• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Unauthorised access blocked.?

Hi been getting this sort of thing in the history list of unauthorised access blocked.? I’ve got pictures uploaded if this helps with more info. Is anyone getting this to.?

Replies

Kudos2 Stats

Re: Unauthorised access blocked.?

The Unauthorized Access Blocked messages in your security history are logged by Norton Product Tamper Protection every time an executable file attempts to read/write/edit/delete a Norton file.  Common Windows processes like svchost.exe, taskmgr.exe, dfrgntfs.exe, etc. as well as any executable from third-party software like CCleaner and Malwarebytes Anti-Malware will cause one of these Unauthorized Access Blocked messages to be logged if they touch a file from your Norton installation. Please see post <here> in the Product Suggestions board regarding logging of these blocks. (credit Imacri)


Norton Product Tamper Protection prevents outside programs from making changes to the Norton product.  Norton Product Tamper Protection protects your Norton product from an attack or modification by any virus or other unknown threat. Norton Product Tamper Protection view in the Security History window displays details about unauthorized attempts to modify Norton processes.  Unauthorized access blocked (Access Process Data).  NPTP events are not reports of malware.


The most common NPTP log entries are legitimate Windows processes that Norton is preventing from accessing Norton files or processes.  Norton is simply maintaining a secure isolation from other processes running on your system.  (credit Community)

Kudos0

Re: Unauthorised access blocked.?

Hello Jakelong91, welcome to the forums. My suggestion is download, install and run Malwarebytes due to the attempt to reset registry keys within Windows. Although Norton states no further action is required it is in your best interest to be on the safe side. Here is the link for Malwarebytes which it totally free and is 100% compatible with Norton products:

https://www.malwarebytes.com/

Secondarily if you are comfortable with changing system settings in the services area, open the "run" command. Type in services.msc and a new window will appear. Scroll down the list to the service named Remote Registry. Double click it and a dialog box will open. In the area of that box where "service status" is if it is running select STOP. Next in the area where "STARTUP TYPE" is select from the list disabled. Perform these same instructions with the services "Remote Desktop Configuration AND Remote Desktop Services". Reboot for the changes to take affect. Please let us know if you need guidance.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Home / Professional x 64 version 1903 / build 18362.239 / N360 Deluxe 22.17.3.50 / Norton Core v.282 on Android 2.00
Kudos0

Re: Unauthorised access blocked.?

Okay thanks for the welcome soulAsylum. I did the following options you gave in services  and disabled theose bits and rebooted. Will this solve the problem in history of unauthorised access blocked.? Is it done by remote maybe.?

Kudos1 Stats

Re: Unauthorised access blocked.?

Jake as bjm posted Norton is notifying you of the intrusion attempt so you would continue to see these notices if in fact they continue from other sources. The settings modifications I suggested are avenues set by default when you install windows and can be disabled to close off those services as they are not required for Windows to correctly function. Hope that helps.

Cheers

"From DOS to Windows10 what a journey it has been" / MS Certified Professional / Windows 10 Home / Professional x 64 version 1903 / build 18362.239 / N360 Deluxe 22.17.3.50 / Norton Core v.282 on Android 2.00
Kudos0

Re: Unauthorised access blocked.?

Hi bjm_, This is a newly reinstalled windows 7 on my Hp pavilion that I just did cause it failed to start last time. Haven’t hardly been using the internet on it just YouTube. So is this hole thing is due to the norton tamper program of norton protecting itself from any changes.? Would there be anything in a way to see what’s causing it.? Norton found no viruses so far in full system scan. It also doing this on my other 2 laptops witch is a dell Inspiron 1750 on windows 7 and other one is windows 10 Hp envy.

Kudos0

Re: Unauthorised access blocked.?

Hi bjm_ the pictures just came available from moderator. With the more info of what’s its doing as this is a newly reinstalled system of windows 7 on my Hp pavilion. Witch is doing the same thing on my others.

Kudos0

Re: Unauthorised access blocked.?

...disable unnecessary startups

...set to Manual (Disable) unnecessary services [http://www.blackviper.com/category/guides/]

...ignore Unauthorized access blocked events

...FWIW ~ YMMV

Kudos3 Stats

Re: Unauthorised access blocked.?

Norton Product Tamper Protection events are normal, as legitimate programs and Windows processes frequently try to access Norton files or processes.  Norton blocks all attempts by all outside agents - even legitimate ones like the Windows processes shown in the screenshots.  There is no need to do anything.  No need to scan with a third-party anti-malware program, no need to change services settings.  These events are not attacks.  They can be ignored.  Unless the actor in the logs is an actual malicious process that does not belong on your PC, these events are totally harmless and routine.  And in 8 years on the forums, I have not seen even one report of a Tamper Protection event that was malicious.

Accepted Solution
Kudos1 Stats

Re: Unauthorised access blocked.?

Jakelong91:

...So is this hole thing is due to the norton tamper program of norton protecting itself from any changes.? Would there be anything in a way to see what’s causing it.?

Hi Jakelong91:

Go to Security | History | Show and choose Norton Product Tamper Protection from the dropdown list and you'll see a long list of these Unauthorized Access Blocked messages.  If you double-click any logged item the details will show you the Actor (the file that triggered the "block") and the Target (the Norton file that it attempted to read/write/edit/delete).

I can generate one of these "blocks" any time I want by launching Microsoft Sysinternal's Process Explorer utility as shown below.  Process Explorer is similar to the Windows Task Manager and is completely harmless - Norton Product Tamper Protection simply logs one of these "blocks" every time a Norton file (in the example below, nsbu.exe) is touched by a non-Norton executable like procexp.exe.   As bjm_ and SendOfJive already mentioned, these "blocks" do not mean that your system is under attack and they can be safely ignored.

The majority of the Unauthorized Access Blocked messages logged on my machine are for my Windows Service Host process svchost.exe and other "legitimate" Windows system files, and svchost.exe is the same Actor shown in two of the images in your original post.  Your third image shows a "block" for conhost.exe, which is the Console Window Host process. Windows starts a new instance of conhost.exe when you open a console like a Command Prompt (cmd.exe), for example, to help manage interface elements like scroll bars, etc.
---------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.5.0 * NS Premium v22.11.2.7 * MB Premium v3.3.1
 

Kudos0

Re: Unauthorised access blocked.?

Hi lmacri so there’s nothing to worry about this access thing being blocked all the time. So it can be safely ignored or won’t do any damage to my system files.? Ok just seems strange though don’t remember seeing these messages before on the older versions of norton. Even with the norton tamper product settings like bjm_ and SendOfJive said. And remote thing of the services like SoulAsylum said Ok thanks for the info and help of the blocking thing guys. As long as it not too sensitive of messing up my system. Then I’ll ignore this problem.

Kudos0

Re: Unauthorised access blocked.?

These Tamper Protection entries have been commonplace for a very long time.....Do not worry about them.

https://community.norton.com/en/forums/unauthorized-access-logged-2

This thread is closed from further comment. Please visit the forum to start a new thread.