• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

non-authorized access blocked

Hello,

I have checked the history of my Norton Security installation on a laptop and I can see severals entries classified as being medium where it says that non authorized access has been blocked (open the process token) or (access to thread data). The program triggering this situation is most of the time Explorer and the target is NS.exe. I have another occurrence where the trigger is Acer Care Center (accstd) with the same target (NS.exe).

I would like to know whether this is normal or not and what should I do about this situation?

Regards

Replies

Kudos0

Re: non-authorized access blocked

Hello bjm,

thanks for your quick reply. I have been through your suggested links and I came to the conclusion that my "warnings" are kind of "normal". I am not sure if my understanding is correct because I still find pretty strange that Explorer or even Acer Care Center is making attempts at accessing NS.

Can you please confirm that my understanding is correct?

Regards

Accepted Solution
Kudos1 Stats

Re: non-authorized access blocked

Can you please confirm that my understanding is correct?

Yes, your understanding is correct.

Re: Unauthorized Access Blocked (Access Process Data) Permalink

What you describe are Norton Product Tamper Protection events, which are normal and harmless.  Legitimate programs often attempt to access Norton files and processes.  All such efforts are blocked in order to prevent Norton's operations from being disrupted or compromised by any outside agent, legitimate or malicious.  These are not attacks, and Norton is simply logging the events.  The outside programs are only prevented from interfering with Norton, and are otherwise allowed to run normally.  Threats to your computer that require your attention will be announced through Norton alerts on your PC.  The Norton logs are simply a record of Norton's activities.

Kudos0

Re: non-authorized access blocked

I just ran into this same problem with malwarebytes, and I found out Windows defender is doing the same.  It had me very confused.  Since both of the programs are well known, is there any way, Norton, can note it in the history, exactly what is going on, as when I see it, it looks to me that Norton is stopping Malwarebytes from doing something.  An explanation of this kind of warning in Norton would be helpful I am sure for many, explaining that it is normal for Antivirus and Antimalware to trigger this and everything is ok, and any other programs, you should look at more closely to see what they are doing or something on that effect, just to help with confusion.  

Kudos0

Re: non-authorized access blocked

Posted: 22-Oct-2016 | 4:41PM • Edited: 22-Oct-2016 | 4:59PM • Permalink

The Unauthorized Access Blocked messages in your security history are logged by Norton Product Tamper Protection every time an executable file attempts to read/write/edit/delete a Norton file.  Common Windows processes like svchost.exe, taskmgr.exe, dfrgntfs.exe, etc. as well as any executable from third-party software like CCleaner and Malwarebytes Anti-Malware will cause one of these Unauthorized Access Blocked messages to be logged if they touch a file from your Norton installation. Please see my post <here> in the Product Suggestions board regarding logging of these blocks. (credit Imacri)


Norton Product Tamper Protection prevents outside programs from making changes to the Norton product.  Norton Product Tamper Protection protects your Norton product from an attack or modification by any virus or other unknown threat. Norton Product Tamper Protection view in the Security History window displays details about unauthorized attempts to modify Norton processes.  Unauthorized access blocked (Access Process Data).  NPTP events are not reports of malware.


The most common NPTP log entries are legitimate Windows processes that Norton is preventing from accessing Norton files or processes.  Norton is simply maintaining a secure isolation from other processes running on your system.  (credit Community)

https://community.norton.com/en/forums/wmiprvseexe 

This thread is closed from further comment. Please visit the forum to start a new thread.