• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos2 Stats

Unauthorized access blocked (Set Regietry Security Key).

I found this in my recent history. The word "regietry" is not a typo on my part, this is actually what it says in the log.

Actor: windows\system32\svchost.exe

Actor PID: 708

target: hkey_local_machine\system\currentcontrolset\enum\root\legacy_bhdrvx64\0000\control\

target PID: 0

Action: Set regietry security key.

Reaction: Unauthorized access blocked.

Current OS is Windows 7 SP1 along with NIS 2011.

Any insight regarding this event will be gladly appreciated.

Replies

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I found this in my recent history. The word "regietry" is not a typo on my part, this is actually what it says in the log.

Actor: windows\system32\svchost.exe

Actor PID: 708

target: hkey_local_machine\system\currentcontrolset\enum\root\legacy_bhdrvx64\0000\control\

target PID: 0

Action: Set regietry security key.

Reaction: Unauthorized access blocked.

Current OS is Windows 7 SP1 along with NIS 2011.

Any insight regarding this event will be gladly appreciated.

Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

It is a Windows process that is accessing too deeply into Nortons system.  All it means is that the access was blocked.  It does not mean that anything was prevented from working or doing its job.  It is part of the protection in place to prevent malware from disabling Norton.  Not to worry.

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I understand. But why would it need to access something that deep in the registry?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Bump?
Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

I've also noticed these things in my history log recently. I'm not 100% sure but I think they started after the most recent upgrade. Also, as the original poster pointed out...

The word 'registry' is spelled incorrectly in the history log. If nothing else, I would think Symantec might want to correct that typo.

--Ron

What am I thinking about right now?
Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

I agree with RonH.  There have been several reports of this Tamper Protection entry since the latest update began to be released.  It is not unusual for these sorts of entries to suddenly appear after a change to the program.  Sometimes the new notifications are intentional, and sometimes they are not, but either way they are harmless and do not affect the safety or performance of your system.  There was a similar situation recently with "Set file attributes" entries in the Tamper Protection logs.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I, and maybe the OP as well, was hoping for a definitive answer from a Norton employee. If the security suite is responsible for triggering the "harmless" event as part of a comprehensive process, I can relax. But if it's another program I've knowingly and willingly installed that is causing this, then it is of grave importance I get to the bottom of this. Please let me rule in or out the security suite's role.
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Since the original posting, I have received two more of these entries. I only seem to be getting these at around the same time each morning, so I think it might be a part of some scheduled task.

Was there some big update that was recently applied that I don't know about?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

bump?
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I just received this same log in my history for the FIRST TIME. 1 hour after my NIS 2011 updated to 18.6.0.29

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I have a similar log entry that happened today

Tuesday May 10th 7am central US time.

HOWEVER, I use NIS 2010 and my version is the same 17.8.0.5

so I have not gotten any version update.

My entry shows as follows:

Severity: Medium 

Activity: Unauthorized Access Blocked (Set Regietry Security Key

Status: Blocked 

Recommended Action:   No action Required

Advanced Details

Actor: C:\Windows\system32\svchost.exe

Target:  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\

LEGACY_EECTRL\0000\Control

Action: Set Regietry Security Key

Reaction: Unauthorized action blocked

I guess what makes me very concerned is this whole Legacy EECTRL thing.

so is this a Norton function or is it an infection???

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Looking through the tamper protection log I see that the same thing happened on Monday May 9th at 7:59pm US Central Time and again just a few moments ago ( Tuesday May 10th 8: 11 am US Central time)

and again I have no new version update

also my entry is the same as the OP except this part

LEGACY_EECTRL\0000\      wheras others have letters and numbers

The Actor PID seems to be connected to DCOM Service Process Launcher

This is concerning me that there is some type of infection.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Update:

This has now happened for the 3rd time in the last 2 hours.

I also googled LEGACY_EECTRL and some info points to a Norton VQR item

Can someone from Norton please address this so we know if this is normal or if it is a sign of infection?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

From all appearances Windows is attempting to set a security registry key on various Norton files.  In both cases, yours and the OP's, the drivers are legacy drivers.  Norton doesn't even allow Windows to monkey with it, so it is blocked.

EECTRL is the eraser control driver.  The OP's is the BASH driver.  The situation is no different than what was previously explained by SendOfJive.

The notification system is not necessarily an exact copy of the problem entry.  This is not the first Symantec spelling error, nor will it be the last, I'm sure.

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).


SendOfJive wrote:

I agree with RonH.  There have been several reports of this Tamper Protection entry since the latest update began to be released.  It is not unusual for these sorts of entries to suddenly appear after a change to the program.  Sometimes the new notifications are intentional, and sometimes they are not, but either way they are harmless and do not affect the safety or performance of your system.  There was a similar situation recently with "Set file attributes" entries in the Tamper Protection logs.


Here is why I am concerned. In my case when I check the Actor Process ID it is associated with an instance of svchost.exe.

When I go to task manager and right click on that particular svchost.exe and right click "Go to services" it takes me to

DcomLaunch ( Decom Server Process Launcher)

others who are experiencing this, when you check the PID of the actor, what servicedoes the svchost.exe run?

No I don't know much about computers, but I have to ask why would that particular svchost.exe be needing to access Norton files?

Does this sound like the svchost.exe has been/is being used to attemp to attack my system?

And why does it seem to happen several times a day only starting 2 days ago?

I appreciate any further clarification. From the other posts on here, it seems that several folks are getting the same thing.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

DCOM service process launcher.  Scroll down to Vista, and read all of the things on your computer that it is required to do.

http://www.blackviper.com/wiki/DCOM_Server_Process_Launcher

Notethe default path:

C:\Windows\system32\svchost.exe -k DcomLaunch

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).


Calls wrote:
Does this sound like the svchost.exe has been/is being used to attemp to attack my system?

These are all legitimate services and processes that are essential parts of Windows, and therefore are very likely to try to access running Norton processes from time to time.  If you find something in the Norton Security History logs that Auto-Protect and various system scans have not already alerted you to, then it is NOT malicious.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

First thanks all for your responses.

MODS- Should I post my questions as a seperate post?

 Back in early May 2011, I had two intrusion attempts: Malicioys Website and a Blackhole Toolkit

But both of these were bloacked by Norton

I'm understaning that there are various functions that might try to access the Norton  pices.

No shock to anyone, I still have some confusion

1. LEGACY_EECTRL / Legacy Drivers are  part of the Norton function in the registry, right?

2. Why would any windows process/service need to attempt to change the registry key of a Norton function?

3. Any sense as to why this just started 2 days ago and why only some people have noticed this? (My product version hasn't changed)

(Del and SoJ- do you see this happening in your machines too?)

4. So this activity by svchost.exe and the assocoated service Dcom Service Proces launcher Does NOT appear to be any malicious manipulation, where the service has been "taken over" by something malicious??

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

to the original poster of this thread and the others who have noticed this, are you still seeing these entries occuring? I have since May 9, 2011. Seems 2-3 entries daily.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Has nobody else been getting these entries anymore?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Mine started in the morning of May 03, 2011 with actor pid 932 target pid 0. Next four days had two entries each with actor pid 864 target pid 0. Sunday, May 08. 2011 had one entry of actor pid 864 target pid 0 because pc was shut down for several hours. Monday resumed with one entry with actor pid 920 target pid 0. Tuesday had two entries. Today started with one with actor pid 920 target pid 0. My entries share the same legacy BASH driver as new_ton, the OP, posted. I was one of the vanguard who received the new engine over a week ago.
Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

Plse look in your Windows Updates if you installed some around that date. There were a few extra system updtaes around end of April.

Maybe MS changed some modules, which caused this.

W10 1809 and 1903 / W10 Insider / IE11 and FF 67, TB 60.7, NS 22.17, (Android 7 with NMS)
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I had non-security updates from Microsoft on April 27 (automatic updates disabled!). Firefox 4.0.1 was installed the next day. On the following day, April 29th, I uninstalled several programs I had tried out. May 2nd, Norton was updated (automatic updates disabled!) with the new engine 18.6.0.29. Then, no programs installed or removed until May 6th, a few Microsoft-related. Then on Tuesday, May 10th, yesterday, was the Microsoft monthly security updates. The changes to the actor pid may be Microsoft-related. But the entries began soon after Norton upgraded.
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I am still receiving the entry about 2 times per day sine my first log on 5/9/11. I don't know if it has to do with NIS 2011 but it started about 1 hour after my NIS 2011 updated   to 18.6.0.29. Nothing else , to my knowledge, has been installed on my computer since 5/1/11 So I figure it has something to do with NIS 2011 since it first started appearing after the update.

In all, I have 7 entries in my NIS 2011 history log since 5/9/11

Actor    C:\WINDOWS\SYSTEM32\SVCHOST.EXE

Actor PID   844,832,848,780,848,852,804 (different number each entry to equal 7 times)

Target   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDRVX86\0000\Control\

Target PID    0

Action   Set Regietry Security Key

Reaction   Unauthorized access blocked

I am running Windows Vista Home Premium Service Pack 2 with NIS 2011 18.6.0.29 and IE 8

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

to all those who are getting this entry-

when you check the actor pid  does it correspond to

Dcom Launch  and Plug and Play?

I'm surprised more folks dont notice this

It seems to transend NIS version ( I have 17.8.0.5) and OS ( I have Vista Home Premium 32 bit with Vista SP 2)

Am I the only one really concerned about this?

Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

Why don't you try the Microsoft forum and ask them why Windows is setting registry security keys?  It seems more appropriate than wondering why Norton is reporting it and blocking it.

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).


delphinium wrote:

Why don't you try the Microsoft forum and ask them why Windows is setting registry security keys?  It seems more appropriate than wondering why Norton is reporting it and blocking it.


Del- Thats a good point. Altough no other forum around is as helpful as the Norton forums

 

I will try to post  sometime soon in the microsoft answers forum. If anyone else posts there before me, let me know the thread. If it is indeed a microsoft issue, then I think we all need to post there so that they correct the issue.

 

Del- you had mentioned something about Legacy Drivers. Are they used by Norton products?

(I'm referring to the part of the registry key that reads LEGACY_EECTRL)

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Also- To Dell and Send of Jive(and other veteran volunteers)

Do you also see this issue on your machines?

Are Norton staff seeing this same situation on their test machines?

It would help a great deal to know if Norton has detected the same situation on their machines.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I'm not seeing it on my Win 7 machine, but it was a clean install of Win 7, rather than an upgrade from Vista.  There are two Vista boxes on this thread, and it may have something to do with the limited user accounts.  A security key is connected to user access.  Norton is just not allowing Windows to put a security key on two of its drivers.

Generally, legacy drivers have been left behind after an application was removed in case it was needed by the operating system later.  So I tend to think that since new applications better fit Windows increased security policies, Microsoft is trying to put a bandaid on older entries.  Norton is doing nothing more than reporting it and preventing it from ocurring.

The actual process and reasoning behind it, will have to come from Microsoft.

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

@delphinium, by your reckoning and the timing of the reports in my logs, the OS may have been setting the key for some time until the new Norton engine found it worth blocking and reporting the action. @Calls, the actor process ID, the numerals that are reported in the logs, changes with each reboot. Also, the task manager, by default, does not show the actor pid column. Now that I know where to look, the services involved are power, plugplay and dcomlaunch under the auspices of the svchost process.
Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

I think that is a good call neigh-ho-ma.  Sometimes actions and processes go on for years until something starts reporting them, and then it is just like new. 

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

I'm having the same warning in my history. Not sure when it started. I'm running 64 bit vista with norton internet security 2011.
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

To Send of Jive


SendOfJive wrote:

These are all legitimate services and processes that are essential parts of Windows, and therefore are very likely to try to access running Norton processes from time to time.  If you find something in the Norton Security History logs that Auto-Protect and various system scans have not already alerted you to, then it is NOT malicious.


not sure what you mean by:

If you find something in the Norton Security History logs that Auto-Protect and various system scans have not already alerted you to, then it is NOT malicious

did you mean if I don't find something?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

so I think its safe to say that this has something to do with Vista OS, at least part of the issue.

The svchost.exe that I show also is connected to Dcom Launcer and plug and play.

Now to the experts here (And I mean that with sincere respect and thanks)- My bigest concern about this is that something compromised svchost.exe and/or Dcom Launcher

Does that appear as a likely conclusion, that these are being used to attack our Norton Program?

Or does it NOT appear that anything is compromised and attempting to  attack our NIS program?

Much thanks to all

Kudos1 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).


Calls wrote:

not sure what you mean by:

If you find something in the Norton Security History logs that Auto-Protect and various system scans have not already alerted you to, then it is NOT malicious

did you mean if I don't find something?


Hi Calls,

If there is something malicious on your computer it will be detected by Auto-Protect or a system scan.  A Product Tamper Protection log entry showing Norton blocking a legitimate Windows process from accessing a legitimate Norton file is not an indication of malware - it is normal.  Yes, this particular entry is new, but there are several explanations for this that are far more likely than malware that does nothing except repeatedly try unsuccessfully to access an obscure Norton registry setting.  I mean, if it were something malicious, why would it go to the trouble to do that when Norton isn't detecting  it as malware anyway?  If malware were truly the cause of these events you would be posting about weird behaviors rather than log entries.  The odds of this being the work of malware are incredibly small.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Thanks SoJ

(Hope you don't mind me shortening your name to SoJ)

That makes sense. Pkus if it were malware, I most likely could not get my Norton updates or Microsoft updates. And I have successfully been able t do that

(BTW Thanks for being patient with me)

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Hi Calls,

Yeah, I think you are correct to be a little suspicious about an entry that has not been seen before.  In fact, that is the only reason to check logs regularly -  to spot things that are out of the ordinary.  So you were on the right track.  And there are still some legitimate unanswered questions about this event, for sure.  But there are just so many other reasons you could be seeing this, that malware wouldn't really concern me unless there were other disconcerting things going on as well.  If malware were trying to disable Norton, you can bet it would be doing a lot of other things too.  And as closely as you monitor your system, I'm sure you would recognize anything that was amiss instantly. 

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Does that appear as a likely conclusion, that these are being used to attack our Norton Program?

__________________________________________________________________________________

It's not attacking Norton.  That's where the confusion is.  Most things, including Windows processes have to ask Norton for access to it to some degree.  Norton protects all of its files, including the ones it isn't using. 

Under certain circumstances profanity provides relief denied even to prayer.Mark Twain
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

HF1

Welcome

You're using IE9 but it isn't in compatibility mode.

Please click on the torn page at the top of your screen to make the switch

Then we'll be able to read your message and try to help

Dick Win 10x64 current current NSBU
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Thanks I will try again

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).


hvgsel wrote:

Plse look in your Windows Updates if you installed some around that date. There were a few extra system updtaes around end of April.

Maybe MS changed some modules, which caused this.


hvgsel- I followed your suggestion.

May be part of the answer

Here is what I found:

On or about April 26, 2011  there were a few Vista updaes. One of them, KB2492386, seems to have to do with

Application Compatibility Update for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: April 2011

Further-

The kinds of issues that are resolved by application compatibility updates

When you try to install and run certain legacy games or applications, you may experience one or more of the following symptoms:

  • The game, the application, or the firmware is installed incorrectly.
  • The game, the application, or the firmware causes system instability.
  • The primary functions of the game, of the application, or of the firmware do not work correctly.

I would ask all those who have this issue to check and see if they have this Vista update, KB2492386, on or about April 26th, 2011

Now if I'm not mistaken, isn't some left over Norton drivers a LEGACY  item?

So this may account for the attempt by svchost.exe (probably the Dcom Lanucher) from attempting to access the Norton LEGACY Driver?

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Vista Home Premium SP2

NIS 18.6.0.29

Update KB2492386 applied

TargetUnauthorized access blocked (Set Regietry Security Key)HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDRVX86\0000\Control\30

I currently have 30 of these entries. Unless you see either of the following entries occurring at the same time as one of the entries above...:

Unauthorized access blocked (Delete File)

Unauthorized access blocked (Terminate Process)

...then stop worrying about these Tamper Protection log entries.

In my experience, Norton Product Tamper Protection history logging can best be described as a 'boy who cried wolf' feature. If you would like to discuss this further then please start a new thread.

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

While the most recent KB2492386 app compat update may be implicated, we get these type of updates regularly on a nearly monthly basis. Who will say the one in March or February is the culprit? Out of three programs on my pc--windows 7 programs and features, ccleaner and revouninstaller, the latter is the only one registering Norton's new engine NIS 18.6.0.29 installation. That occurred on May 2nd. The "Unauthorized access blocked (Set Regietry Security Key)" reports began appearing in my Norton log twice daily thereafter, unfortunately without any similiarity in the timing of the reports. But it does involve the dcomlaunch group of the svchost.
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

All I kow is I started getting this entry 1 hour after NIS 2011 updated to 18.6.0.29

Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).


elsewhere wrote:

Vista Home Premium SP2

NIS 18.6.0.29

Update KB2492386 applied

TargetUnauthorized access blocked (Set Regietry Security Key)HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHDRVX86\0000\Control\30

I currently have 30 of these entries. Unless you see either of the following entries occurring at the same time as one of the entries above...:

Unauthorized access blocked (Delete File)

Unauthorized access blocked (Terminate Process)

...then stop worrying about these Tamper Protection log entries.

In my experience, Norton Product Tamper Protection history logging can best be described as a 'boy who cried wolf' feature. If you would like to discuss this further then please start a new thread.


Elsewhere-

When I added my information to the OP thread, I asked the Mods to move me to my own thread if they felt that I should do so. They left my posts on herer so I think they see my posts as part of the OP issue.

Just trying to figure somethings out, thats all.

Kudos3 Stats

Re: Unauthorized access blocked (Set Regietry Security Key).

Further tamper protection was added either in or at the same time as the 18.6 release. These new log events are the result of that addition and, as with most other log events of this type, generally don't indicate a problem unto themselves.

Reese AnschultzSenior Software Quality Assurance Manager, Symantec Corporation
Kudos0

Re: Unauthorized access blocked (Set Regietry Security Key).

It took two weeks; but at least it came to pass.

This thread is closed from further comment. Please visit the forum to start a new thread.