Norton Internet Security / Norton AntiVirus

[MPSAN]

Hello ALL:

All of a sudden my wife is getting "Symantec Service Framework" and "BHEngine" errors/popups. We are using NIS 2011 ver 18.6.0.29 on XP Pro SP3. We have never had this before? Could this have anything to do with a downlevel MS Net Framework?

[jaemsz]

Hi MPSAN,

Can you post an image of what you are seeing?

Thanks,

jaemsz

[MPSAN]

Well, this is on my wife's system and I will see what I can get the next time it happens. However, I did write down the message and some data the last time she showed me the issue. It said the following....

Symantec Service Framework encountered a problem and needs to shut down.

szappname: ccsvhst.exe

10.1.1.16

The Event viewer also mentioned that the faulting module was BHEngine.dll  6.2.2.17 fault address 0x00094727.

It seems to come up on a boot as the event log shows it every day and the same hex (0x) address. I hope this is enough info.

[jaemsz]

1.  Is this something that happens frequently?

2.  Check c:\windows\minidump folder for *.dmp files.  Check the date/time of the latest one.  Does it coincide with the BHEngine crash?  If so,  we need to take a look at it.

[Carlos_Linares]

Can you look up your installed update list and post the KB number for the MS update you mentioned?

[MPSAN]

Carlos do you mean the MS net framework update?

Also, we were away and I will need to turn on my wifes computer to answer the rest of the info being requested.

Thank you both. I THINK we get this posted in the log every time the system boots up but I will confirm.

[MPSAN]

UPDATE.

So far, it did not happen (yet) today. I am leaving the system on to check.

However, I looked at the minidump directory and have only 2 files from a few years ago, so, no, the BHEngine.dll errors are NOT creating a dmp file.

Also, my last MS .net framework installed update is KB2446704. They suggest a newer one...ver 4 KB982670 but I have not done that.

[jaemsz]

Please let us know if you are able to reproduce the problem.  Thanks.

[MPSAN]

Well, it just happened again. I will see if there is a .dmp file. It does close down NIS2011. I still did not update MS .net framewaork. Could that matter or is the Norton Framework a different item?

[MPSAN]

OK, I looked and there were NO .dmp files in Windows\minidump.

I checked the event viewer and in Application event at 16:18 it said that the Faulting Module was ntdll.dll

I looked at the System Event and at 16:21 it said that the NIS service was terminated and would restart in 120,000 MS, which it did. I did notice after the error that NIS was not running, but it is now.