• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Kudos0

Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Hi all,

I run Process Explorer whenever I'm using my PC to monitor the CPU usage and for other purposes. Recently I switched to Norton AV and it runs fine and I like the performance. The problem is that I get tons of "Unauthorized Access Blocked" alerts in my security history. I imagine Process Explorer is trying to access info about Norton and norton is denying it. That's fine. My concern is that this is making my security history log gigantic and I'd rather not have Norton wasting disk IO constantly updating the log with these redundant alerts.

Disabling tamper protection solves the problem but I don't want to have to do that. Is there any way to exempt process explorer from tamper protection or at least stop all these alerts being written in the security history?

thanks

Replies

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Hi all,

I run Process Explorer whenever I'm using my PC to monitor the CPU usage and for other purposes. Recently I switched to Norton AV and it runs fine and I like the performance. The problem is that I get tons of "Unauthorized Access Blocked" alerts in my security history. I imagine Process Explorer is trying to access info about Norton and norton is denying it. That's fine. My concern is that this is making my security history log gigantic and I'd rather not have Norton wasting disk IO constantly updating the log with these redundant alerts.

Disabling tamper protection solves the problem but I don't want to have to do that. Is there any way to exempt process explorer from tamper protection or at least stop all these alerts being written in the security history?

thanks

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Hi fmcsimmons,

Interesting.  I am also running Process Explorer in the background with Norton Internet Security 2012 and do not get any Tamper Protection events.  What  version of ProcExp are you running?

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Process Explorer 15.23

Norton AntiVirus: 20.2.1.22

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Running PE with admin rights also if that matters.

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Interestingly enough the open source tool Process Hacker does not trigger the alerts. It has a lot of PE's functionality but is open source.

So there's no way to solve this problem then?

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

There is no way to exclude specific programs from Tamper Protection monitoring.  I wonder if anyone else is also having your issue.

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

I have been running NIS 2013 since last fall. I also get bombarded with Norton event log entries when I use Process Explorer. Annoying as heck.

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer


SendOfJive wrote:

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.


No, NIS 2012 gets the same tamper entries. Tested on several systems.

Kudos0

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer


Bombastus wrote:

SendOfJive wrote:

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.


No, NIS 2012 gets the same tamper entries. Tested on several systems.


What I meant was that some patches will introduce new monitoring rules for Norton Product Tamper Protection, so not all versions will necessarily log the same events.   Good to know though, that NIS 2012 and NIS 2013 are on the same page.

Replies are locked for this thread.