I have been having this same issue with a notification at startup of "WS.Malware.1" being blocked but the only thing showing in my history is a duplicate process from my "services.exe" which I have varified on a few startups using the history information and my task manager.
The target is the Norton antivirus program and the action is from the services.exe, which is in windows/system32 and there is only one which appears valid.
I scanned the regisrty for the issue and turned up nothing.
Could this be a duplicate process that is being triggered from or by a recent update to the AV program that perhaps is initiating the duplicate process from a previous one not removed during the update?
I varified the PID to be services.exe on a number of startups.
[edit: Clarified subject.]