DWH***.tmp and DWH***.exe in Temp Folder

[Migration User]

Hello, I keep having Symantec Endpoint Protection pop up with dwh.exe and dwh.tmp files and it never stops... They're called dwh, and then a bunch of random characters for example "dwh1f6f.exe". Symantec only says the .exe ones are risks, but when I go to the location " C:\Users\ME\AppData\Local\Temp" there are "dwh.tmp" files too. I can't seem to fix this! Please somebody help me.

[ℬrίαη]

This has been a known issue in SEP since the very first versions.

See the solutions presented in this article:

DWH*.tmp files are created and detected when quarantine is scanned with new virus definitions

[Migration User]

How do I open the Virus and Spyware Policy? Sorry about my stupid questions, I'm not too familier with antivirus stuff...

[GeoGeo]

The easiest way to minimise the impact of this known issue is to delete the quarantine files on the machines it's detecting on.

Either remotely delete them from SEPM or locally from the SEP client. Open SEP client > View Quarantine >Highlight all the files > delete.

[ℬrίαη]

Do you have access to a SEPM?

[Migration User]

I don't know... How would I know if I do?

[Migration User]

I don't think that works, since they get deleted and created every time Symantec detects them. :/

[ℬrίαη]

Are you running an unmanaged version or this managed by your company?

[Migration User]

I think unmanaged, I don't seem to have any special options or anything.

[ℬrίαη]

Yea then there won't be a SEPM. You'll need to manually delete the quarantine per the link in my first post.

[GeoGeo]

The DWH issue is an issue symantec have known about for ages where when your machine downloads new defs it removes the files from it's own quarantine to rescan them with the new defs in case there is a fix in the new defs set. While it is scanning the files something else on the machine like a search engine on the machine also scans the files or accesses them so SEP creates a duplicate DWH file hence the random numbers and letters the end. an quarantines them too so the quarantines start to double up. Clearing out the local quarantine folder will stop sep trying to scan the files and creating the duplicates. 

[Migration User]

Once check Tamper protection setting

1. Open the SEPM console.
2. Click Clients.
3. Select the client-group you want to modify.
4. Click the Policies tab.
5. Click General Settings.
6. Click the Tamper Protection tab.
7. Perform one of the following actions: (Should be check the temper protection if its not check that option.)
8. Click OK.