'Chrome.exe has changed since the last time you opened it'

[Migration User]

When I tried opening my chrome browser I got the message:  

'Chrome.exe has changed since the last time you opened it.  Are you sure you want to open it?' or 

some such.  

I clicked details and got this:

Version:  27.0.1453.94

File Path:  C:\Users\Miles\AppData\Local\Google\Chrome\Application\chrome.exe

 

Connection Origin:  local initiated

Protocol:  TCP

Local Address:  192.168.23.215

Local Port:  49185 

Remote Name:  translate.googleapis.com

Remote Address:  74.125.28.95

Remote Port:  443 (HTTPS - HTTP protocol over TLS/SSL)

 

Then a msg. popped up from my Symantec systray icon.  'Symantec has changed.  Process such and such...'

 

I ran hitman pro, malware, symantec.  Nothing.  System log shows one entry:  

 

6/5/2013 7:35:41 AM Executable file change denied Major Outgoing TCP 74.125.28.95 98-FC-11-77-8F-F3 192.168.23.215 88-9F-FA-36-11-30 C:\Users\Miles\AppData\Local\Google\Chrome\Application\chrome.exe Miles Miles-Laptop Default 1 6/5/2013 7:33:37 AM 6/5/2013 7:33:37 AM

 

msg:  Application has changed since the last time you opened it, process id: 5080

Filename: C:\Users\Miles\AppData\Local\Google\Chrome\Application\chrome.exe

The change was denied by user.

 

Has someone hacked or attacked my pc?  If I reinstall windows will that fix the issue?  What should I do?

 

 

[ℬrίαη]

You have network application monitoring enabled

Is this an unmanaged client?

To disable, open SEP

under Network Threat Protection click Options >> Change Settings

Under Traffic Settings, uncheck the box for "Enable network application monitoring"

Click OK

[Migration User]

p.s. this comes after I've been getting occasional port scan attack messages for the past week or two

[pete]

check this link

Symantec Endpoint Protection states that "an application has changed since the last time you used it."

http://www.symantec.com/business/support/index?page=content&id=TECH123331

[Rafeeq]

You would get this pop up if the executable has been upgraded recently. Check your eventviewer if you find any upgrade for chrome.

Symantec Endpoint Protection states that "an application has changed since the last time you used it."

 

http://www.symantec.com/business/support/index?page=content&id=TECH123331

[Migration User]

'Enable network application monitoring' is already unchecked.  Should I uncheck 'Enable port scan detection?'

FYI I have an acer aspire laptop 5253 

[ℬrίαη]

Could be the IPS then. Check the Security log to see what SID it's firing on.

I wouldn't uncheck this as it will decrease your security awareness.

Also, what's the exact version of SEP and what components do you have install? Is this an unmanaged version of SEP?

[Migration User]

The signature columns in my security log are blank.  Process id is 5080, does that help?  

Version:  12.1.2015.2015  

Components installed:  Virus & Spyware Protection, Proactive Threat Protection, and Network Threat Protection.

Not sure what you mean by unmanaged.  The laptop is on my husband's home wi-fi network.

[ℬrίαη]

Unmanaged meaning it is not managed by a SEPM and this is for home use only.

[Migration User]

When I look up the remote host 75.125.28.95 it gives the orgname of The Planet.com Internet Svcs. (Houston TX)

Under additional info. it shows Softlayer which is a computer security type company in Dallas, TX.

Could this mean someone that works there has hacked my laptop?

[Migration User]

When I look up the remote host 75.125.28.95 it gives the orgname of The Planet.com Internet Svcs. (Houston TX)

Under additional info. it shows Softlayer which is a computer security type company in Dallas, TX.

Could this mean someone that works there has hacked my laptop?

[ℬrίαη]

ThePlanet is a service provider, same with softlayer, they provide hosting services, etc.

if you open a CMD window and do an ipconfig /all what does it show for your DNS servers?

[Rafeeq]

You could safely igonre it . When an executable changes it will pop up such messages. Check if you have upgraded your Chrome or added any add ins..etc.

[Migration User]

DNS Servers:

192.168.22.1

184.16.33.54

192.168.23.1

[Migration User]

Did you also see my note below about the port scan attack messages I've been getting occasionally over the past couple weeks?  Could that be related to this?

[ℬrίαη]

It could be but port scans happen continuously on the unfiltered Internet.

For the message about chrome changing, it was likely due to Chrome updating itself. This is a symptom of network application monitoring which detects changes in executables. Can you confirm Chrome was updated? I know you said network application monitoring isn't enabled but this has been the only time I've seen this message. If Chrome was updated than it is a normal message from SEP.

For the port scan attempts, SEP is detecting these so you can create a firewall rule to block this IP if you wish. A port scan is not inherently malicious, it is just the first step in an attack, which is recon. Your PC is being scanned to see what ports are open.

[Migration User]

In Event Viewer (local), Windows logs, Application, it shows two gupdates (google updater) at an hour and 50 minutes before I logged off last night.  That could indicate chrome was updated, am I right?  Or should I be looking elsewhere in Event Viewer?  The Event ID for those is 0, does that mean no update was actually ran or does the 0 represent something else?

This is down below in Event Viewer (under General tab):

The description for Event ID 0 from source gupdate cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

 

If the event originated on another computer, the display information had to be saved with the event.

 

The following information was included with the event: 

 

Service stopped

 

Thank you so much for your excellent assistance!

 

[ℬrίαη]

It does indeed look like Chrome was updated.

Event ID 0 for gupdate is Windows related so it should be considered safe.

[Migration User]

Thank you for all of your great help!

[ℬrίαη]

No problem, glad to help. Don't forget to mark the post that best helped as "Solved" so it can benefit others who may have a similar problem with this.

If you still need assistance, let us know!