Unauthorized access blocked / open process token/ IP address has disappeared from adapter

Hi,

 

I have a Windows XP system, and my Norton security history has been showing a lot of odd msgs lately.

 

Firstly, it shows "Unauthorized access blocked (open process token) " with medium severity occuring every couple of minutes for the last 2 days. Even though it says I do not have to take any action, it seems rather frequent for these msgs. The actor is explorer.exe and the target is mcui32.exe.

 

Also, it shows me updates like "IP address disappeared from adapter... and is no longer being protected".., and then soon after that, "Protecting your connection to a newly detected network on adapter...." . Is this any cause for concern? Or is this happening just because I disconnect and reconnect to the internet at those times??

 

Further, just last night, NIS detected and quarantined k0maw.exe (Infostealer.gampass) (identified as high risk), and it SAYS it has been removed. Needless to say, I did panic when I saw that, and I just want to make sure that these other messages i've been getting have no relation to this k0maw.exe?

Can someone please help? I'm really not a techie person, and I'm sorry if I'm sounding like a total ignoramus :)

 

Thanks!

 

The unauthorized access block is just Norton logging that another application accessed Norton files.  That access is blocked due to Norton's tamper protection.

 

The firewall entries are just normal entries logging connections made and in the case of IPV6, not made as it is not in use.  Again perfectly normal.

 

With the quarantined item, you can look in History>quarantine, and highlight the entry.  You will be able to click on more details to find out where it was found.  Often it is old emails.  Let us know what you find.

Its actualy quite normal for it to do that, norton has put tamper protection on all its files, so when you see these msgs just ignore them.