hi,

what is the SEP version, this issue has been fixed in RU6 MP1, however the RU6 MP2 is out. You install the current version. That should fix the issue.

Information on issue

http://www.symantec.com/business/support/index?page=content&id=TECH92399&locale=en_US

As mentioned above upgrade is the first solution,

DWH***.tmp files are detected in the user profile temp directory.

 http://www.symantec.com/docs/TECH92399

Large numbers of .tmp files are being created in the xfer_tmp or 7.5/xfer folder and are being detected as threats.

http://www.symantec.com/business/support/index?page=content&id=TECH93590&locale=en_US

Are you familiar with Ccleaner. It is a simple utillty program that erases temp files. Run a scan and copy the temp file in the search box.

I ran into this also.  

What is happening is Symantec will rescan the files in Quarantine when it downloaded new def files.  When it does this is places those files in the Temp folder as a file named DWH***.tmp.  Unfortunately it then detects those files as a Trojan.Gen and quaratines them.  

What I did to fix it was:

1. Clear out the temp folder.  You can either do this from the GUI or from a command prompt.
2. Clear out the quarantine folder.  You can do this from the SEP GUI.

Once those are both cleaned out it should stop happening.  

I also wrote a batch script that clears out all the Temp folders, for all users, and Recycler.

You may need to modify it not to include C:\Temp.  Some of our clients were re-pointed to C:\Temp for their temp locations, if yours are not just remove that line.  

This also only works in XP right now.  Working on modifying it to run in Win7

Hi

I have installed and upgraded  Symantec_Endpoint_Protection_11.0.6_MP2_Xplat_EN_DVD as i was suggested in this forum.Since that upgraded i am running into some problems.

I can't make any reports in SEP console.And in the monitor page shows nothing for any summary.Seems update has problem.how could i remove that or any better solution.

Rgds

OMG that will be a lot of things bro.do i need to do the whole process? i just want reporting function to back in normal

it is needed in case of disaster in upgrade etc. Esle the client will not communicate with SEPM and you have to manually update the SEP clients with sylink.