Not what you were looking for? Ask our experts!
Reply
Newbie
fmcsimmons
Posts: 5
Registered: ‎01-28-2013

Countless "Unauthorized Access Blocked" alerts in history when running Process Explorer

Hi all,

 

I run Process Explorer whenever I'm using my PC to monitor the CPU usage and for other purposes. Recently I switched to Norton AV and it runs fine and I like the performance. The problem is that I get tons of "Unauthorized Access Blocked" alerts in my security history. I imagine Process Explorer is trying to access info about Norton and norton is denying it. That's fine. My concern is that this is making my security history log gigantic and I'd rather not have Norton wasting disk IO constantly updating the log with these redundant alerts.

 

Disabling tamper protection solves the problem but I don't want to have to do that. Is there any way to exempt process explorer from tamper protection or at least stop all these alerts being written in the security history?

 

thanks

 

nortonprob.png

SendOfJive
Posts: 10,782
Kudos: 4,838
Solutions: 779
Registered: ‎02-07-2009

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

[ Edited ]

Hi fmcsimmons,

 

Interesting.  I am also running Process Explorer in the background with Norton Internet Security 2012 and do not get any Tamper Protection events.  What  version of ProcExp are you running?

Newbie
fmcsimmons
Posts: 5
Registered: ‎01-28-2013

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

Process Explorer 15.23

Norton AntiVirus: 20.2.1.22

Newbie
fmcsimmons
Posts: 5
Registered: ‎01-28-2013

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

[ Edited ]

Running PE with admin rights also if that matters.

SendOfJive
Posts: 10,782
Kudos: 4,838
Solutions: 779
Registered: ‎02-07-2009

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.

Newbie
fmcsimmons
Posts: 5
Registered: ‎01-28-2013

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

Interestingly enough the open source tool Process Hacker does not trigger the alerts. It has a lot of PE's functionality but is open source.

 

So there's no way to solve this problem then?

SendOfJive
Posts: 10,782
Kudos: 4,838
Solutions: 779
Registered: ‎02-07-2009

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

There is no way to exclude specific programs from Tamper Protection monitoring.  I wonder if anyone else is also having your issue.

Super Contributor
donziehm
Posts: 391
Registered: ‎12-29-2010

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore

I have been running NIS 2013 since last fall. I also get bombarded with Norton event log entries when I use Process Explorer. Annoying as heck.

Super Spam Squasher
Bombastus
Posts: 1,795
Registered: ‎11-16-2009

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore


SendOfJive wrote:

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.


No, NIS 2012 gets the same tamper entries. Tested on several systems.

SendOfJive
Posts: 10,782
Kudos: 4,838
Solutions: 779
Registered: ‎02-07-2009

Re: Countless "Unauthorized Access Blocked" alerts in history when running Process Explore


Bombastus wrote:

SendOfJive wrote:

The items monitored by Tamper Protection do vary from one version to another, so I am wondering if this might be specific to NAV 2013.


No, NIS 2012 gets the same tamper entries. Tested on several systems.


What I meant was that some patches will introduce new monitoring rules for Norton Product Tamper Protection, so not all versions will necessarily log the same events.   Good to know though, that NIS 2012 and NIS 2013 are on the same page.