Hello all!
Here's my environment:
Win7 64 bit, running as Std user with NIS2011 installed (18.6.0.29).
I did a clean install on my laptop yesterday, and I'm finding a number of "Unauthorized Access Blocked" messages all relating to C:\WINDOWS\SYSTEM32\SEARCHPROTOCOLHOST.EXE. What's really odd is the error detail is different for each: One is relating to an attempt to access the Syserr.exe process, one is for navw32.exe, and two others are for attempts to delete registry values. Yet another was trying to create a key.txt under the C:\ProgramData\Norton folder. Here is an example error:
7/11/2011 8:06 AM,Medium,Unauthorized access blocked (Access Process Data),Blocked,No Action Required,"Monday, July 11, 2011 8:06 AM",C:\WINDOWS\SYSTEM32\SEARCHPROTOCOLHOST.EXE,2968,C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\SymErr.exe,9732,Access Process Data,Unauthorized access blocked,2
Any ideas on why this could be happening? The searchprotocolhost.exe app appears to be legit.