Endpoint Protection

 View Only

SYMANTEC TAMPER PROTECTION ALERT

  • 1.  SYMANTEC TAMPER PROTECTION ALERT

    Posted Jan 16, 2008 04:16 PM
    We use Virtual PC quite heavily in our environment.  Whenever a virtual PC is started it is generating a number of tamper protection alerts on the physical machine.  I've pasted a sample of my tamper protection log below.  Any ideas on how to get round this short of turning off the tamper protection feature? I saw in another forum they added C:\Program Files\Microsoft Virtual PC\Virtual PC.exe as a tamper protection exception, but it didn't work.  Any ideas?
     
    SYMANTEC TAMPER PROTECTION ALERT

    Target:  C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
    Event Info:  Set Information Process
    Action Taken:  Blocked
    Actor Process:  D:\Program Files\Microsoft Virtual Server\vmh.exe (PID 3020)
    Time:  Wednesday, January 16, 2008  3:48:06 PM
    ______________________________________________________________
    SYMANTEC TAMPER PROTECTION ALERT

    Target:  C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    Event Info:  Set Information Process
    Action Taken:  Blocked
    Actor Process:  D:\Program Files\Microsoft Virtual Server\vmh.exe (PID 3020)
    Time:  Wednesday, January 16, 2008  3:48:06 PM
    ______________________________________________________________________
    SYMANTEC TAMPER PROTECTION ALERT

    Target:  D:\Program Files\sav\VPTray.exe
    Event Info:  Set Information Process
    Action Taken:  Blocked
    Actor Process:  D:\Program Files\Microsoft Virtual Server\vmh.exe (PID 3020)
    Time:  Wednesday, January 16, 2008  3:48:06 PM
    ____________________________________________________________________
    SYMANTEC TAMPER PROTECTION ALERT

    Target:  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    Event Info:  Set Information Process
    Action Taken:  Blocked
    Actor Process:  D:\Program Files\Microsoft Virtual Server\vmh.exe (PID 3020)
    Time:  Wednesday, January 16, 2008  3:48:06 PM
    ___________________________________________________________________