I had a support session with One Click, and I happened to see a list of active TCP connections (using the Sysinternals viewer) and I saw that wininit.exe was connected to 204.232.134.16 which is the same IP address that hsplayer.exe was connecting to. I don’t know why wininit.exe needs to connect to Symantec. If anyone could shed some light on this I would appreciate it.