I am running Windows Vista 32-bit Business Edition and I currently have Symantec Corporate Antivirus v10.2 installed. My antivirus continually finds the Bloodhound.Exploit.196 virus which filename's usually looks something like this "DWH####.tmp" in my temp folder for my user profile. Symantec's website regards this virus as very low risk but the risk level is not my problem. My problem is that when my Symantec Antivirus starts auto scanning the temp folder it spends all day removing the virus over and over again as the virus gets re added back.
Now so far I have tried deleted out all files from my profile temp folder, my cookies, windows\temp folder, and Java temporary files. Once the virus came back again I upgraded and then uninstalled Adobe Reader and the exploit still continued to reappear. I then uninstalled SAV for a week and watched the temp folder and I never saw the DWH entries come back. Last week I reinstalled SAV and then installed a pdf reader application that reads pdf files but is not Adobe. My computer ran fine for about 5 or so days and today SAV found the DWH files and started back up on its old process of deleting the files over and over again.
How could I still be getting these DWH files if I uninstall Adobe or how can I remove this exploit for good? And I did check another Symantec Endpoint thread on experts-exchange that says simply to update Adobe and delete several temporary files and this did not help at all even though it is the accepted answer for that thread.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I had the same problem a few months back, it seems to be a false positive, seems to be an issue with Symantec. Take a look at the following thread or run a google search on "DWH temp files".
http://community.norton.co
While this thread is not overly helpful in solving the problem, what fixed it for me was applying Maintenance Patch 1 for 10.2. Symantec told me that if the patch didn't work, I would have to upgrade to the newer endpoint 11 product.
I reinstalled my Symantec Corporate v10.2 and a few hours later it began finding the DWH files again. I disabled all Symantec services for a day and then turned them back on. I also installed an alternative to Adobe Reader called PDF-XChange Viewer. That was just a few days after my initial posting and Symantec has not reported anymore DWH files since. Not sure if the reinstall of SAV or install of PDF XChange Viewer helped the issue but so far so good. This is the longest its been since the pop ups.
If I do see the DWH files again I will try to upgrade to Symantec Endpoint.
Hi,
Do the following please:
1) Download and run CCleaner (http://www.ccleaner.com/d
2) Download and run Symantec Intelligent Updater (http://www.symantec.com/b
Latest version: http://definitions.symante
The previous steps will erase all temp files, and update and replace any damaged definition that may cause this false-positive.
A Symantec Certified Specialist @ your service
Business Accounts
Answer for Membership
by: ThinkSmartIncPosted on 2009-01-15 at 12:42:04ID: 23387584
According to http://www.symantec.com/se