http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_stor...
and the .mdb export:
http://mysbfiles.stonybrook.edu/~amenon/base_shield_app_stor...
SecProxy.exe from BaseShield App Store.(C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe) performed operations on the following processes belonging to Symantec Endpoint Protection:
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
The operations it performed include "Memory Free", "Thread Resume", "Memory Write", "Memory Allocation".
I don't know why any app, let alone BaseShield would have to access and modify the memory of a program totally unrelated to it.
Date and Time,Computer,User,Action Taken,Object Type,Event,Actor,Target,Target Process 11/28/2008 9:27:14 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1984),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1),C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (PID 3536, terminal session 1) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700) 11/28/2008 9:27:13 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2272),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700),C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (PID 3700) 11/28/2008 9:27:12 PM,ARJUN-LAPTOP,Administrator,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528) 11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528) 11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528) 11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 596),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528),C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (PID 3528) 11/28/2008 9:27:11 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 2004),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1),C:\Program Files\Common Files\Symantec Shared\ccApp.exe (PID 1268, terminal session 1) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,Administrator,Logged,Memory,Free,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Thread,Resume,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Write,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116) 11/28/2008 9:27:10 PM,ARJUN-LAPTOP,SYSTEM,Logged,Memory,Allocation,C:\Windows\system32\BaseShield\BaseShield\SecProxy.exe (PID 1076),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116),C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (PID 2116)