Norton Internet Security / Norton AntiVirus

[Twoboxer]

. . . a problem and must close. The latest incident occurred today, but at least this time it seems I did NOT lose my "blocked list" nor my identity log-ins or cards.

I have 6 PCs using NIS 2009, and the four machines that experience "normal" use (ie, browsing, email, game play, and periods of "on" time with no one at the keyboard) have all experienced this issue. The other two have not yet experienced this specific error; they are mostly for dedicated game play and never use (any form of) Outlook.

Today's NIS crash occurred on a Dell XPS 710 under Win XP MCE SP3 with up-to-date software and idle scan OFF. The crash occurred while I was afk for a couple of hours, having left two IE7 browser windows open. While this machine uses Outlook 2003, it was not specifically executed at any time during this operating session. I responded to the NIS crash error message and sent the info to MS. I could not close the IE windows and used Task Manager to end the IE process before rebooting. The shut down screen then showed that some previously dl'd (presumably Windows) updates were ready for installation . . . I can't be sure when those updates were dl'd. All appeared normal after reboot.

Event Viewer said:   

Faulting application ccSvcHst.exe, version 108.1.0.24, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x00050bb4.

The other machines experiencing these failures include a Sony Vaio all-in-one and a small HP both under XP MCE SP3, and a self-built Intel quad-core machine under Vista Home Premium. In addition to these Framework errors, I've experienced lock-ups and the occasional unexplained loss of blocked lists and log-ins. I've cut down on the number of lockups by first turning Idle Scan off and then turning off a backup program (Memeo) that also "uses" idle time. However, I still get messages from NIS that something was accomplished during "idle time".

The point is, I'm tired of this stuff. I'm willing to do whatever I can to help resolve these problems. According to my NIS 2009 window, we have 268 days left.

What do you need from me?

Message Edited by Twoboxer on 03-12-2009 03:16 PM

Message Edited by Twoboxer on 03-12-2009 03:18 PM

[delphinium Norton Fighter]

Hi Twoboxer:

Because of the different release times of the new version, can you check Help & Support>about to see if there are differences in versions between the machines?  Some or all might be 16.2.0.7  and some or all could have the new 16.5.0.134.  Troubleshooting may vary depending on OS and version.

Are all of the affected machines running XP sp 3, and is it Pro or Home?  If not, give us a list of OS, service packs, NIS versions.

Also please check your event viewer in control panel>administration tools and give us a list of errors.  I for example have had a rash of w32time errors, which is hooked into a Microsoft patch as well as Nvidia warnings.

Nvidia drivers have been causing some issues and there is a recent update.

What other security or scanning programs do you have on your computers?

I would recommend typing this info out in Notepad for a copy and paste, because it will be lengthy, and the forum editing program has a rather nasty habit of refusing to send and deletes it instead.  It will make you distinctly irritable.

[Twoboxer]

OK, took your advice lol - been there with these editors. And I gave up trying to edit this with bolds and underlines - sorry.

PC #1) Dell XPS 710 H2C

Symptoms: Hangs, Sym Framework crashes

OS: MS Windows XP MCE Version 2002 SP3 (not Pro)

NIS: Ver 16.5.0.134

nVidia Info: 2x8800 GTX NOT running SLI using driver 181.20 during latest error.

Other Progs: Windows Firewall is apparently ON; No other security or scanner progs. Acronis Home. Several Logitech drivers and

Slysoft (DVD, CD) progs resident. FRAPS. SB X-FI.

Event Log Entries:

- 3/12/09 1:45 PM Faulting application ccSvcHst.exe, version 108.1.0.24, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x00050bb4.

- 3/10/09 4:30 AM Fault bucket 1138073496.

- 3/10/09 4:30 AM Faulting application iexplore.exe, version 7.0.6000.16791, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x0001b1fa.

- 3/9/09 1:49 PM Fault bucket 1169382849.

- 3/9/09 1:46 PM Faulting application ccSvcHst.exe, version 108.1.0.24, faulting module msvcr80.dll, version 8.0.50727.3053, fault address 0x00050bb4.

- 3/1/09 2:24 AM The description for Event ID ( 0 ) in Source ( Media Center Scheduler ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Flush: RecordingFile failed to write Invalid XML Operation..

- 2/28/09 7:03 PM The description for Event ID ( 0 ) in Source ( Media Center Scheduler ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Flush: RecordingFile failed to write Invalid XML Operation..

[PC not used 1/31 - 2/27]

- 1/30/09 Total 9 instances of the following, fixed after new version of zboard DL'd compatable with Net 3.5:

EventType clr20r3, P1 zboard.exe, P2 2.5.0.19, P3 483ae5f9, P4 zboard, P5 2.5.0.19, P6 483ae5f9, P7 14, P8 46, P9 system.nullreferenceexception, P10 NIL.(.NET Runtime 2.0 Error)

- 1/24/09 5:26 AM (2 occurrences) Fault bucket 1006469850.

- 1/13/09 3:29 PM 1/13/09 Fault bucket 1050193106.

- 1/13/09 3:25 PM Faulting application ccSvcHst.exe, version 108.0.2.4, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x00050bb4.

- 1/2/09 8:54 PM Faulting application ccSvcHst.exe, version 108.0.2.4, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x00050bb4.

- 12/31/09 4:49 AM Fault bucket 1050193106. (Application hang, faultrep.dll)

- 12/31/09 4:40 AM Faulting application ccSvcHst.exe, version 108.0.2.4, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x00050bb4.

- 12/29/08 4:40 AM Faulting application ccSvcHst.exe, version 108.0.2.4, faulting module msvcr80.dll, version 8.0.50727.1433, fault address 0x00050bb4.

PC#2 Sony VAIO Desktop All-in-one

Symptoms: Approx 3/6/09 NIS detaches from Outlook 2003, reason unknown, loses Blocked List on re-integration.

OS: MS Windows XP MCE Version 2002 SP3 (not Pro)

NIS: Ver 16.5.0.134

nVidia Info: hehe ATI Mobility Radeon x700, older drivers, wife's machine.

Other Progs: No other security or scanner progs. Acronis Home.

Event Log Entries:

- 3/9/2009 4:57:21 PM Fault bucket 752607381. (Application Error, faultrep.dll)

- 3/9/2009 4:55:34 PM Faulting application ati2evxx.exe, version 6.14.10.4118, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x000106f7.

[PC not used 1/31 - 2/27]

- 1/22/2009 3:10:41 PM Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

- 1/22/2009 3:06:56 PM Faulting application iexplore.exe, version 7.0.6000.16762, faulting module flash9f.ocx, version 9.0.124.0, fault address 0x0003c895.

- 1/19/2009 11:01:08 PM PW Exit: System.InvalidOperationException: No process is associated with this object.
   at System.Diagnostics.Process.EnsureState(State state)
   at System.Diagnostics.Process.get_HasExited()
   at System.Diagnostics.Process.EnsureState(State state)
   at System.Diagnostics.Process.get_ExitCode()
   at Durrant.DVRMSFileWatcher.ProcessWrap.ap_Exited(Object sender, EventArgs e)
  
- 1/15/2009 11:28:21 PM Faulting application iexplore.exe, version 7.0.6000.16762, faulting module flash9f.ocx, version 9.0.124.0, fault address 0x0003c895.

- 1/10/2009 9:56:46 AM The description for Event ID ( 0 ) in Source ( Media Center Scheduler ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Flush: RecordingFile failed to write Invalid XML Operation..

PC #3) Self-built Intel quad core

Symptoms: My backup and travel machine, this PC had its mobo replaced 10 days ago. It gets only periodic heavy use (including

Outlook email), eg, during the period 1/31-2/27. Hangs, Framework crashed, lost Log-ins and Blocked List all during that period.

OS: MS Windows Vista Home Premium SP1

NIS: Ver 16.2.0.7

nVidia Info: 8800 GT using driver 182.06.

Other Progs: Windows Firewall is ON, UAC is off; no other security or scanner progs. Acronis Home. Several Logitech drivers and

Slysoft (DVD, CD) progs resident.

Event Log Entries 1/31-2/27:

- 2/27/2009 6:07:30 PM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0x1730, application start time 0x01c999300b65336a.

- 2/27/2009 6:04:20 PM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0xdd8, application start time 0x01c9992f9f46fa5b.

- 2/27/2009 6:03:28 PM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0x16f0, application start time 0x01c9992f99860c0b.

- 2/27/2009 6:03:17 PM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0xc0c, application start time 0x01c9992f2aa30dbb.

- 2/26/2009 1:59:41 AM The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again. Context:  Application, SystemIndex Catalog

- 2/25/2009 9:20:44 PM The COM+ Event System detected a bad return code during its internal processing.  HRESULT was 8007043c from line 45 of d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp.  Please contact Microsoft Product Support Services to report this error.

- 2/25/2009 9:04:00 PM The COM+ Event System detected a bad return code during its internal processing.  HRESULT was 8007043c from line 45 of d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp.  Please contact Microsoft Product Support Services to report this error.

- 2/25/2009 3:43:49 PM The program PROTECT.exe version 3.6.10.8 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1dc Start Time: 01c99789a92394a5 Termination Time: 1 (Needed to DL newer version of copy protect program used by new games - all previous errors ignored)

-  2/23/2009 5:03:23 PM The program iexplore.exe version 7.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 15f8 Start Time: 01c995fe158822dc Termination Time: 0

- 2/19/2009 9:48:29 PM Faulting application Lockdown.exe, version 0.0.0.0, time stamp 0x34350681, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000005, fault offset 0x000659c3, process id 0x17c8, application start time 0x01c993009a76b0d4.

- 2/19/2009 8:36:20 PM Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

- 2/19/2009 8:19:58 PM The COM+ Event System detected a bad return code during its internal processing.  HRESULT was 8007043c from line 45 of d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp.  Please contact Microsoft Product Support Services to report this error.

- 2/12/2009 11:02:41 PM The program iexplore.exe version 7.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 1708 Start Time: 01c98d8fcb1f5966 Termination Time: 31

- 2/10/2009 9:24:52 PM Disabled performance counter data collection from the "PolicyAgent" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.

Unable to locate the open procedure "OpenIPSecPerformanceData" in DLL "C:\Windows\System32\ipsecsvc.dll" for the "PolicyAgent" service. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.

- 2/10/2009 9:16:33 PM The program iexplore.exe version 7.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: 9e4 Start Time: 01c98bc68f58beef Termination Time: 0

- 2/9/2009 1:37:57 PM Faulting application Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, faulting module Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, exception code 0xc000000d, fault offset 0x0000b2d0, process id 0x12e0, application start time 0x01c98ae4dc509c37.

- 2/9/2009 1:37:49 PM The program NOTEPAD.EXE version 6.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel. Process ID: e84 Start Time: 01c98ae54de63767 Termination Time: 2

- 2/7/2009 5:47:21 PM Faulting application Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, faulting module Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, exception code 0xc000000d, fault offset 0x0000b2d0, process id 0x123c, application start time 0x01c98949dfd2c1ad.

- 2/6/2009 4:14:17 PM Faulting application Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, faulting module Core Temp.exe, version 0.95.4.0, time stamp 0x46cac353, exception code 0xc000000d, fault offset 0x0000b2d0, process id 0x127c, application start time 0x01c98882199d1507.

- 2/5/2009 3:40:29 AM Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

- 2/4/2009 2:51:06 AM Faulting application EmeraldTear.exe, version 0.0.0.0, time stamp 0x48c5fc26, faulting module MSVCP80.dll, version 8.0.50727.1434, time stamp 0x475774e1, exception code 0xc0000005, fault offset 0x0000105e, process id 0xc34, application start time 0x01c9869cd3cf8f2b.

- 2/3/2009 11:36:36 PM Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

- 2/3/2009 11:36:35 PM Failed to create restore point on volume (Process = H:\DirectX9\DXSETUP.exe /silent; Descripton = ôbv; Hr = 0x80070057).

- 2/3/2009 11:35:51 PM Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005. This is often caused by incorrect security settings in either the writer or requestor process.

- 2/2/2009 4:11:37 AM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0x1444, application start time 0x01c985147f86b1f1.

- 2/2/2009 3:58:10 AM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0x1594, application start time 0x01c98513e21a18d1.

- 2/2/2009 3:52:19 AM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0xfa0, application start time 0x01c985133d99f9b1.

- 2/2/2009 3:49:52 AM Faulting application OUTLOOK.EXE, version 11.0.8217.0, time stamp 0x480f95d9, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000264, fault offset 0x0008ee83, process id 0x5d0, application start time 0x01c985130c8f0b31.

Message Edited by Twoboxer on 03-12-2009 10:19 PM

Message Edited by Twoboxer on 03-12-2009 10:20 PM

[delphinium Norton Fighter]

Wow, that is the most impressive collection of Windows errors, I've ever seen!  Gives us lots to work with though.

Are you running any Adobe Creative Suite CS3 on any of them?  Also, two have the new version 16.5, the other probably wasn't working well enough to download the update.

What is the MB name and version on contestant #3?  There has been a hardware conflict here and there.

[delphinium Norton Fighter]

Twoboxer:

Please view this thread, if you haven't found it already.  There are a number of posters with similar issues and an assortment of fixes, depending on the conflict involved.

http://community.norton.com/norton/board/message?board.id=Norton_360&message.id=342&query.id=533571#...

This thread is actually on the 360 forum but some of the problems might be the same.

[Twoboxer]

PC#1 hung again today with several info events, but no listed error event. Turned it on, checked this forum, read the replies, had breakfast, came back to frozen machine.\

@Delphinium:

1) PC#1: Programs listed in Adobe folder are Pagemill 3.0 and Photoshop 5.0.

2) Funny that the two XP systems have the "older" NIS, and the Vista machine has the "newer".

3) PC#3 had this motherboard through 2/2009 (Newegg Links):

EVGA 122-CK-NF68-A1 LGA 775 NVIDIA nForce 680i SLI ATX Intel Motherboard

Beginning ~March 2, this mobo:

GIGABYTE GA-EP45-UD3P LGA 775 Intel P45 ATX Intel Motherboard

I *beilieve* the EVGA mobo developed disk access issues over time. Since replacement the PC has performed perfectlyly. However, with regard to NIS, Outlook has not been used since the mobo replacement.

Message Edited by Twoboxer on 03-13-2009 11:00 AM

[delphinium Norton Fighter]

Hi Twoboxer:

Actually it is the two XP machines with the new version.  PC #3 has the old version.  The problem with #3 considering the number of errors could well be the video card.  Have a look at this thread with regard to Gigabyte drivers.  Check Gigabyte support to see if they have come up with a patch, and there is a link embedded in the thread to provide your information to Symantec so that they can provide a patch, if necessary.

http://community.norton.com/norton/board/message?board.id=nis_feedback&message.id=31984&query.id=561...

Hopefully some of the posters with experience on Media Centre will step in to assist.

[Twoboxer]

lol - guess I should read version numbers with a more open mind :)

Anyhow, the thread you reference shows a different Gigabyte mobo with an nVidia chipset. My Gigabyte board has an Intel P45 chipset - there are no nVidia mobo drivers. The drivers for the nVidia 8800GT vid card were kept up to date through Feb, and I installed the latest (3/3 update) last night. Since the mobo was replaced, I have been able to explain each of the error-events to my own satisfaction (ie, old prgram crashing for known reason, etc). And, although Outlook has not been used, the machine has performed flawlessly. I'll be using Outlook on that machine during April, so . . .

. . . let's forget PC#3 for now. The errors prior to 3/1 could well be because of nVidia problems, whether the then-installed EVGA mobo or the 8800GT. But the disk issues, mobo swap, and current performance change the mix too much for diagnosis.

=============

Re: PC#1: I did some poking around and discovered that BMUservice (Memeo Backup scheduler) launches every bootup. Memeo is an auto-backup program that operates during "idle time". Via a thread posted here earlier, I learned that could be a problem, and stopped the automated backups. However, the Memeo service still loads.

While that "shouldn't" pose a problem, I disabled that service today and will monitor results.

[Twoboxer]

No Joy - I was actually able to recreate the freeze-up (without eating breakfast again) without Memeo's service having run.

Then I disabled Google Update service (x2) . . . and I was NOT able to recreate the freeze-up.

Will let it run a few days and watch . . . this may be the source of the freeze-ups and they may or may not be related to an NIS conflict.

[delphinium Norton Fighter]

Voyager 10 contributed this fix as well.  The problem is that so many things can cause the Framework errors that it's hard to find.

---

Here is a possible Solution to the Problem "Framework stopped working" during complete Scan.

i have found the smallest storage instability (RAM) the error in the framework raises , "memtest"  do not found such errors .

increase the Stability in RAM then the error no longer appear , for example increase slightly the Ram-voltage from 1,8V to 1,9V .

this worked so far and i see no error after a Scan.

The second way is, replace the RAM and use less and larger Modules (2 instead of 1 GB) , this increases as well as the Stability .

Message Edited by Voyager10 on 09-11-2008 12:30 PM

---

With Acronis, it may depend on the version.  There appears to be as many successes as problems with it.

Disabling the anti-spam feature has helped, and turning off scanning of compressed files.

Please let us know if your fix works.