The issue of multiple DWH files being created and retained has been improved in SEP 11 Release Update 7 Maintenance Patch 2 (RU7 MP2) and SEP 12.1 RU1 MP1. Please see Migrating to Symantec Endpoint Protection 11.0.7200 (RU7 MP2) or Upgrading or migrating to Symantec Endpoint Protection 12.1.1101 (RU1 MP1) for details on how to apply this update.

Based on the severity of the detections, there are some known workarounds that should resolve the issue. These are listed in order of preference:

1. Disable rescanning of the local quarantine upon receipt of new virus definitions.

   1. Open the Antivirus and Antispyware policy > Windows Settings > Quarantine > General

   2. Under "When New Virus Definitions Arrive" choose Do nothing".
      In SEP 12.1 versions, this policy will be called Virus and Spyware Protection and Quarantine will be under Advanced Options.

1. Limit the size of the Quarantine folder.

   1. In the right-hand panel, on the Cleanup tab, under Quarantined Files, check Enable automatic deleting of quarantined files that could not be repaired (default: Delete after 30 days) and Delete oldest files to limit folder size at: (default 50 MB).

   2. Click Ok and, if needed, assign the policy.

2. Ensure that no processes or services (such as Windows Indexing Service for example) can access or monitor SAVCE or SEP files.

3. Ensure that the "%TEMP%" folder is not open when virus definitions are updated.

4. Restart in safe mode, delete *.DWH files in the temporary folder, and empty the quarantine folder.

If the quarantine, temporary directories, or xfer_temp folders have gotten too big for Windows to open or clear the contents, it may be necessary to do this from a command prompt. Symantec also has a tool called SymDelTmps which can help delete the temporary files on a machine that is difficult to work with. Please contact Technical Support and ask for this utility if you would like to use it.

The instructions below are for a standard installation. If the client is installed somewhere other than the default location, please be sure to change the path for the files and folders in the commands below. The commands will vary based on operating system, so choose the command that is appropriate for your computer.

Deleting files from User Temp folder
Type the following command in Command Prompt. (The following string will vary depending on the user name.) Replace "<NAMEOFUSER>" with the username of the desired Windows user you wish to empty the temp folder for:

Windows 2000/XP/2003:
DEL /F /Q "C:\Documents and Settings\<NAMEOFUSER>\Local Settings\Temp"

Windows Vista/7/2008:
DEL /F /Q "C:\Users\<NAMEOFUSER>\AppData\Local\Temp"

Deleting the contents of the temp folder at the root of C:\

Type the following command in Command Prompt:
DEL /F /Q C:\temp

Deleting the contents of the Windows Temp folder

Type the following command in Command Prompt:
DEL /F /Q C:\WINDOWS\Temp

Deleting the contents of the xfer and/or xfer_temp directories
Type the following command in Command Prompt:

Windows 2000/XP/2003:
SEP 11.x
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer_tmp\"
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\xfer\"

SEP 12.1
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo>\Data\xfer_tmp\"
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo>\Data\xfer\"

Windows Vista/7/2008:
SEP 11.x
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer_tmp\"
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer\"

SEP 12.1
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\<silo>\Data\xfer_tmp\"
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\<silo>\Data\xfer\"

The Quarantine Folder
Note: The following instructions are to be done from the Command Prompt as attempting to open the Quarantine folder in the Windows user interface may result in delays and Windows Explorer application hangs due to the large amount of files that can reside there.

Delete the Quarantine Folder
Type the following commands in the Command Prompt:

Windows 2000/XP/2003:
SEP 11.x
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\"
RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\"

SEP 12.1
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"
RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"

Windows Vista/7/2008:
SEP 11.x
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine\"
RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine\"

SEP 12.1
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"
RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"

Recreate the Quarantine Folder
Type the following commands in the Command Prompt:

Windows 2000/XP/2003:
SEP 11.x
MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Quarantine\"

SEP 12.1
MD "C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"

Windows Vista/7/2008:
SEP 11.x
MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine\"

SEP 12.1
MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\<silo>\Data\Quarantine\"

Start the Symantec Endpoint Protection

1. Click Start, then Run
2. Type: smc -start
3. Click OK

NOTE: It is important to recognize that there are applications, such as Windows Indexing Service, that routinely attempt to touch each file.
Other known applications are Backup applications. In these cases, if that application can make an exclusion for *.DWH, it is strongly advised to implement that exclusion.