Unauthorized Access Blocked (Access Process Data)

Norton Security | Norton Internet Security
1

I just bought a Sony Vaio which came with Windows 7 OS today, and I noticed in my Norton Internet Security History page, I have a notices that says:

 

Unathorized access blocked (Access Process Data), Severity - Medium

 

Actor: C:\PROGRAM FILES\SONY\VAIO CARE\COLLSVC.EXE

Target \Device\HarddiskVolume3\Program Files (x86)\Norton Internet Security\Engine\ccSvcHst.exe


It keeps doing this practically every 1-2 minutes!!

 

Is this an attempted attack attack or anything else to worry about, or is it just normal? I've scanned use Adaware and Malwarebytes and found nothing.....

2

Since its a legit program from Sony just add it to the exclusions. Then you wont see the alert anymore. If you just bought the pc then how could it be infected.

3

Hi BezzaB,

 

This is normal and is not an attack.  The log entries you cite belong to Norton Product Tamper Protection, which safeguards the integrity of your Norton product by blocking or limiting the access that outside agents have to Norton files and processes.  In almost all cases you will find that these entries involve legitimate programs that run on your computer, including WIndows processes, some of which will show up repeatedly in these logs.  These programs are not a threat to your computer and are only being prohibited from interfering with Norton's operations.  They are not prevented from running or carrying out their own tasks.  As long as the actor shown in these notices is a process that belongs on your computer you do not need to be concerned about these logs.  Outside processes frequently interact with Norton and these logs simply record each event.  Since this is not a threat alert you do not need to exclude this file from scans, and doing so would not stop the NPTP logging, anyway.

4

There is information available for drmserver.exe at Bleeping Computer.  It is a valid program added by Sony/ XCP DRM security.It is in the nature of a legitimate rootkit, if there is such a thing.  The unauthorized access blocked, just means that Norton won't let it change any of its files.  Most programs and services have to access Norton for one reason or another, and Norton logs it as blocked.

 

http://www.bleepingcomputer.com/forums/topic34904.html

 

http://en.wikipedia.org/wiki/Extended_Copy_Protection

5

Hello kosterude

 

There is a new Adobe Reader update that just came out on Tues. for security reasons. If you haven't updated that program yet, I suggest that you do update it.  It fixed like 30 some odd security risks in the program. While you are at the Adobe site, you may as well make sure you have the latest Adobe flash player and shockwave player also.

6

Hi ontariopc,

 

What you describe are Norton Product Tamper Protection events, which are normal and harmless.  Legitimate programs often attempt to access Norton files and processes.  All such efforts are blocked in order to prevent Norton's operations from being disrupted or compromised by any outside agent, legitimate or malicious.  These are not attacks, and Norton is simply logging the events.  The outside programs are only prevented from interfering with Norton, and are otherwise allowed to run normally.  Threats to your computer that require your attention will be announced through Norton alerts on your PC.  The Norton logs are simply a record of Norton's activities.

7

Thank you very much for your quick reply to my question. I have only noticed this recently in my security history and thought my computers were under attack. I am relieved that this is nothing to worry about.

8

Hi ontariopc,

 

You're welcome.  I think I have responded to more Tamper Protection concerns than any other issue.  If you are not familiar with it, the entries can seem worrisome - it comes up a lot around here.