DWH*.tmp files are created and detected when quarantine is scanned wi... https://support.symantec.com/en_US/article.TECH102953.

html

1 of 5 22/06/2017 18:19
DWH*.tmp files are created and detected when quarantine is scanned wi... https://support.symantec.com/en_US/article.TECH102953.html

Deleting .DWH files

Stop the Symantec service

To stop the Symantec Endpoint Protection service:

1. Click Start, then Run

2. Type: smc -stop
3. Click OK

Deleting files from User Temp folder

Type the following command in command prompt. (The following string will vary
depending on the user name.) Replace NAMEOFUSER with the user name of the
desired Windows user for whom you want to empty the temp folder:

Windows 2000/XP/2003:
DEL /F /Q "C:\Documents and Settings\NAMEOFUSER\Local Settings\Temp"

Windows Vista/7/2008/8/2012/10:
DEL /F /Q "C:\Users\NAMEOFUSER\AppData\Local\Temp"

Deleting the contents of the temp folder at the root of C:\

Type the following command in command prompt:

DEL /F /Q C:\temp

Deleting the contents of the Windows Temp folder

Type the following command in command prompt:

DEL /F /Q C:\WINDOWS\Temp

Deleting the contents of the Defwatch temp folder

Type the following command in command prompt:

Windows 2000/XP/2003:

Symantec Endpoint Protection 12.1.5+

DEL /F /Q C:\Documents and Settings\All Users\Application Data\Symantec
\Defwatch.DWH

Windows Vista/7/2008/8/2012/10:

Symantec Endpoint Protection 12.1.5+

DEL /F /Q C:\ProgramData\Symantec\Defwatch.DWH
2 of 5 22/06/2017 18:19
DWH*.tmp files are created and detected when quarantine is scanned wi... https://support.symantec.com/en_US/article.TECH102953.html

Symantec Endpoint Protection 12.1.5+

DEL /F /Q C:\ProgramData\Symantec\Defwatch.DWH

Deleting the contents of the xfer and/or xfer_temp folders

Type the following command in command prompt. Replace silo with the appropriate
build number:

Windows 2000/XP/2003:

Symantec Endpoint Protection 12.1

DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\silo\Data\xfer_tmp\"
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\silo\Data\xfer\"

Symantec Endpoint Protection 11.x

DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\xfer_tmp\"
DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\xfer\"

Windows Vista/7/2008/8/2012/10:

Symantec Endpoint Protection 12.1

DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
\Data\xfer_tmp\"
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
\Data\xfer\"

Symantec Endpoint Protection 11.x

DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint
Protection\xfer_tmp\"
DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\xfer\"

The Quarantine Folder

Note: The following instructions are to be done from the command prompt as
attempting to open the quarantine folder in the Windows user interface may result in
delays and Windows Explorer applications to hang due to the large number of files
that can reside there.

Delete the Quarantine Folder

Type the following commands in the command prompt. Replace silo with the
appropriate build number:

Windows 2000/XP/2003:

3 of 5 22/06/2017 18:19
DWH*.tmp files are created and detected when quarantine is scanned wi... https://support.symantec.com/en_US/article.TECH102953.html

Windows 2000/XP/2003:

Symantec Endpoint Protection 12.1

DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\silo\Data\Quarantine\"
RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\silo\Data\Quarantine\"

Symantec Endpoint Protection 11.x

DEL /F /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\Quarantine\"
RD /S /Q "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\Quarantine\"

Windows Vista/7/2008/8/2012/10:

Symantec Endpoint Protection 12.1

DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
\Data\Quarantine\"
RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
\Data\Quarantine\"

Symantec Endpoint Protection 11.x

DEL /F /Q "C:\ProgramData\Symantec\Symantec Endpoint
Protection\Quarantine\"
RD /S /Q "C:\ProgramData\Symantec\Symantec Endpoint
Protection\Quarantine\"

Recreate the Quarantine Folder

Type the following commands in the command prompt. Replace silo with the
appropriate build number:

Windows 2000/XP/2003:

Symantec Endpoint Protection 12.1

MD "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\silo\Data\Quarantine\"

Symantec Endpoint Protection 11.x

MD "C:\Documents and Settings\All Users\Application Data\Symantec
\Symantec Endpoint Protection\Quarantine\"

Windows Vista/7/2008/8/2012/10:

Symantec Endpoint Protection 12.1

MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
4 of 5 22/06/2017 18:19
DWH*.tmp files are created and detected when quarantine is scanned wi... https://support.symantec.com/en_US/article.TECH102953.html

Symantec Endpoint Protection 12.1

MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\silo
\Data\Quarantine\"

Symantec Endpoint Protection 11.x

MD "C:\ProgramData\Symantec\Symantec Endpoint Protection\Quarantine\"

To start the Symantec Endpoint Protection service:

1. Click Start, then Run.

2. Enter the following: smc -start
3. Click OK.

NOTE: It is important to recognize that there are applications, such as Windows

Indexing Service, that routinely attempts to touch each file. Other applications
known to touch these files are backup applications. In these cases, you should
make an exclusion for *.DWH in that application, if possible.

5 of 5 22/06/2017 18:19