Endpoint Protection

I am starting to see a large amount of "Trojan Horse" detections residing in "C:\Windows\winsxs\temp\PendingRenames".  In one case I had the machine re-imaged, but the "threat" is still being detected.  The Machines in question are Vista SP2, however I am not seeing this 100% wide spread yet.

Any Ideas?

whats the action taken on these ? quarantinied? or deleted?
 

They are deleted, I would change the primary action so that I can get a sample however since this is a vague detection (Trojan Horse) I don't want to risk not deleting other Trojan Horses.

Is the symptom spreading at all?
What are the filenames being detected as 'Trojan'; do they seem like legitimate windows files??
The windows event viewer on the machine in question may have a record of the filename

hope its not deleting legitimante files
can you paste the complete path and the file name its deleting.
 

The files it is detecting are:

C:\Windows\winsxs\Temp\PendingRenames\bb4e1478bc8eca015a320000680a2807.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\370bd0f5ad8eca01ae030000cc05b00b.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\cf6d3bb6858eca015a320000f40f9c0b.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\593cafcc808eca015a320000240c1803.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\6a24f9215a8eca015a320000640f6405.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\bc9600e6578eca01ae030000640c280c.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\281492f04d8eca016a07000058059405.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\68543d394c8eca015a320000fc04c409.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\152c8cae4b8eca015a3200000412e011.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\49d2547f468eca012d0800003405c005.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\c6370202428eca015a3200008411d812.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\4bfd51383e8eca01e42f0000440e9004.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\f01fa4d6398eca0160320000800f5403.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b

C:\Windows\winsxs\Temp\PendingRenames\2074a061288eca016f3200005809c80c.x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e_scecli.dll_149e0f7b These are just a few.

There were few Vulnerabilities with Scecli.dll
So patch you system with all latest windows security updates and run full scan or run mrt scan

Start - run - MRT

Okay so I have been narrowing this down.  Apparently the image is SP1, and this risk is detected during an upgrade to SP2. 

We see exactly the same problem.

Now, upgraded clients seem OK. But it is discomforting, to say the least(!), that SEP might be messing with the SP2 upgrade.

Hopefully we can get confirmation from Symantec that this is not hurting anything.