes immediately" option to slow the leak. To further slow the leak, increase the TruScan interval (default is 1 hour). 

  Monitor rtvscan.exe memory usage on the Endpoint Protection client. If it goes above 300MB then restart the rtvscan.exe service (the "Symantec Endpoint Protection" service) . No reboot should be necessary. After monitoring memory usage you may identify an hourly interval at which you can schedule a service restart.
   

• Or, remove the Proactive Threat Protection component of the Endpoint Protection Client.
   
• Or, remove the DigiNotar patch: http://support.microsoft.com/kb/2616676