Yes Win7, nowhere in my logs are there anything reported about "dfrgntfs.exe." Also its not only svchost.exe but iexplore.exe so this could hardly have anything to do with defragmentation.
The unauthorized blocked svchost warnings I have had before.
But it’s these DFRGNTFS .EXE ones that are now concerning me
Are these files being misused to do harm?
And thus norton is blocking them ?
I scan this DFRGNTFS .EXE and its safe plus it’s in the right folder system32.
So two main questions first one now being is there something malicious going on?
Or is norton just logging things different?
It is definitely not malicious.
My subscription was updated about a month ago. In the last year I also updated the version of NAV on the two Win 7 computers (something like 6 months ago) but have been lazy about not updating the version on the XP machine. So it seems to be version-independent. It could be that some LiveUpdate they put out in the last 2 days is doing this. I'm suspicious of the fact that it started happening to Calls withing a minute of a manual LiveUpdate run....
I've just run a full system scan on everything, and aside from a few tracking cookies, nothing was found. Still watching behavior to see if these warning messages continue.
Ok I accidentally clicked resolved because my stupid smart phone.
How do I remove the resolved status because this surely is not resolved
To clarify mine started about 7:30 am on 9/10/13.
I did not do a manual live update prior to this logging. I renewed my subscription to NUS the night before and I ran a Microsoft update. But not a nortonanual live update
No idea...I just tried, but can't see how to "unresolve" it.
The behavior still continues on the XP machine. Just had a large set of these medium severity issue blocked.
On one of the Win 7 machines (laptop) I haven't seen it since 6:54 am this morning (Eastern time). Since it seems to have come in waves around every 3 hours or so, this seems to be good news. The other Win 7 (desktop) has had one medium level issue in the last few hours, but not the massive groupings.
Well yesterday 9/10/13 it started around 7:40 or so. I had to reboot my pc for other reasons . When I came home from work it showed the same logging at like 9:30 am. But that might have been a continuation of the previous defrag since I interrupted it by rebooting the PC
lmacri wrote:
Further to my previous post, I've gone back through my Norton Product Tamper Protection history and have also seen a large upswing of these blocks for dfrgntfs.exe, starting on 09-Sep-2013 @ 7:41:44 PM and continuing through to the present, so it can't have anything to do with Patch Tuesday.
Sorry, I have to correct a comment I made in message # 16. The large jump in blocks for dfrgntfs.exe on my VIsta machine actually started on 10/09/2013 at 7:41:44 PM, which is actuaIly Tuesday 10-Sep-2013 (i.e., not Monday 09-Sep-2013), so I can't exclude a glitchy Windows Patch Tuesday update as the cause of the problem. I looked in my Windows Event Viewer and my system re-booted at at 6:45 PM after my Patch Tuesday updates were installed, which is about an hour before all the blocks started.
Good news. I still haven't seen any seen any of these dfrgntfs.exe blocks since I powered off and re-started my machine this morning.
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 23.0.1 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
Now when I renewed the NIS2012 subscriptions it was for 3 PCs one of which is my wife’s laptop
I looked at the history on the laptop and it does not show this logging
lmacri wrote
Good news. I still haven't seen any seen any of these dfrgntfs.exe blocks since I powered off and re-started my machine this morning.
------------
Unfortunately a full power-down of my XP and restart doesn't resolve it. I got a huge blast of them a few minutes ago on there.
Still quiet on the two Win 7 machines (as far as no major 20+ medium "unauthorized access" warnings) for the last 3.5 hours (desktop) and 6.5 hours (laptop). The laptop hasn't been rebooted since the 6:53 am set. I did reboot the desktop, but not a hard shut down like the XP.
Will breathe easier if I go a full 24 hours quiet on them though...
Just wish this wasn't happening on 9/11...that isn't helping my nerves at all.
Calls wrote:
Ok I accidentally clicked resolved because my stupid smart phone.
How do I remove the resolved status because this surely is not resolved
Hi Calls:
Log into the forum, navigate to message # 13 which is currently marked as the solution, click on the Option link in the top right corner and choose "Unmark as Accepted Solution".
Exactly how many warnings do you have? I counted 25 here.
I counted up about 45 of the DFRGNTFS
No I’m at work so I don’t know what my pic is doing
I have the same problem right now. Nine of the entries are saying "community feedback: pending" and there's two mentioning "Norton error reporting submission". I've already did a full system scan and found nothing. On top of that, when I ran disk defragmenter manually 20+ entries showed "Unauthorized access blocked (open file). This problem didn't start until yesterday evening for me.
Melen wrote:Exactly how many warnings do you have? I counted 25 here.
Hi Melen:
I counted 96 in total - 16 between 7:41:44 PM and 7:42:38 PM on 10/09/2013 (yesterday) and 80 between 12:08:22 AM and 12:11:23 AM on 11/09/2913 (today in the early morning).
In every case, the actor was C:\Windows\System32\dfrgntfs.exe (actor PID 2244). The Norton files reported as the target varied but almost every one was located in a subfolder of C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\.
I changed my power settings to keep my system in continuous idle mode for a few hours this afternoon and still haven't seen any more of these frequent blocks for dfrgntfs.exe, but dfrgntfs.exe didn't run during the extend idle so I can't confirm that a background idletime defrag will trigger these blocks.
EDIT:
I don't know if it's relevant, but I always have Norton Community Watch (NCW) disabled and there are no recent entries in my Norton Error Reporting (NER) history. That might be why I'm not seeing the same NCW and NER errors as others have reported in this thread, but these errors might simply be related to a temporary connection problem with the Symantec servers last night that prevented NCW from sending data back to the servers.
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 23.0.1 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
lmacri wrote:
The Norton files reported as the target varied but almost every one was located in a subfolder of C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\.
I googled {0C55C096-0F1D-4F28-AAA2-85EF591126E7} and in my case it looks like the Norton extensions for my Firefox browser (coFFPlgn.dll, IPSFFPl.dll) might have been the intended target of dfrgntfs.exe for many of these blocks.
------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 23.0.1 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS
I've checked my Norton history to find more of these entries regarding the "unauthorized access blocked" which DOES concern DFRGNTFS.EXE. I'm too lazy to count them all but I can clearly see theres over 60 of them in all. The first wave of these entries didn't start until Sept. 9, 2013 in the evening. That was monday. Windows Update didn't start its tuesday patches yet...Everytime I used disk defragmenter, this would start and it is trying to access Norton's files. I have my defragmenter setting off and only use it manually. Windows Update isn't set to automatic but I have it telling me when an update is available. I'm starting to think something's been recently changed.
Hi LMarie2013,
It's very strange, I have the same settings as you more or less, in my case WU is disabled & also the notifications and I have NIS optimizer set to off.
I've checked 5 mins ago in NIS History and I have NOT a single entry concerning DFRGNTFS.EXE.
Regards,