• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs

Not what you are looking for? Ask the experts!

Kudos0

Blue Screen Crash - not a virus?

I am using Windows7, and Norton Internet Securty, Netbook Edition.

The virus detection and removal has been spotless for the entire year I've been using Norton, except for last night.

I was in a group webcam chat on tinychat when my computer's screen went blue, and the speakers gave off a low feedback. It didn't shut off right away.

So I went to remove the battery, but before I could, the screen went black, but the computer stayed on. I removed it anyway. After about five minutes I restarted, everything's here, no data is missing.

This is all Norton Shows in history (sorry I can't copy/paste it) -->

Unauthorized access blocked. (Access Process Data) -Status: Blocked, no action needed
Actor: Appdata\local\temp\NSU~TMP\au_.exe
Target: Nortoninternetsecurityengine

Risk: Medium

Theres a few similar like these listed. Is it a virus?
 

Could it be I just overheated by computer and it won't happen again? 

Note: I use manycam program, and immediately uninstalled it after when I restarted. Thought it might've been that but I haven't ever had any problem with it

Edit for another note: I was running Chrome. No toolbars and I've had it for almost a year. Firefox and IE have both been slow on my netbook/freeze frequently.

Replies

Kudos0

Re: Blue Screen Crash - not a virus?


enchantlee wrote:

I am using Windows7, and Norton Internet Securty, Netbook Edition.

The virus detection and removal has been spotless for the entire year I've been using Norton, except for last night.

I was in a group webcam chat on tinychat when my computer's screen went blue, and the speakers gave off a low feedback. It didn't shut off right away.

So I went to remove the battery, but before I could, the screen went black, but the computer stayed on. I removed it anyway. After about five minutes I restarted, everything's here, no data is missing.

This is all Norton Shows in history (sorry I can't copy/paste it) -->

Unauthorized access blocked. (Access Process Data) -Status: Blocked, no action needed
Actor: Appdata\local\temp\NSU~TMP\au_.exe
Target: Nortoninternetsecurityengine

Risk: Medium

Theres a few similar like these listed. Is it a virus?
 

Could it be I just overheated by computer and it won't happen again? 

Note: I use manycam program, and immediately uninstalled it after when I restarted. Thought it might've been that but I haven't ever had any problem with it

Edit for another note: I was running Chrome. No toolbars and I've had it for almost a year. Firefox and IE have both been slow on my netbook/freeze frequently.


Welcome,

Sorry to hear about your scare. Let's see if we can give you back your sense of security.

I'll start by assuming that both Windows and Norton are up to date with all of their downloads and patches. Next I will assume that you have run a full scan using your Norton product. Then I would suggest that you run a full scan using Malwarebytes free scanner found here:  http://www.malwarebytes.org/products/malwarebytes_free it's Norton compatible and nice to keep around for when you want a second opinion.

Now about the screen shot. Here's some information that should make it easier:  http://community.norton.com/t5/Forum-Feedback/Forum-Tip-How-to-post-screenshots-in-the-forum/td-p/254415 Don't expect to see it immediately as all graphics must be approved by a moderator before they are displayed in public.

It sounds like something tried to access a part of your Norton program and its tamper protection feature made that impossible. It also sounds like part of the prevention was a shutdown. Not unheard of but a bit unusual.

So. if all checks out clean I expect that you are good to go again. As for it happening again, about the only response I can offer is 'maybe'. The trolls are out there looking for weak spots. You aren't one of the m but that doesn't mean they won't try again. Continue to use your computer as you wish and continue to be careful. The very best security product you have is the one between your right and left ears, when it is fully engaged.

If you haven't installed it you might want to consider Norton DNS:  http://community.norton.com/t5/Other-Norton-Products/New-version-of-Norton-DNS-is-now-available/m-p/548930/message-uid/548930#U548930 it can be on your computer or on your router. Makes a great filter so you don't find yourself in places you really didn't want to be.

Stay well and surf safe. We'll leave a light on

Dick Win7x64 SP1 current NSBU
Kudos1

Re: Blue Screen Crash - not a virus?

Hi enchantlee,

You should follow through on dickevans' suggestions to investigate possible malware.  However, "Unauthorized Access Blocked" entries in Norton history will appear whenever any outside agent - even a Windows process - attempts to access a Norton file or process.  This is not usually an indicator of malware, and it is possible, even likely, that the entries you see are coincidental and not related to the issue you had.  The fact that Norton Auto-Protect did not alert to anything also makes malware less likely, although not out of the question.

Kudos0

Re: Blue Screen Crash - not a virus?


enchantlee wrote:

This is all Norton Shows in history (sorry I can't copy/paste it) -->

Unauthorized access blocked. (Access Process Data) -Status: Blocked, no action needed
Actor: Appdata\local\temp\NSU~TMP\au_.exe
Target: Nortoninternetsecurityengine

 

I'm just throwing out an idea here, but if I scan with the registry cleaner in CCleaner I always get a missing MUI reference for C:\Users\Lori\AppData\Local\temp\~nsu.tmp\Au_.exe on my 32-bit Vista machine.  Doesn't this file have something to do with the Norton Update Agent (NUA) that's responsible for automatically downloading upgrades for Norton products?  I have automatic downloads of new upgrades (Settings | Miscellaneous Settings | Automatic Download of New Version) disabled on my system so the NUA never runs on my system and associated files are probably wiped off my hard drive every time I clean out my temp folders.

GORPY1 started a thread yesterday about a recent NIS 2012 patch delivered by LiveUpdate that requires a re-boot and causes Auto-Fix to throw an error about an incomplete installation.  Symantec employee Tim Lopez's reply here indicates that a product update is coming in the next few weeks and that Auto-Fix may show an installation error because only part of the patch was applied yesterday.

I'm wondering if there was some sort of "hiccup" on enchantlee's system while this patch was trying to install during a background Automatic LiveUpdate.

Edit:

I just noticed that richfed posted here in GORPY1's thread that yesterday's patch created a problem with his Identity Safe.  This may tie in with enchantlee's observation about the missing toolbars in Chrome and IE/Firefox problems.

---------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 9.0.1
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Kudos0

Re: Blue Screen Crash - not a virus?


enchantlee wrote:

I am using Windows7, and Norton Internet Securty, Netbook Edition.

I was in a group webcam chat on tinychat when my computer's screen went blue, and the speakers gave off a low feedback. It didn't shut off right away.  So I went to remove the battery, but before I could, the screen went black, but the computer stayed on. I removed it anyway...

Edit for another note: I was running Chrome. No toolbars and I've had it for almost a year. Firefox and IE have both been slow on my netbook/freeze frequently.


Hi enchantlee:

Could you please confirm the version of your NIS netbook edition from Support | About, and how you installed your software?  For example, if you have the netbook version of NIS 2012 v. 19.2.0.10, did you download the installation file from the Symantec website at www.norton.com/countrycode/netbook (e.g., www.norton.com/uk/netbook) onto a netbook or ultra-mobile PC that doesn't have a CD drive?  Do you have an older version (e.g., NIS 2011 v. 18.6.0.29 netbook edition)?

If you received the NIS product update yesterday via an automatic LiveUpdate that was described in GORPY1's thread here and your PC tried to perform a re-boot while you were using your chat application (hence the blue screen while Windows was attempting to re-start, which might not have been an actual BSOD), you may have interrupted the re-boot when you pulled your battery out of your PC and corrupted your NIS installation.  It's possible you may have to perform a clean re-install of your Norton product to get your Norton extensions working correctly again in your browser, but we can provide step-by-step instructions for you if we know what netbook version of NIS you have.

If you check your NIS security history and look under your LiveUpdates from yesterday, can you see anything in the advanced details for one fo these LiveUpdates that would indicate whether you got a NIS product update that required a re-boot?  The screenshot below is from an older product update on my system  - I didn't receive the most recent product update myself (at least not yet) but that may be because I haven't upgraded to NIS 2012 yet or have the Automatic Download of New Versions disabled in my settings.

 

-----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 9.0.1
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Replies are locked for this thread.