I'm getting a bunch that look like this:
SYMANTEC TAMPER PROTECTION ALERT
Target: LiveUpdateShutdownEvent
Event Info: Open Internal Event
Action Taken: Blocked
Actor Process: C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (PID 5244)
Time: Tuesday, July 21, 2009 12:52:27 AM