Norton Internet Security / Norton AntiVirus

[CountryGuy]

I have two machines using NIS2010 at the moment, both running Windows 7.  I have a bunch of messages in my history for "Unauthorized Access Logged".  Here is the full message:

Severity:  Medium

Activity:  Unauthorized access logged (Access Process Data)

Recommended Action:  No Action Required

Under Advanced Details:

 Actor: C:\WINDOWS\SYSTEM32\CONHOST.EXE

Target:  \Device\Harddisk\ProgramFiles (x86)\Norton Online\AddOns\Norton Safety Minder\Engine\1.1.5.15\TampMon.exe

Conhost.exe is a new binary with Windows 7, so my hope / guess is its a false positive?  Anyone else experience this thus far?

EDIT:  I should note that NIS2010 is not throwing an alert for these, they are just in the History, and appear sporadically (1-2 times an hour though).

Message Edited by CountryGuy on 10-04-2009 01:45 AM

[mdturner]

---

CountryGuy wrote:

I have two machines using NIS2010 at the moment, both running Windows 7.  I have a bunch of messages in my history for "Unauthorized Access Logged".  Here is the full message:

Severity:  Medium

Activity:  Unauthorized access logged (Access Process Data)

Recommended Action:  No Action Required

Under Advanced Details:

 Actor: C:\WINDOWS\SYSTEM32\CONHOST.EXE

Target:  \Device\Harddisk\ProgramFiles (x86)\Norton Online\AddOns\Norton Safety Minder\Engine\1.1.5.15\TampMon.exe

Conhost.exe is a new binary with Windows 7, so my hope / guess is its a false positive?  Anyone else experience this thus far?

EDIT:  I should note that NIS2010 is not throwing an alert for these, they are just in the History, and appear sporadically (1-2 times an hour though).

Message Edited by CountryGuy on 10-04-2009 01:45 AM

---

I think your assessment is correct and this is not an issue to worry about - looks like a false positive.

[dbrisendine Norton Fighter]

This is not a false positive but a logged information record that something tried to access part of NIS's processes.  This did happen and NIS blocked the access to keep it's processes secure.  The log record is just so you will know what happened (in the background, without your intervention) should there ever be a concern.

[rbridgeman]

When accessing myyearbook.com, browsing my and other profiles for a bit, my network access always cuts out and I can't see passed the scope of my computer (router and modem aren't seen).  A soft reboot fixes this problem.  This has just been happening with Windows 7.  It didn't happen with Vista when I had it.  As a result, the same message appears as above (Unauthorized Access Logged (Access Process Data)) after the soft reboot in the Norton Tamper Protection.  I have all the same software as I had with Vista.  I use my laptop with Vista to access myyearbook.com since it works fine.

[neigh-ho-ma]

i get this in my history (Unauthorized Access Logged (Access Process Data)) after i run a malwarebytes quick scan.