Hi David, Eddy
Thanks for the suggestion and clarifications. Try as I might, I cannot find any configuration UI for the Protected Storage service on my WindowsXp machine. I did find this description of the Protected Storage Service here:
https://msdn.microsoft.com/en-us/library/aa939852(v=winembedded.5).aspx which says that "There are no configurable settings for this component". So I'm at a loss on this angle.
However I found some other interesting info: today the "Protected Item" error dialog popped up at 11:29:02 am EST. I was looking through the Avast debug logs searching for any entries timestamped 11:29:02 or 16:29:02 GMT and found 4 files. I included excerpts from 2 of the files below (if you want to see more of a particular file, let me know):
Hns.log: 2015.12.01 16:29:02 | SystemScore IQueryRecentWinSATAssessment creating failed: 0x80040154
2015.12.01 16:29:02 | Start Scan: mode=record, type=2, depth=2, 0x00000230
2015.12.01 16:29:02 | LoadEngine: using engine build
2015.12.01 16:29:02 | LoadEngine: module=C:\Program Files\AVAST Software\Avast\defs\15113000\aswHds.dll version=10.0.0.42
2015.12.01 16:29:02 | LoadEngine: successfully loaded engine of version 15113000
2015.12.01 16:29:02 | RealConnectivityScanner: local connect
2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to '
http://www.msftncsi.com/ncsi.txt' status:200 result:2
2015.12.01 16:29:02 | Start scanRouter()
2015.12.01 16:29:02 | RealConnectivityScanner: local connect
2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to '
http://www.msftncsi.com/ncsi.txt' status:200 result:2
2015.12.01 16:29:02 | Network adapter: 'Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport', 1, 00247e6dc431
HnsFromUi_asw.hns.devices_1448996304.json: "device_status" : "vuln_scan_completed",
"time" : "01/12/2015 11:29:02"
"gateway_base_url" : "
http://192.168.1.1:8080/",
"ADAPTER_NAME" : "Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport",
"HTML_LOGIN_FORM_ACTION_0" : "
http://192.168.1.1/cache/697866478/index.cgi",
"HTML_LOGIN_FORM_INPUT_PASSWORD_NAME_0" : "passwd1",
"HTML_LOGIN_FORM_INPUT_TEXT_NAME_0" : "user_name",
http://192.168.1.1 is my router's URL address. At the exact time the dialog popped up, these entries get logged. Do you guys think this is anything?
ps, there was nothing logged in the /report/FileSystemShield.txt log.
Thanks again for the help.