Default Block SSDP... causing reboot?

Norton Security | Norton Internet Security
1

Hi,

 

I have a question/problem I need help with.  I got home after being gone all day and sat at my desk just in time to watch it reboot twice without me doing a thing.  Since this has been happening off and on for a few days (though not like it did just now) I opened Norton to scan and make sure I don't have a virus, after first running update to make sure I was up to date.

 

I checked the Security History to see if there might be something there and found this: 

 

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
2/15/2014 6:04:28 PM,Info,"Rule \"Default Block SSDP\" blocked (192.168.0.1, Port (2869) ). Inbound TCP connection. ",Detected,No Action Required,Firewall - Activities
Rule "Default Block SSDP" blocked (192.168.0.1, Port (2869) ).

Inbound TCP connection.

Local address, service is (BETH-7E26D6569E (192.168.0.6), Port (2869) ).

Remote address, service is (192.168.0.1, Port (1281) ).

Process name is "C:\WINDOWS\system32\svchost.exe".

  

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
2/15/2014 5:58:04 PM,Medium,Unauthorized access blocked (Send Terminate Message to Window),Blocked,No Action Required,2/15/2014 5:58:04 PM,C:\WINDOWS\EXPLORER.EXE,1880,C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe,2484,Send Terminate Message to Window,Unauthorized access blocked

 

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
2/15/2014 5:56:37 PM,Medium,Unauthorized access blocked (Duplicate Object),Blocked,No Action Required,2/15/2014 5:56:37 PM,C:\WINDOWS\SYSTEM32\SERVICES.EXE,816,C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe,2484,Duplicate Object,Unauthorized access blocked

  

 

The time corresponds with my reboot.  There's more if it's needed.  Not sure what is needed to figure this out.   I understand that Norton is working and protecting me... what I don't understand is why my pc reboots when this happens.  

Any help would be appreciated

 

Beth

 

2

... Maybe Windows updates installing?

3

Hi SendOfJive,

 

I checked the event viewer and all I see for today are information events.  Scrolled back a few days and had a couple of warnings but nothing that looks like it cause this.  I'll figure it out or someone will for me :)  just wanted to make sure Norton wouldn't be doing it as part of the blocking.  Thanks for the information!

Beth

4

Hi Krusty13,

 

I thought about that but when it did it twice in a row ...  didn't make sense that it'd be an update.  Also, my pc updated yesterday or the day before.  Thanks for the idea though... it's a good one :)  

Beth

 

5

Hi,

 

I have a question/problem I need help with.  I got home after being gone all day and sat at my desk just in time to watch it reboot twice without me doing a thing.  Since this has been happening off and on for a few days (though not like it did just now) I opened Norton to scan and make sure I don't have a virus, after first running update to make sure I was up to date.

 

I checked the Security History to see if there might be something there and found this: 

 

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
2/15/2014 6:04:28 PM,Info,"Rule \"Default Block SSDP\" blocked (192.168.0.1, Port (2869) ). Inbound TCP connection. ",Detected,No Action Required,Firewall - Activities
Rule "Default Block SSDP" blocked (192.168.0.1, Port (2869) ).

Inbound TCP connection.

Local address, service is (BETH-7E26D6569E (192.168.0.6), Port (2869) ).

Remote address, service is (192.168.0.1, Port (1281) ).

Process name is "C:\WINDOWS\system32\svchost.exe".

  

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
2/15/2014 5:58:04 PM,Medium,Unauthorized access blocked (Send Terminate Message to Window),Blocked,No Action Required,2/15/2014 5:58:04 PM,C:\WINDOWS\EXPLORER.EXE,1880,C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe,2484,Send Terminate Message to Window,Unauthorized access blocked

 

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
2/15/2014 5:56:37 PM,Medium,Unauthorized access blocked (Duplicate Object),Blocked,No Action Required,2/15/2014 5:56:37 PM,C:\WINDOWS\SYSTEM32\SERVICES.EXE,816,C:\Program Files\Norton 360\Engine\20.4.0.40\ccSvcHst.exe,2484,Duplicate Object,Unauthorized access blocked

  

 

The time corresponds with my reboot.  There's more if it's needed.  Not sure what is needed to figure this out.   I understand that Norton is working and protecting me... what I don't understand is why my pc reboots when this happens.  

Any help would be appreciated

 

Beth

 

6

 Hi, Beth.  As has been said, normal Norton notifications. Norton will routinely block any program trying to access its files.

7

Hi bmorton62,

 

I've just had one of my systems restart all on it's own too!

 

Very strange!  I have never had anything like that happen before and I'd sure like to know why.

 

Windows 7 x64 SP1

 

N360 v21.1.0.18

8

Hi, Krusty. I had a couple of freezes recently and an unexpexted shutdown, which I put down to hdd/graphics/ram/dust bunnies, you name it.

 

My desktop is in the shop atm, but I'm wondering if this is related.

 

Did your Event Viewer throw up anything unusual ?