Hellow, I am running NORTON 18.5.0.125 on WinXP SP3, all my full system scans come out clean but I have noticed the following since Monday January 10th, I get the following error pretty much once a week on Monday night at roughly the same time: Unauthorized access blocked (Create File)
And the logs, below, show that its the cmd.exe trying to write to this directory:
C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds38C9.tmp
Its always the exact same directory but a different temp file, and I don't see anything in that directory. I have a feeling that it is norton itself trying to do something but blocking itself.
This has now occurred on the following dates:
Monday, January 31, 2011 7:27 PM
Monday, January 24, 2011 7:25 PM
Monday, January 17, 2011 7:22 PM
Monday, January 10, 2011 6:50 PM
Monday, January 10, 2011 6:46 PM
Logs below. Is anyone else seeing this? All my full system scans come out completely clean and I have not isntalled any new software recently other than windows updates or Norton Updates.
Thanks,
Rich
Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
1/31/2011 7:27 PM,Medium,Unauthorized access blocked (Create File),Blocked,No Action Required,"Monday, January 31, 2011 7:27 PM",C:\WINDOWS\SYSTEM32\CMD.EXE,4888,"C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds20C3.tmp",0,Create File,Unauthorized access blocked
Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
1/24/2011 7:25 PM,Medium,Unauthorized access blocked (Create File),Blocked,No Action Required,"Monday, January 24, 2011 7:25 PM",C:\WINDOWS\SYSTEM32\CMD.EXE,3580,"C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds2E5.tmp",0,Create File,Unauthorized access blocked
Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
1/17/2011 7:22 PM,Medium,Unauthorized access blocked (Create File),Blocked,No Action Required,"Monday, January 17, 2011 7:22 PM",C:\WINDOWS\SYSTEM32\CMD.EXE,5768,"C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds1E7C.tmp",0,Create File,Unauthorized access blocked
Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
1/10/2011 6:50 PM,Medium,Unauthorized access blocked (Create File),Blocked,No Action Required,"Monday, January 10, 2011 6:50 PM",C:\WINDOWS\SYSTEM32\CMD.EXE,4520,"C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds38C9.tmp",0,Create File,Unauthorized access blocked
Category: Norton Product Tamper Protection
Date & Time,Risk,Activity,Status,Recommended Action,Date,Actor,Actor PID,Target,Target PID,Action,Reaction
1/10/2011 6:46 PM,Medium,Unauthorized access blocked (Create File),Blocked,No Action Required,"Monday, January 10, 2011 6:46 PM",C:\WINDOWS\SYSTEM32\CMD.EXE,3972,"C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\NCW\temp\ds38C7.tmp",0,Create File,Unauthorized access blocked