Hi friends,
i have a problem on the client that have SEPM 12.1, my quarantine folder grows each time it is impossible to stop it, and follow the recommendations given here http://www.symantec.com/business/support/index?page=content&id=TECH102953&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1385483600551SpcKBx70cAGqGv9oacE89HWK2F78Kci7G1I8Q another recommendation, I see that this is a problem that has not yet been solved, opened a case on the mark more than 2 weeks and still no one calls me (Case # 05474632) I find that incredible.

Your help is urgently needed.

Thank you.

JHM.

This is the DWHxxx.tmp issue. It's a known bug in SEP. have you tried manually deleting the quarantine?

Follow the steps here:

When new virus definitions are in place and the quarantine is being scanned, a DWH file is created and detected by Auto-Protect

Hope that articles help you.

How to Manage Quarantined files.

I'm tired of deleting in safe mode and system mode and even there's a solution. * tmp grow uncontrollably.

disable scan when new definition arrives.

Than disable scanning quarantine when new defs arrive.

It's a known issue which will hopefully get a fix soon.

It's not truly fixed in 12.1.2, 12.1.3, or 12.1.4. It still exists, it's only improved in future releases.

my version is 12.1.3001

Now I'm testing the effect disable Quarantine scan when new firms arrive.

Doing this should resolve it

the annoying message keeps coming all the time!

You can also supress that until your testing is complete

Hello,

I agree. This issue seems to be resolved as I haven't come across any of such cases with Symantec Endpoint Protection 12.1 RU2 detecting DWH###.TMP files (expect one..in SEP 12.1.4)

tmp file (DWH*****.tmp) detected as Trojan.Gen or Trojan.Gen.2 by Corp products

http://www.symantec.com/business/support/index?page=content&id=TECH102953

The Actual cause was with SEP 11 where the files were created by the Symantec Endpoint Protection or Symantec AntiVirus Quarantine scan. This scan is normally initiated by a virus definition update.

The quarantine scan on virus definition update can be disabled: edit Antivirus and Antispyware policy > Windows Settings > Quarantine > General, under "When New Virus Definitions Arrive" choose "Do nothing".

There are also several known methods to work around the issue:

• The quarantine scan on virus definition update can be disabled in the  Symantec Endpoint Protection Manager (SEPM): edit Antivirus and Antispyware policy > Windows Settings > Quarantine > General, under "When New Virus Definitions Arrive" choose "Do nothing".
• Items in quarantine can be deleted.
• If the indexing service is enabled it could be triggering the issue when the dwh***.tmp files are indexed.
• Investigate other applications that are scanning the temp file for changes.

Check this Thread:

http://www.symantec.com/connect/forums/sep-121-and-dwhtmp-files

In case, the issue is re-occurying even after the above steps have been taken, then please create a case with Symantec Technical Support.

Check these Steps below:

How to create a new case in MySymantec

http://www.symantec.com/business/support/index?page=content&id=TECH58873

Phone numbers to contact Tech Support:-

Regional Support Telephone Numbers:

• United States: https://support.broadcom.com (407-357-7600 from outside the United States)
• Australia: 1300 365510 (+61 2 8220 7111 from outside Australia)
• United Kingdom: +44 (0) 870 606 6000

Additional contact numbers: http://www.symantec.com/business/support/contact_t...

as the message appears, I put the path Quarantine exceptions.
No be fine if this action? Now I perform a full scan.

I think there should be a more transparent solution, so I read several days ago this problem dates back to 2009, it's amazing that even Symantec resolved anything yet, may not be may not juggle do in these instances, but also knowing many rely on the product for this because it is the best on the market or it claims to be.

was this a fresh install or upgrade over previous versions? 

The file name in the scan looks suspicious, get cleanwipe remove previous version of sep,install 12.1.4 the latest the greatest