Extensive Access Attempts Being Blocked

Archive
1

Windows Pro 10, Norton 360

 

1. Yesterday (12/27/2022) Norton warned "Smart Firewall Off".   I clicked "Fix Now". There was no response or messages. How do I check the firewall?

2. Due to item 1., I checked Norton Recent History.  There are the following access attempts listed very frequently:

Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction,Terminal Session
12/28/2022 10:55:01 AM,Info,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,12/28/2022 10:55:01 AM,C:\WINDOWS\SYSTEM32\EOAEXPERIENCES.EXE,10896,C:\Program Files\Norton Security\Engine\22.22.11.12\NortonSecurity.exe,14572,Access Process Data,Unauthorized access blocked,3

The history lists them over the past week.

I hibernate or shut down/restart my system at least once a day.

Is there anything I can do to stop these access attempts and similar things? 

3. The history also refers repeatedly to not being able to find my IP address. Should I be concerned about this?


 

2

Thanks for the post back.

SA

3

Thanks. I'm OK for now.

4

@Gar Cooper Can we assist further? Just following up with the thread.

SA

5

All: EOAEXPERIENCES.EXE has the following information from Microsoft.  

EoA Experiences is short for "Ease of Access". If this process is active, it probably means you have an accessibility tool running in the background.
Go to Windows Settings > Ease of Access and disable what's enabled in Display, Mouse pointer, Text cursor...
Reboot, and see if you problem has disappeared.

https://answers.microsoft.com/en-us/windows/forum/all/cpu-use-high/7d43efca-0537-4d2e-a207-6907d77115fe

Please note that this file CAN become infected as can many other legitimate Windows files. Running a full system scan is the next course of action to be on the safe side of things. May we ask. What is your OS and its version? Wondering whether you are running a version of Windows that is no longer supported by its OEM or an insider build.

SA

6

Gar Cooper:
How do I check the firewall? 

Please check Norton tray icon -> do you see Enable or Disable Smart Firewall? 
To check:  run Firewall Reset -> confirm Automatic Program Control is On -> call browser -> check Firewall Program Control ... for example:
png_16251.png

Gar Cooper:
Category: Norton Product Tamper Protection [...]

FWIW ~ What is EoaExperiences.exe ?
https://processchecker.com/file/EoaExperiences.exe.html

7

The Unauthorized Access Blocked messages in your security history are logged by Norton Product Tamper Protection when an executable file attempts to read/write/edit/delete a Norton file.  Common Windows processes like svchost.exe, taskmgr.exe, dfrgntfs.exe, etc. as well as executable from third-party software will cause an Unauthorized Access Blocked message to be logged if they touch a file from your Norton installation. Please see post <here> in the Product Suggestions board regarding logging of these blocks. (credit Imacri)

Norton Product Tamper Protection events are not reports of malware.  Unauthorized Access Blocked (Access Process Data) messages in your security history are not reports of malware.  The most common Norton Product Tamper Protection log entries are legitimate Windows processes that Norton is preventing from accessing Norton files or processes.  

Norton Product Tamper Protection events are normal, as legitimate programs and Windows processes frequently try to access Norton files or processes.  Norton blocks attempts by outside agents - even legitimate Windows processes.  There is no need to do anything.  No need to scan with a third-party anti-malware program, no need to change services settings.  These events are not attacks.  They can be ignored.  Unless the actor in the logs is an actual malicious process that does not belong on your PC, these events are totally harmless and routine. (credit SendOfJive)