DefWatch.DWH\dwh*.exe

I'm seeing a lot of these pop up from Auto Protect and Real Time Scans from our users. Clients are managed and running 12.1.6168.6000 clients.  Google shows that this was a false positive common to SEP 12.1.2 clients (but listed the files as dwh*.tmp not .exe as I'm seeing it). SEP is queuing it as Trojan.Gen.2. 

Any ideas for dealing with this? Thanks