When the virus definitions are updated in SEP, there is an option to "Rescan the Quarantine". This enables the SEP client to inspect the files stored in the local quarantine and verify if any of them can be repaired with the updated AV signatures. When the files were originally quarantined, they were compressed and encrypted to ensure that the stored version cannot continue to infect the local machine. Consequently, the SEP client must extract the original file(s) from this quarantine packaging before it can be re-scanned.
During this file extraction process, a temporary file - named DWH####.tmp - is created in the working directory of the SEP client. This is typically within the "%App Data%\Symantec\" folder, but in certain older builds of SEP it may also use the windows %TEMP% folders. Normally, this temporary file will not be scanned by the SEP Auto Protect function because SEP is already handling the file, i.e. SEP knows that it owns the file. However, if a third-party process accesses that file while it is being created, the SEP Auto Protect function will intercept this file access and will declare the file as un trusted because another process, possibly malicious, had accessed the file.
This will cause the file to be seen as a "new" file and untrusted. Accordingly, the file will be scanned. This results in an already quarantined and infected file getting re-scanned. Accordingly, it will be treated as a suspect file and quarantined, resulting in a duplicate file being added to the local quarantine.
Finally, as each definition sets is received by the SEP client and the local quarantine is re-scanned, the above detailed process repeats and the contents of the local quarantine are doubled.