Endpoint Protection

I have read many posts and none seem to address the issue that applies to version 12.1 RU5 Symantec Endpoint Proctection.

This Symantec Antivirus Detection Window is up and consistently adding new *.tmp files to the list for analysis and quaratine.

I cannot disable the "do nothing option with new definations" because I cannot find the option in my "Virus and Spyware Protection settings.

Any help is greatly appreciated. 

it's known issue

DWH*.tmp files are created and detected when quarantine is scanned with new virus definitions

https://support.symantec.com/en_US/article.TECH102953.html

Please read this:

When new virus definitions are in place and the quarantine is being scanned, a DWH file is created and detected by Auto-Protect

http://www.symantec.com/docs/TECH102953

You need to clear out manually for the only other solution since you cannot make the policy change. This is a false positive and has been a known issue for some time now.

I cannot find this detail in my 12.1 RU5 Symantec EP.  How do I get to Windows settings -> Quarantine> advanced Options to select DO NOTHING.

These instructions do not match the dialogs for 12.1 RU5.

Disable rescanning of the local quarantine upon receipt of new virus definitions. 

1. Open the Virus and Spyware policy > Windows Settings > Quarantine > Advanced Options
2. Under "When New Virus Definitions Arrive" select Do nothing.

Open the AV policy and go to Quarantine. On the General select 'Do Nothing'

You can find here.

Open the Virus and Spyware policy >Edit-> Windows Settings > general

Cause: This is caused by the rescanning of files that are already in the Qurantine.

Solution: Either the rescanning of files in the Quarantine should be disabled OR There should be no files in the Quarantine to be rescanned.

The option to disable the rescanning of files in Quarantine is available in the "Virus and Spyware policy" in the SEP-Manager console. If the affected machine is a managed client (which is reporting to the SE-Manager), you need to change disable this option in the policy in SEP-Manager.

If the affected machine is an Self-managed client (standalone, not reporting to a SEP-Manager), this option is not available in the SEP client. Hence the solution would be to delete all the related files, so that there won't be any file in the Quarantine and hence avoiding the rescan of the files in Quarantine.

Note: Deleting the files in the quarantine will not affect the normal working of the computer.

Boot the computer in to Windows Safe Mode and delete the related files by following the article at the link below. In addition, check the risk log on the SEP client and check the path where the detections are made. If the path in the log is not in this article, then you need to locate that folder and empty it as well.

http://www.symantec.com/docs/TECH102953

Hi,

By any chance are you running Small Business Edition? 'Do nothing' is not recommend setting.

Actually this was a known issue with previous SEP releases. We haven't haerd about this issue with any recent SEP release.

How many clients are affected?

Hi efd,

The most important question is, "WHERE are these .tmp files being detected?"  Don't assume that this is a product defect/false alarm.  Can you post a samples list of detected files and locations?  (That can be found in the risk log.)

Many thanks,

Mick