topic Re: ccsvchst Silent Mode & Smart Definitions? in Norton Internet Security / Norton AntiVirus

ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Sat, 17 Sep 2011 11:56:18 GMT

Because ccsvhst.exe can sometimes cause so much memory usage when it is running (80% to 100% cpu) I find that turning on Silent Mode can provide positive help while browsing the internet and using internal programs. I do not use my computer for gaming purposes or in full screen mode rarely at all and I understand that this was the main reason for introducing it.

I have de-activated Pulse Updates & Automatic LiveUpdate as I now prefer to control when these updates are downloaded so as not to incur further load on my resources from LiveUpdate or ccsvchst.exe and this seems to work better than when I had it all Automatic.

I did come across the following articles which do help to some extent but they do not give me a complete understanding of how to use Silent Mode when I already have LiveUpdate turned off. Basically I just want to prevent ccsvchst.exe kicking in at unspecified intervals and stop it hogging resources when I am in the middle of something. At the moment turning on Silent Mode has become somewhat of a lets guess how long I want it on for rather than something more scientific. I usually end up turning it off for between 4 hours and day. From my point of view it would be better that updates, scans ccsvhst.exe and all other background processes run when I am away from the computer so that I can just get on with what I need to do when I return.

Finally, if I have elected to manually download LiveUpdate at times when my computer is not in use would I then be better to turn off Smart Definitions?

According to Symantec ‘Norton Internet Security provides the Smart Definitions option to choose between the Core Set virus definitions and Complete Set virus definitions for LiveUpdate sessions...... Turning on the Smart Definitions option minimizes download time, installation time, and system start time. Therefore, the Core Set results in faster performance of your computer. When the Smart Definitions option is turned off, Norton Internet Security activates the Complete Set virus definitions which contain all the virus definitions for each threat that is known to Symantec’

Silent Mode – Say goodbye to interruptive alerts while playing games

‘Only the activities that require constant on-demand protection from viruses and other threats keep on running, resulting in minimal impact to the system’

The Norton Pulse Updates Feature

‘Both Pulse Updates and full Automatic LiveUpdate respect the new Silent Mode option and turn off completely when Silent Mode is turned on. If the system goes into “automatic” Silent Mode because a full screen application is running, Pulse Updates will not run and the full Automatic LiveUpdate will wait a full six hours before running’

Silent Mode

Norton Internet Security provides many solutions and features to handle viruses and other security threats. Norton Internet Security also informs you, through alerts and notifications, how viruses and other security threats are detected and resolved. When you perform important tasks on your computer, you likely would prefer not to receive any alert messages. Silent Mode suppresses alerts and notifications and temporarily suspends most of the background activities. If Norton Internet Security detects a security threat when Silent Mode is enabled, it does not display the alert but takes appropriate action to protect your computer. You can either turn on the silent mode manually or otherwise enable the full screen detection which will enable the silnt mode whenever any application opens in the fullscreen mode. You can view the summary of the Silent Mode sessions under the Full History category in the Security History window. This summary includes the type of Silent Mode, the time when Silent Mode is turned on and turned off, and the security activities that occurred during Silent Mode. I think, Pulse updates, Automatic LiveUpdate, System Activity Monitoring by SONAR and Norton Insight/Community watch will be suspended for time being and will resume once you exit from Full screen mode or disable the Silent Mode accordingly.

Re: ccsvchst Silent Mode & Smart Definitions?

Bombastus — Sat, 17 Sep 2011 11:58:49 GMT

If your Norton processes are using 100% CPU, something is seriously wrong and you'd be better off trying to identify and rectify the cause instead of hiding the symptoms.

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Sat, 17 Sep 2011 12:03:27 GMT

Norton is not using 100% CPU all the time only sometimes and that can be when I want maximum resources to be available.

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Sun, 18 Sep 2011 23:54:02 GMT

Bombastus wrote:
If your Norton processes are using 100% CPU, something is seriously wrong and you'd be better off trying to identify and rectify the cause instead of hiding the symptoms.

I have done what I can to try an identify the problem, but switching on Silent Mode is not hiding the symptoms it is merely giving me respite to carry on and use my computer until this situation can be resolved.

I do not have the technical knowledge or the amount of time that is required to research this complex problem without the necessary input from Norton but meantime I have run Procmon and identified that ccSvcHst.exe is duplicating the reading of various files much as was found by martin4584 when reporting Dreaded high CPU usage here

I was quite astounded by the results produced by Procmon and this was just a sample taken over a period of just an hour or so ........

ncwmrc.db

Reading the same path 449 times in just 8 minutes between 11:29pm & 11:37pm 18-Sep-11

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwmrc.db

ncwperfmon.db

Reading the same path 22,434 times in just 20 minutes between 10:21pm & 10:41pm 18-Sep-11

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwperfmon.db

If Norton Staff could help me understand what exactly is supposed to run under ccSvcHst.exe when Silent Mode is activated then perhaps we might be able to identify why so much memory is being consumed and why there are over 1,250,000 events recorded in just 30 minutes.

I have also checked the Norton Full History and it doesn't have anything untoward to report.

For the moment I shall run Norton 2012 in Silent Mode while I am working at the computer and run LiveUpdateat at periods of inactivity throughout the day until this unsatisfactory situation can be resolved.

PS: Due to the size of the files you will understand that I am unable to copy any of the entries from Procmon.

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Mon, 19 Sep 2011 16:36:43 GMT

Norton Staff - Can you help me please.

I have added these to to be excluded from Scans , Auto Protect, Sonar & Download Intelligence Detection .......

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}

\NIS_19.1.0.28\NCW\ncwmrc.db

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwperfmon.db

Running Procmon again shows that ccSvcHst.exe is still reading ncwmrc.db & ncwperfmon.db 1000's of times in spite of these exclusions. In fact Microsoft has had to increase my Windows XP Pagefile size because it had run out of Virtual Memory due to the number of records being read.

If adding them to exclusions will not work how else can I stop Norton using up my computer resources with unnecessary duplicated file reads?

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Mon, 19 Sep 2011 19:55:48 GMT

Hi crisoco8722:

Regarding Norton background idle tasks, you might find Jerry20's thread Disabling All Idletime Activity here helpful. The information there refers to NIS 2011, not NIS 2012, but you may still find some useful information there.

As for Smart Definitions, check out Tywin7's thread Smart Definitions vs. Normal Definitions here. Enabling Smart Definitions is only useful if you have just installed NIS and have not run an initial LiveUpdate to bring your virus definitions up-to-date. When you install NIS, your first LiveUpdate will install the full set of virus definitions (approx. 64 MB ). If you enable Smart Definitions after that initial LiveUpdate, you will then download the core set of virus definitions (approx. 47 MB), saving you a grand total of about 17 MB of disk space. Regardless of whether you have the full or core set of virus definitions, you will receive the exact same set of virus definitions each each day via LiveUpdate.

Smart Definitions will only save you download time once, and once only, if you install NIS and immediately enable Smart Definitions before running your first LiveUpdate. That way, the initial LiveUpdate will download the 47 MB core definitions instead of the 64 MB full definitions. I have a slow dial-up connection and went back to using the full set of definitions once I figured all this out since I have lots of free space on my 250 GB hard drive and saving 17 MB of drive space was insignificant.

This is a complete guess on my part, but the "ncw" in ncwperfmon.db and ncwmrc.db probably refer to Norton Community Watch (NCW). If you disable NCW in your settings (in NIS 2011, it's Settings | Miscellaneous Settings | Norton Community Watch | OFF) this may stop all this excessive actvity on your computer. NCW is just a reporting feature included in NIS for the benefit of Symantec (more info is available if you search for "Norton Community Watch" in your NIS Help files) and disabling it will have no effect on the security of your PC.

Turning on SIlent Mode will temporarily disable the automated Norton Tasks that run when your computer is plugged in and in idle mode. To see a list of these tasks, open the Norton Tasks window (in NIS 2011, it's Performance | Norton Tasks). If Silent Mode is off (which it is by default) and you start working on your computer and take your system out of idle, any background idle task that is partially complete will be suspended until the next time your system goes into idle mode again.

----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Mon, 19 Sep 2011 21:16:02 GMT

crisoco8722:

I should clarify one comment in my previous post about Automatic LiveUpdates and idle mode. If Silent Mode is off (the default) and you are working on your computer or browsing the Internet, pusle updates will still run (i.e., pulse updates will not wait for your system to go into idle mode) because they use very few system resources. As far as I know, the more resource-intensive full Automatic LiveUpdate (which behaves similarly to a manual LiveUpdate) will only run when your system is in idle mode when Silent Mode is off.

I hope someone will correct me if this is wrong.

And be sure to read michaell's response here in Jerry20's thread about the new Metered Bandwidth feature in NIS 2012. You may find this to be a useful feature for controlling how background tasks run in NIS 2012.

----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Tue, 20 Sep 2011 00:48:15 GMT

Thank you very much lmacri. I really do appreciate the time you have taken to answer my questions and in more detail than I would have expected. I have read all the links but have to admit at this stage that I have not had the time to fully get to grips with the new Metered Bandwidth feature in NIS 2012.

While you were preparing your dissertation I was in the process of throughly removing 2012 with the idea of going back to version 2011 but when I re-installed 2011 I could not get on with it having used 2012 plus problems with the toolbar in Firefox 6 so I am back with 2012 again.

I have had a quick look at turning off NCW but it seems to have had little or no effect because ccSvcHst.exe is still producing 100's of events for ncwmrc.db but I could not find the other one ncwperfmon.db which is my Performance Monitor. The overall total events with Procmon seem to be less as well. Problem is I cannot run Procmon too long as it uses up so much memory.

I think your are right that NCW is Norton Community Watch.

I completely understand your explanation of Smart Definitions. Tywin7's thread was also very helpful.

Your picture of the Norton Tasks helped me understand where to check the Task that have run / not run but I think it is strange that Norton doesn't actually show here what tasks have been switched off. The only tasks I have enabled are Quick Scan & Full Scan but the rest do not show as disabled in the status column.

As I have elected to download LiveUpdate (not Automatic) at times when my computer is inactive that doesn't seem to interfere with having Silent Mode switched on. Thank you for pointing out the thread relating to 2012 Metered Bandwidth. I will look into changing some of my options when I fully understant what it is all about.

Thanks again for all your help with this.

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Tue, 20 Sep 2011 01:55:54 GMT

Hi crisoco8722:

Glad to help. I have a 56 Kbps dial-up modem so the whole issue of Norton background tasks and what tasks run or don't run during Silent Mode and system idles is of special interest to me, and frankly a bit confusing - I'm not sure I completely understand it myself.

I wouldn't worry too much about the actual counts of ncwmrc.db events. The important issue is how often the Symantec Service Framework (ccSvcHst.exe) is hitting close to 100% of your CPU and available RAM, especially if it happens for a sustained period of time. If you look in the top graph of the Norton Tasks window (Performance | Norton Tasks), you can zoom anywhere from 10 min to 1 month in the past and see just how often ccSvcHst.exe (the yellow peaks on the graph) has been hitting close to 100% of your total CPU or memory.

I use a small program called Process Explorer v. 15.04 from Microsoft SysInternals instead of the Windows Performance Monitor that you may want to try. It's similar to the Performance Monitor and shows the realtime % of your CPU being used by each process that's loaded into memory, and it also shows detailed information about CPU usage, hard drive read/writes, etc. when you double-click on the graphs at the top of the main window. If you want to try it just download the ProcessExplorer.zip file from here and unzip it anywhere on your hard drive - there's no installation process and double-clicking on the unzipped procexp.exe file launches the program.

----------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Tue, 20 Sep 2011 12:58:00 GMT

Thanks lmacri for the further information.

Norton Tasks

The tasks section provides a very useful record of cpu peaks and is one that I will keep my eye on in future.

Silent Mode

I propose to use this every day now and set it to 1 day. Then just run LiveUpdate Manually which will run without disturbing the setting. I will also run the scans manually as and when. I am not sure if Quick Scan will still run automatically in the background with Silent Mode on though.

I see that there is a facility to add programs to a list that will automatically turn on Silent Mode when the program/s are run. When I can decide what programs to add to the list I will change to that approach.

Changes to Default Settings

Insight OFF

Sonar OFF

Identity Safe OFF

Safe Surfing OFF

Automatic LiveUpdate / Pulse Updates OFF

Download New Version OFF

Boot Time Protection (normal) ON

Cloud Based Help Files 2012

I really hate this change as every individual help file has to be loaded up in the browser and lacks the speed that 2011 had when all help files were locally installed.

Procmon

I will not run this very useful program again unless I see any serious continuous peaks in CPU. Your pointers were very helpful.

Process Explorer

Thank you for the detail about Process Explorer. I already have this useful tool but have to admit that I have not used it much. When something unusual is happening on my computer I want an immediate visual of what is going on.

However, your explanation of Norton Tasks I found to be very useful and will help me look at it more constructively the next time I open it to look at past events. SysInternals turn out some great little tools.

My CPU Memory Visuals

TinyResMeter I find absolutely invaluable as it is always there in the top bar of every program running on the computer. It will continually change to show the top cpu or whatever setting you want. It is brilliant.

System Monitor is a little known experimental Firefox Add-on and sits in the bottom add-on bar, shown here purple & black. It is a real time monitor and the purple bar constanly changes as system memory demands increase or decrease. Furthermore the hover tooltip quickly provides even further information. See the second screen shot.

In the Windows Notication Area I always have Performance Monitor showing (below the McAfee shield).

This is a miniature graph showing cpu usage.

Upgrading Norton 2011 to 2012

I had an unfortunate experience when completely uninstalling Norton 2012 with the Norton Removal Tool to re-install Norton 2011. All seemed to have gone well until I upgraded to 2012 again. The problem only came to light when I clicked my special shortcut that opens LiveUpdate. Windows could't find the file and neither could I when I investigated the Norton Internet Security file in Windows Explorer. One folder set listed it and the other didn't.

To cut a long story short it seems that in the downgrade / upgrade Norton had installed a duplicate set of Norton Internet Security files .....

I had to run the Norton Removal Tool yet again and even then I was still left with one set of files. Only running the tool a second time did I finally get rid of all traces of the second Norton Internet Security folder so that I could then re-install NIS 2012.

This is something to note for any other user wanting to try out NIS 2012 and then downgrade and later upgrade. It may also have been a contributory factor towards the extra memory that was being used running the program.

Kind regards.

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Tue, 20 Sep 2011 14:02:46 GMT

Hi crisoco8722:

First, a further comment about ncwperfmon.db and ncwmrc.db, since what you're observing on your PC is starting to make sense.

If you open the Norton Tasks window (Performance | Norton Tasks) as shown in message # 9, zoom out to one month and click anywhere inside the graph with your mouse, you see a pop-up window listing each .exe executable program that was running on your PC at the time and what % of your CPU and memory each program used. According to the NIS 2011 Help files (search for "about CPU graph and memory graph"), NIS takes a snapshot of your CPU and memory usage every 15 seconds and stores it on your local hard drive for one month. Since the .db file extension is reserved for database files, I'm guessing this performance data is being saved in the ncwperfmon.db and/or ncwmrc.db database(s).

When you disable Norton Community Watch (Settings | Miscellaneous Settings | Norton Community Watch) this data continues to be collected and written to your hard drive every 15 seconds (or how else would NIS display that fancy-schmantzy graph? :smileytongue: ). However, disabling NCW should stop the submission of NCW performance reports to the Symantec servers via your Internet connection, which is the CPU-intensive portion of the task, and you should stop seeing new items appearing in the NCW history (in the NIS 2011 main window, you click History and then select Norton Community Watch from the Show dropdown list).

And I agree with your comment in a previous post. It would be nice if the status of a Norton background task changed to Disabled in the Norton Tasks window once it was disabled in the configuration settings. My NCW status is "Not Enrolled", but that's only because I disabled this task immediately after installing NIS 2011 and it never had a chance to run in the first place.
----------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Tue, 20 Sep 2011 15:02:36 GMT

Hi crisoco8722:

Now to your comments in message # 10.

The tasks you enable/disable in the configuration settings depends mainly on the speed of your Internet connection and your personal preferences (e.g., whether you want Idenity Safe to manage logins and personal data on the web) . The only changes I would suggest would be:

Sonar ON

Safe Surfing ON

Insight Protection ON

Idle Time Optimizer OFF

Norton Community Watch OFF

Special Offer Notification OFF

Disabling Sonar Protection, Safe Surfing and Insight Protection will compromise the security of your PC, so I would try browsing the Internet with these features both enabled and disabled and see if it really makes a difference to the performance of your PC. Idle Time Optimizer is the built-in disk defragmenter in NIS that is scheduled to run during idle mode every time you install software. If you have Windows Disk Defrgmenter (or some other defragging software) scheduled to run a monthly defrag, the Idle Time Optimizer is a waste of time and may do more harm than good. And as I mentioned before, the NCW task is of no benefit to you - the performance reports uploaded to the Symantec servers only benefit Symantec.

If you have Automatic Live Updates, Idle Time Optimizer and NCW disabled in your settings, the only tasks that Silent mode will temporarily suspend will be the weekly Idle Full System Scan (which can be disabled or re-configured in Settings | Computer Settings | Computer Scans | Idle Time Scans) and the Norton Insight and Idle Quick scans (which can't be disabled). As far as I know, all these tasks only run when your system is idle, so turning on Silent Mode while you're working on your computer or browsing the Internet isn't going to improve your system performance. Please note that if you ever decide to disable your Idle Full System Scans, you should schedule or manually run a Full System Scan every week or so to make sure that you don't severely compromise your PC's security.

Thanks for the info about TinyResMeter and the System Monitor Firefox add-on. I hadn't heard of either program and they both sound like excellent troubleshooting tools.

And I agree with your comment about online Help in NIS 2012. Anything feature that's moved off my local hard drive and into the cloud will continue to be a problem for me until I get a high speed Intenet connection.

-----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

bjm_ — Tue, 20 Sep 2011 15:34:30 GMT

Please permit non techie question ...

The McAfee Shield is on the same machine as Norton ?

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Tue, 20 Sep 2011 16:09:39 GMT

bjm_ wrote:
Please permit non techie question ...
The McAfee Shield is on the same machine as Norton ?

Hi bjm,

Thanks for your input.

McAfee in this case is the Site Advisor add-on for Firefox which is similar to Norton Safe Web Icons against the Google search results. I personally prefer Site Advisor but it is all down to personal choice.

No, it is not another Anti Virus program but thank you for being observant.

Regards.

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Tue, 20 Sep 2011 16:47:55 GMT

bjm_:

Nice catch. I didn't even clue in that crisoco8722's screenshot showed a McAfee product.

crisoco8722:

I guess that explains why you disabled Safe Surfing, Insight, Identity Safe and Sonar in NIS. I looked at the McAfee SiteAdvisor page here, and noticed that the free (limited) version of SiteAdvisor performs quite a few tasks usually performed by NIS. I'll leave it to you to figure out if you have any duplication in protection, or even worse, any gaps in protection like the real-time heuristic detection of new viruses and malware that Sonar Protection provides.

------------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Tue, 20 Sep 2011 20:13:08 GMT

lmacri wrote:
I guess that explains why you disabled Safe Surfing, Insight, Identity Safe and Sonar in NIS .........

Yes, this was part of the reason but I have had too many false positives with Insight / Sonar so I prefer not to have these switched on any longer. I know that the combination of heuristic analysis and Insight can reduce the incidence of false positives but I have found that it still does not work well in practice. Yes, I may well be missing out on some of the protection that Sonar provides but for me the constant quarantining of genuine files and programs negates these advantages.

I would like to set an exact time for a Full Scan but NIS 2012 does not seem to allow for an exact time setting although the help files say you can. I will have to decide how to deal with this.

For me the combination of Norton AntiVirus / Firewall, McAfee Site Advisor, Firefox 6, Tracking Disabler, GooglePrivacy, Request Policy, AdBlockPlus, Element Hider Helper and PDF-XChange Viewer all allow me to surf safely without interuption and BT Yahoo! Mail Address Guard allows me to receive emails without any spam.

Thank you ever so much for your detailed contribution. It has been really helpful.

Kind regards.

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Wed, 21 Sep 2011 14:17:56 GMT

Hi crisoco8722:

Several NIS 2012 users have reported problems with false positives for legitimate software so it's possible that Symantec tweaked the heuristic algorithm to behave more agressively. Symantec is asking people to report their false positives here and they're delivering daily corrections to the exclusion white lists via LiveUpdate as they process each report. You can add exclusions manually to your settings (Settings | Computer Settings | AntiVirus and Sonar Exclusions), but if you think that your heuristic scanning is the cause of the problem you can temporaily disble this feature (Settings | Computer Settings | Computer Scans | Heuristic Detection | OFF) until Symantec gets this straightened out.

You're correct about Norton removing the ability to schedule a full scan for a specific day of the week/time of day in NIS 2012. Symantec employee michaell has posted a less-than-ideal workaround here in the thread NIS 2012 Scheduling is Horrible that may be helpful.

Regarding your comment in message # 10 about problems rolling back from NIS 2012 to NIS 2011, any time someone rolls back their NIS version or would like to to perform a re-install of their current installation I always advise using the Norton Removal Tool (NRT) to wipe the old installation. PapauZ has posted step-by-step instructions here on how to use the NRT. The NRT will wipe all Norton software from your system, so please keep this in mind if you have Norton Utilities, Norton Ghost or other Norton products on your PC.

RichD noted here that the Norton Removal Tool should remove all Norton executable files, like .exe, .dll, .sys files, etc. but will not remove all inert files like log files, history files, .dat files, etc. This normally isn't a concern, but if you would like to roll back to NIS 2011 I would recommend going the extra step and manually deleting the C:\Program Files\Norton Internet Security\ folder after running the NRT to ensure the best possible re-install of NIS 2011. If you have problems with your Norton Toolbar extension in Firefox again, a simple tweak to your FF profile can often solve the problem (see the section titled Corrupt Extensions Files in the Mozilla support article here for one example).

Edit:

I just noticed that Symantec just released a minor product update for NIS 2012 to v. 19.1.1.3 yesterday via LiveUpdate (see revisions here). Maybe that will fix a few problems.

----------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Wed, 21 Sep 2011 16:03:24 GMT

lmacri wrote:

Several NIS 2012 users have reported problems with false positives for legitimate software .........

Thank you for your report about Sonar. I appreciate what you say and I have already been through the process of removing from quarantine, reporting, adding to exclusions etc. and quite frankly I cannot put up with it. That is why I prefer to have the whole thing turned off. At some time in the future I may reconsider switching it back on when Symantec has had time to find a better solution.

lmacri wrote:

You're correct about Norton removing the ability to schedule a full scan for a specific day of the week/time of day in NIS 2012. Symantec employee michaell has posted a less-than-ideal workaround here in the thread NIS 2012 Scheduling is Horrible that may be helpful.

Thanks for the workaround but that was not what I was referring to. That was for a specific day. My requirement is to schedule the scan for a specific time of day and then perhaps the actual day may not be quite so important.

lmacri wrote:

Regarding your comment in message # 10 about problems rolling back from NIS 2012 to NIS 2011, any time someone rolls back their NIS version or would like to to perform a re-install of their current installation I always advise using the Norton Removal Tool (NRT) to wipe the old installation .........

Yes, I know and that was done. I even did a scan of the registry entries with RegSeeker and removed any dregs left behind from the removal tool. As I said, the removal tool is not intelligent enough to remove a copy of NIS in the same folder and requires the tool to be run a second time to completely remove everything.

lmacri wrote:

......... I would recommend going the extra step and manually deleting the C:\Program Files\Norton Internet Security\ folder after running the NRT to ensure the best possible re-install of NIS 2011.

This was not necessary after running the Removal Tool a second time, but I always check this anyway to make sure nothing is left behind.

lmacri wrote:

If you have problems with your Norton Toolbar extension in Firefox again, a simple tweak to your FF profile can often solve the problem (see the section titled Corrupt Extensions Files in the Mozilla support article here for one example).

Thanks, that is worth noting but the problem only seems to have been with Norton 2011. Re-installing 2012 installed the correct toolbar without any problem.

lmacri wrote:

I just noticed that Symantec just released a minor product update for NIS 2012 to v. 19.1.1.3 yesterday via LiveUpdate (see revisions here). Maybe that will fix a few problems.

Hasn't made any difference.

Re: ccsvchst Silent Mode & Smart Definitions?

crisoco8722 — Wed, 21 Sep 2011 22:47:36 GMT

How to schedule an am or pm timed scan in NIS 2012

Can Windows XP Task Scheduler be used to schedule an am or pm timed scan to run in Norton Internet Security 2012?

Would this method work?

This method was taken from PapauZ in relation to Norton 360 Schedule a custom scan

Obviously Norton 360 would have to be changed for Norton Internet Security with the appropriate engine.

I am assuming that the file navw32.exe will still apply.

I did not understand the meaning of the code /a on the final link though and whether a full scan would actually run.

It is pity that NIS 2012 does not have this facility.

Here it is ........

04-04-2009 12:46 PM

You can't set scheduled scans in the Norton 360 UI... :(

But you can do it with the Windows' Task Scheduler:

1. Open Control Panel -> Task Scheduling, and add a new task

2. In the open file dialog go to C:\Program Files\Norton 360\Engine\3.0.0.134\ and double click on Navw32.exe

3. Set the time range you want to run it

4. Set the User to __YOURMACHINESNAME__/Administrator, and write your administrator password in the password boxes (You need!!! a password for it, I couldn't set it with a user profile having no password...)

5. If it's done, right click on the icon in the Scheduled Tasks, and click on Properties for set one last thing

6. Change the location from "C:\Program Files\Norton 360\Engine\3.0.0.134\Navw32.exe" to "C:\Program Files\Norton 360\Engine\3.0.0.134\Navw32.exe" /a

This way to set a scheduled scan works only to the next engine update. If a new engine (minor patch, ie 3.1) will come, you have to change the start location to "C:\Program Files\Norton 360\Engine\3.x.x.xxx\Navw32.exe" /a

Re: ccsvchst Silent Mode & Smart Definitions?

lmacri — Thu, 22 Sep 2011 04:46:45 GMT

Hi crisoco8722:

I believe the "/a" is the switch for "scan all drives" for the Symantec Shared Component Scanner Module (navw32.exe). See here for more information.

Could you please telll me if the solution posted by BruceComputer here in the thread Schedule Scans in NIS 2012 actually works? It looks like a very simple solution but this sounds identical to the way that custom scans are created in NIS 2011 (see NIS 2011 screen shot below), so I have no idea if it still works in NIS 2012.

------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS