topic Re: Unauthorized access blocked (Set Regietry Security Key). in Norton Internet Security / Norton AntiVirus

Unauthorized access blocked (Set Regietry Security Key).

new_ton — Wed, 04 May 2011 23:32:12 GMT

I found this in my recent history. The word "regietry" is not a typo on my part, this is actually what it says in the log.

Actor: windows\system32\svchost.exe

Actor PID: 708

target: hkey_local_machine\system\currentcontrolset\enum\root\legacy_bhdrvx64\0000\control\

target PID: 0

Action: Set regietry security key.

Reaction: Unauthorized access blocked.

Current OS is Windows 7 SP1 along with NIS 2011.

Any insight regarding this event will be gladly appreciated.

Re: Unauthorized access blocked (Set Regietry Security Key).

delphinium — Thu, 05 May 2011 03:35:16 GMT

It is a Windows process that is accessing too deeply into Nortons system. All it means is that the access was blocked. It does not mean that anything was prevented from working or doing its job. It is part of the protection in place to prevent malware from disabling Norton. Not to worry.

Re: Unauthorized access blocked (Set Regietry Security Key).

new_ton — Fri, 06 May 2011 00:48:26 GMT

I understand. But why would it need to access something that deep in the registry?

Re: Unauthorized access blocked (Set Regietry Security Key).

neigh-ho-ma — Fri, 06 May 2011 19:57:55 GMT

Bump?

Re: Unauthorized access blocked (Set Regietry Security Key).

RonH — Fri, 06 May 2011 20:03:24 GMT

I've also noticed these things in my history log recently. I'm not 100% sure but I think they started after the most recent upgrade. Also, as the original poster pointed out...

The word 'registry' is spelled incorrectly in the history log. If nothing else, I would think Symantec might want to correct that typo.

--Ron

Re: Unauthorized access blocked (Set Regietry Security Key).

SendOfJive — Fri, 06 May 2011 20:17:46 GMT

I agree with RonH. There have been several reports of this Tamper Protection entry since the latest update began to be released. It is not unusual for these sorts of entries to suddenly appear after a change to the program. Sometimes the new notifications are intentional, and sometimes they are not, but either way they are harmless and do not affect the safety or performance of your system. There was a similar situation recently with "Set file attributes" entries in the Tamper Protection logs.

Re: Unauthorized access blocked (Set Regietry Security Key).

neigh-ho-ma — Sat, 07 May 2011 00:10:29 GMT

I, and maybe the OP as well, was hoping for a definitive answer from a Norton employee. If the security suite is responsible for triggering the "harmless" event as part of a comprehensive process, I can relax. But if it's another program I've knowingly and willingly installed that is causing this, then it is of grave importance I get to the bottom of this. Please let me rule in or out the security suite's role.

Re: Unauthorized access blocked (Set Regietry Security Key).

new_ton — Sun, 08 May 2011 03:06:14 GMT

Since the original posting, I have received two more of these entries. I only seem to be getting these at around the same time each morning, so I think it might be a part of some scheduled task.

Was there some big update that was recently applied that I don't know about?

Re: Unauthorized access blocked (Set Regietry Security Key).

neigh-ho-ma — Mon, 09 May 2011 23:04:09 GMT

bump?

Re: Unauthorized access blocked (Set Regietry Security Key).

TooStrong — Tue, 10 May 2011 03:09:20 GMT

I just received this same log in my history for the FIRST TIME. 1 hour after my NIS 2011 updated to 18.6.0.29

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Tue, 10 May 2011 13:20:22 GMT

I have a similar log entry that happened today

Tuesday May 10th 7am central US time.

HOWEVER, I use NIS 2010 and my version is the same 17.8.0.5

so I have not gotten any version update.

My entry shows as follows:

Severity: Medium

Activity: Unauthorized Access Blocked (Set Regietry Security Key)

Status: Blocked

Recommended Action: No action Required

Advanced Details

Actor: C:\Windows\system32\svchost.exe

Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\

LEGACY_EECTRL\0000\Control

Action: Set Regietry Security Key

Reaction: Unauthorized action blocked

I guess what makes me very concerned is this whole Legacy EECTRL thing.

so is this a Norton function or is it an infection???

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Tue, 10 May 2011 13:31:56 GMT

Looking through the tamper protection log I see that the same thing happened on Monday May 9th at 7:59pm US Central Time and again just a few moments ago ( Tuesday May 10th 8: 11 am US Central time)

and again I have no new version update

also my entry is the same as the OP except this part

LEGACY_EECTRL\0000\ wheras others have letters and numbers

The Actor PID seems to be connected to DCOM Service Process Launcher

This is concerning me that there is some type of infection.

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Tue, 10 May 2011 14:11:43 GMT

Update:

This has now happened for the 3rd time in the last 2 hours.

I also googled LEGACY_EECTRL and some info points to a Norton VQR item

Can someone from Norton please address this so we know if this is normal or if it is a sign of infection?

Re: Unauthorized access blocked (Set Regietry Security Key).

delphinium — Tue, 10 May 2011 21:40:52 GMT

From all appearances Windows is attempting to set a security registry key on various Norton files. In both cases, yours and the OP's, the drivers are legacy drivers. Norton doesn't even allow Windows to monkey with it, so it is blocked.

EECTRL is the eraser control driver. The OP's is the BASH driver. The situation is no different than what was previously explained by SendOfJive.

The notification system is not necessarily an exact copy of the problem entry. This is not the first Symantec spelling error, nor will it be the last, I'm sure.

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Wed, 11 May 2011 04:01:34 GMT

SendOfJive wrote:
I agree with RonH. There have been several reports of this Tamper Protection entry since the latest update began to be released. It is not unusual for these sorts of entries to suddenly appear after a change to the program. Sometimes the new notifications are intentional, and sometimes they are not, but either way they are harmless and do not affect the safety or performance of your system. There was a similar situation recently with "Set file attributes" entries in the Tamper Protection logs.

Here is why I am concerned. In my case when I check the Actor Process ID it is associated with an instance of svchost.exe.

When I go to task manager and right click on that particular svchost.exe and right click "Go to services" it takes me to

DcomLaunch ( Decom Server Process Launcher)

others who are experiencing this, when you check the PID of the actor, what servicedoes the svchost.exe run?

No I don't know much about computers, but I have to ask why would that particular svchost.exe be needing to access Norton files?

Does this sound like the svchost.exe has been/is being used to attemp to attack my system?

And why does it seem to happen several times a day only starting 2 days ago?

I appreciate any further clarification. From the other posts on here, it seems that several folks are getting the same thing.

Re: Unauthorized access blocked (Set Regietry Security Key).

delphinium — Wed, 11 May 2011 05:03:54 GMT

DCOM service process launcher. Scroll down to Vista, and read all of the things on your computer that it is required to do.

http://www.blackviper.com/wiki/DCOM_Server_Process_Launcher

Notethe default path:

C:\Windows\system32\svchost.exe -k DcomLaunch

Re: Unauthorized access blocked (Set Regietry Security Key).

SendOfJive — Wed, 11 May 2011 05:06:21 GMT

Calls wrote:
Does this sound like the svchost.exe has been/is being used to attemp to attack my system?

These are all legitimate services and processes that are essential parts of Windows, and therefore are very likely to try to access running Norton processes from time to time. If you find something in the Norton Security History logs that Auto-Protect and various system scans have not already alerted you to, then it is NOT malicious.

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Wed, 11 May 2011 13:39:29 GMT

First thanks all for your responses.

MODS- Should I post my questions as a seperate post?

Back in early May 2011, I had two intrusion attempts: Malicioys Website and a Blackhole Toolkit

But both of these were bloacked by Norton

I'm understaning that there are various functions that might try to access the Norton pices.

No shock to anyone, I still have some confusion

1. LEGACY_EECTRL / Legacy Drivers are part of the Norton function in the registry, right?

2. Why would any windows process/service need to attempt to change the registry key of a Norton function?

3. Any sense as to why this just started 2 days ago and why only some people have noticed this? (My product version hasn't changed)

(Del and SoJ- do you see this happening in your machines too?)

4. So this activity by svchost.exe and the assocoated service Dcom Service Proces launcher Does NOT appear to be any malicious manipulation, where the service has been "taken over" by something malicious??

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Wed, 11 May 2011 13:40:57 GMT

to the original poster of this thread and the others who have noticed this, are you still seeing these entries occuring? I have since May 9, 2011. Seems 2-3 entries daily.

Re: Unauthorized access blocked (Set Regietry Security Key).

Calls — Wed, 11 May 2011 17:43:09 GMT

Has nobody else been getting these entries anymore?