4 ms·
Here is Symantec Endpoint Protection's log of the tampering done by BaseShield App Store. Date and Time,Computer,User,Action Taken,Object Type,Event,Actor,Targ
by arjungmenon 18y ago
Here is Symantec Endpoint Protection's log of the tampering done by BaseShield App Store.
Date and Time,Computer,User,Action Taken,Object Type,Event,Actor,Target,Target Process
11/28/2008 9:27:14 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700)
11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700)
11/28/2008 9:27:12 PM,ARJUN-LAPTOP,Administrator,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528)
11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528)
11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528)
11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528)
11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,Administrator,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116)
11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116)
- MrRage 18y agoThis is a really hard to decipher blob of text. Care to point out some examples of offending entries and interpret what they mean?
- Shamiq 18y agoLooks like a .csv copied over. Mind linking to a copy of the original .csv file?
- arjungmenon 18y agoHere the .csv export of the Symantec's Tamper Protection Log: http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_store_tamper_log.csv http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_stor... and the .mdb export: http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_store_tamper_log.mdb http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_stor...
- arjungmenon 18y agoYup. Here's the essence of the log file: SecProxy.exe from BaseShield App Store.(C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe) performed operations on the following processes belonging to Symantec Endpoint Protection: C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe The operations it performed include "Memory Free", "Thread Resume", "Memory Write", "Memory Allocation". I don't know why any app, let alone BaseShield would have to access and modify the memory of a program totally unrelated to it.