+1
Under review

Unathorized access blocked (Open Process Token)

Greg Czaja 6 years ago updated 6 years ago 3
Hi,

I am getting thousands of these entries in Norton 360 logs for SystemExplorerService.EXE, one every second, with N360 "tamper protection" ON.

I know the activity is supposed to be harmless but I can't see other events without sifting through lots of noisy messages. Turning the N360 tamper protection OFF does not seem like a safe thing to do.
I would imagine the SES code would be able to detect the failure executing the "Open Process Token" function and refrain from accessing the N390 process repeatedly. Seems easy but probably it is not :) Or is it?

Greg
I agree with this suggestion wholeheartedly, and would love to see a fix for this, unless it's something that can only be done on Norton-Symantec's end of development.

I turned off Norton's tamper protection AGES ago, simply due to this conflict between SE and Norton 360, but I really would love to be able to use the "tamper protection" feature. So, if you can do anything to fix this, Miroslav, that would be very much appreciated!

Thanks!
Under review
I have installed Norton 360 trial.... tamper protection is ON...but no warning message displayed.... any idea?
Interesting...

I went back and checked the N360 history log. There is no mention of "Unauthorized access blocked " for SystemExplorerService anymore.
The only explanation I came up with would be that N360 actually changed how they handle the "tamper protection" in respect to services requesting the read access to process data. I do not see anything confirming this theory on Symantec's forums but there has been a lot of posts complaining about false "tamper" hits with different products so maybe Norton "fixed" it?

I will monitor the N360 logs and let you know.
Thanks for checking,
Greg