topic Unauthorized Access Logged???? in Norton Internet Security / Norton AntiVirus

Unauthorized Access Logged????

CountryGuy — Sun, 04 Oct 2009 05:45:28 GMT

I have two machines using NIS2010 at the moment, both running Windows 7. I have a bunch of messages in my history for "Unauthorized Access Logged". Here is the full message:

Severity: Medium

Activity: Unauthorized access logged (Access Process Data)

Recommended Action: No Action Required

Under Advanced Details:

Actor: C:\WINDOWS\SYSTEM32\CONHOST.EXE

Target: \Device\Harddisk\ProgramFiles (x86)\Norton Online\AddOns\Norton Safety Minder\Engine\1.1.5.15\TampMon.exe

Conhost.exe is a new binary with Windows 7, so my hope / guess is its a false positive? Anyone else experience this thus far?

EDIT: I should note that NIS2010 is not throwing an alert for these, they are just in the History, and appear sporadically (1-2 times an hour though).

Message Edited by CountryGuy on 10-04-2009 01:45 AM

Re: Unauthorized Access Logged????

mdturner — Sun, 04 Oct 2009 06:49:30 GMT

CountryGuy wrote:
I have two machines using NIS2010 at the moment, both running Windows 7. I have a bunch of messages in my history for "Unauthorized Access Logged". Here is the full message:

Severity: Medium
Activity: Unauthorized access logged (Access Process Data)
Recommended Action: No Action Required

Under Advanced Details:
Actor: C:\WINDOWS\SYSTEM32\CONHOST.EXE
Target: \Device\Harddisk\ProgramFiles (x86)\Norton Online\AddOns\Norton Safety Minder\Engine\1.1.5.15\TampMon.exe

Conhost.exe is a new binary with Windows 7, so my hope / guess is its a false positive? Anyone else experience this thus far?

EDIT: I should note that NIS2010 is not throwing an alert for these, they are just in the History, and appear sporadically (1-2 times an hour though).
Message Edited by CountryGuy on 10-04-2009 01:45 AM

I think your assessment is correct and this is not an issue to worry about - looks like a false positive.

Re: Unauthorized Access Logged????

dbrisendine — Sun, 04 Oct 2009 07:58:38 GMT

This is not a false positive but a logged information record that something tried to access part of NIS's processes. This did happen and NIS blocked the access to keep it's processes secure. The log record is just so you will know what happened (in the background, without your intervention) should there ever be a concern.

Re: Unauthorized Access Logged????

rbridgeman — Sun, 01 Nov 2009 00:34:48 GMT

When accessing myyearbook.com, browsing my and other profiles for a bit, my network access always cuts out and I can't see passed the scope of my computer (router and modem aren't seen). A soft reboot fixes this problem. This has just been happening with Windows 7. It didn't happen with Vista when I had it. As a result, the same message appears as above (Unauthorized Access Logged (Access Process Data)) after the soft reboot in the Norton Tamper Protection. I have all the same software as I had with Vista. I use my laptop with Vista to access myyearbook.com since it works fine.

Re: Unauthorized Access Logged????

neigh-ho-ma — Sun, 01 Nov 2009 05:12:46 GMT

i get this in my history (Unauthorized Access Logged (Access Process Data)) after i run a malwarebytes quick scan.