Norton for Mac

[Cajarosz]

Hello!!!  I noticed that scans of my mac seemed to run too quickly and complete without detecting any viruses.  I looked at the log and saw that immediately after I requested a full system scan, the SymAVScanDaemon had crashed.  I've attached a copy of the dump from the crash reporter.... HELP!!! THANKS IN ADVANCE FOR YOUR HELP!!!!

Process:         SymAVScanDaemon [500]

Path:            /Library/PrivateFrameworks/SymAVScan.framework/Versions/A/Resources/SymAVScanDaemon.bundle/Contents/MacOS/SymAVScanDaemon

Identifier:      SymAVScanDaemon

Version:         ??? (???)

Code Type:       PPC (Native)

Parent Process:  launchd [1]

Date/Time:       2009-05-15 18:45:59.585 -0700

OS Version:      Mac OS X 10.5.7 (9J61)

Report Version:  6

Anonymous UUID:  029B47FE-D688-45AB-96D3-7BC3C28AC303

Exception Type:  EXC_CRASH (SIGABRT)

Exception Codes: 0x0000000000000000, 0x0000000000000000

Crashed Thread:  3

Thread 0:

0   libSystem.B.dylib             0x91ae8d0c sendto$UNIX2003 + 12

1   com.apple.CoreFoundation      0x91da3388 __CFSocketEnableCallBacks + 1052

2   com.apple.CoreFoundation      0x91d9d2e4 CFSetApplyFunction + 284

3   com.symantec.daemon.framework 0x00088034 SymDaemon::SocketObserver::createClientSocketConnectedTo(sockaddr const*, int, int, int, __CFRunLoop*, double) + 284

4   com.symantec.daemon.framework 0x000880d8 SymDaemon::SocketObserver::createClientSocketConnectedTo(char const*, __CFRunLoop*, double) + 96

5   com.symantec.uiagent.framework 0x001003a8 SymUIA::RemoteConnection::RemoteConnection(__CFRunLoop*, bool) + 156

6   com.symantec.uiagent.framework 0x00101200 SymUIA::MsngrRmtConnection::MsngrRmtConnection(UIAgentMessenger*, __CFRunLoop*) + 40

7   com.symantec.uiagent.framework 0x000fa890 UIAgentMessenger::Register(__CFRunLoop*, bool) + 136

8   com.symantec.uiagent.framework 0x000fa8fc UIAgentMessenger::StartupListener() + 20

9   com.symantec.avscandaemon     0x000055c8 0x1000 + 17864

10  com.symantec.avscandaemon     0x00004e80 0x1000 + 16000

11  com.symantec.avscandaemon     0x0000507c 0x1000 + 16508

12  com.symantec.daemon.framework 0x00086fbc SymDaemon::SocketObserver::doCallBack(__CFSocket*, unsigned long, __CFData const*, void const*) + 224

13  com.apple.CoreFoundation      0x91da1bd8 __CFSocketDoCallback + 352

14  com.apple.CoreFoundation      0x91da34d0 __CFSocketPerformV0 + 292

15  com.apple.CoreFoundation      0x91d98260 CFRunLoopRunSpecific + 1104

16  com.apple.CoreFoundation      0x91d98dac CFRunLoopRun + 60

17  com.symantec.avscandaemon     0x0000427c 0x1000 + 12924

18  com.symantec.avscandaemon     0x000054cc 0x1000 + 17612

19  com.symantec.avscandaemon     0x000026d4 0x1000 + 5844

20  com.symantec.avscandaemon     0x0000257c 0x1000 + 5500

Thread 1:

0   libSystem.B.dylib             0x91ac6900 kevent + 8

1   com.symantec.avscandaemon     0x00005364 0x1000 + 17252

Thread 2:

0   libSystem.B.dylib             0x91ae8d74 select$DARWIN_EXTSN + 12

1   com.apple.CoreFoundation      0x91da3998 __CFSocketManager + 764

Thread 3 Crashed:

0   libSystem.B.dylib             0x91b8f2b0 __semwait_signal_nocancel + 8

1   libSystem.B.dylib             0x91a8d590 get_or_create_key_element + 192

2   libSystem.B.dylib             0x91b87fe0 usleep$NOCANCEL$UNIX2003 + 68

3   libSystem.B.dylib             0x91ba1ba0 __abort + 88

4   libSystem.B.dylib             0x91ba1c08 abort + 96

5   libstdc++.6.dylib             0x928e9e24 __gnu_cxx::__verbose_terminate_handler() + 400

6   libstdc++.6.dylib             0x928e7940 __gxx_personality_v0 + 1240

7   libstdc++.6.dylib             0x928e79a4 std::terminate() + 68

8   libstdc++.6.dylib             0x928e8208 __cxa_pure_virtual + 44

9   com.symantec.uiagent.framework 0x00100944 SymUIA::RemoteConnection::handleDataInternal(void*) + 92

10  com.symantec.uiagent.framework 0x00100b40 SymUIA::RemoteConnection::handleDataForSocket(__CFSocket*, __CFData const*, __CFData const*) + 380

11  com.symantec.daemon.framework 0x00086fbc SymDaemon::SocketObserver::doCallBack(__CFSocket*, unsigned long, __CFData const*, void const*) + 224

12  com.apple.CoreFoundation      0x91da1bd8 __CFSocketDoCallback + 352

13  com.apple.CoreFoundation      0x91da34d0 __CFSocketPerformV0 + 292

14  com.apple.CoreFoundation      0x91d98260 CFRunLoopRunSpecific + 1104

15  com.apple.CoreFoundation      0x91d98dac CFRunLoopRun + 60

16  com.symantec.uiagent.framework 0x00101c8c RunLoopMain(void*) + 192

17  libSystem.B.dylib             0x91ac70c4 _pthread_start + 316

Thread 3 crashed with PPC Thread State 32:

  srr0: 0x91b8f2b0  srr1: 0x0000d030   dar: 0xf0080ee4 dsisr: 0x42000000

    r0: 0x000001a7    r1: 0xf0113080    r2: 0xa02783c0    r3: 0x0000003c

    r4: 0x00000000    r5: 0x00000001    r6: 0x00000001    r7: 0x00000000

    r8: 0x00989680    r9: 0x00989680   r10: 0x91acfa04   r11: 0xa027c7fc

   r12: 0x91b8eccc   r13: 0x00000000   r14: 0xa02d5478   r15: 0x7fffffff

   r16: 0xffffffff   r17: 0x00000000   r18: 0x00000000   r19: 0x00000000

   r20: 0x00000000   r21: 0x00000000   r22: 0x0021e240   r23: 0x00000001

   r24: 0x0021e200   r25: 0x0021e220   r26: 0x00000010   r27: 0x0022cbf0

   r28: 0x0021e230   r29: 0xf0113118   r30: 0x00000000   r31: 0x91b8ece0

    cr: 0x42022228   xer: 0x00000000    lr: 0x91b8ed80   ctr: 0x91b8eccc

vrsave: 0x00000000

[BobP1776]

Same problem.  There appears to be an incompatibility between the Norton 11.0.2 code and Mac OS X 10.5.7 as the problem started after the 10.5.7 update.  The problem may be limited to PowerPC Macs.

Any attempt to do a manual scan or a full scan will crash the SymAVScanDaemon.  The crash happens while logged in as my normal account, and also when logged in as my admin account.  The crash happens as the scan process is preparing to scan -- apparently before the first file is actually scanned.  The crash happens even when attempting to scan a single .rtf text file, so it is not an issue with unpacking archives.

The scan daemon throws two error messages to the Console prior to the crash.  They are:

5/22/09 10:29:34 AM com.symantec.avscandaemon[344] pure virtual method called 

5/22/09 10:29:34 AM com.symantec.avscandaemon[344] terminate called without an active exception 

Running LiveUpdate with the 5/21 definitions does not fix this.

Downloading the full Intelligent Updater with the 5/21 stuff and running that also does not fix this.

Using the Symantec Uninstaller, then re-installing from the original disc image for the 11.0 product, and letting LiveUpdate do its thing at the end of that install also does not fix this.

However, uninstalling, re-installing (with Live Update) and then ALSO running the 5/21 Intelligent Updated *DID* appear to fix this.  I was able to do manual scans of small folders that had previously crashed the Daemon, and I was able to start and then cancel a full disc scan. 

To tidy up after all this futzing around, I then did a Safe Boot (to clear caches), a PRAM reset, and then ran DiskUtility to Repair Permissions (no problems reported), and finally another reboot.  And after all that, I was back in the state where the Scan Daemon crashes on every scan attempt.  I don't know whether the Safe Boot, etc., triggered this or whether it was just a fluke that it was working at all after the previous step.

Here's a typical Crash Report.  I've got a ton of them if you need more.  The forum won't let me post the full length of the Crash Report so I've cut it off before the Binary Images.  Let me know if you need that, and I'll find a way to get it to you:

Process:         SymAVScanDaemon [181]

Path:            /Library/PrivateFrameworks/SymAVScan.framework/Versions/A/Resources/SymAVScanDaemon.bundle/Contents/MacOS/SymAVScanDaemon

Identifier:      SymAVScanDaemon

Version:         ??? (???)

Code Type:       PPC (Native)

Parent Process:  launchd [1]

Date/Time:       2009-05-22 01:10:14.448 -0400

OS Version:      Mac OS X 10.5.7 (9J61)

Report Version:  6

Anonymous UUID:  5E12B162-89FB-4205-934E-A988D8853A77

Exception Type:  EXC_CRASH (SIGABRT)

Exception Codes: 0x0000000000000000, 0x0000000000000000

Crashed Thread:  3

Thread 0:

0   libSystem.B.dylib             0x92a32d0c sendto$UNIX2003 + 12

1   com.apple.CoreFoundation      0x904a1388 __CFSocketEnableCallBacks + 1052

2   com.apple.CoreFoundation      0x9049b2e4 CFSetApplyFunction + 284

3   com.symantec.daemon.framework 0x00088034 SymDaemon::SocketObserver::createClientSocketConnectedTo(sockaddr const*, int, int, int, __CFRunLoop*, double) + 284

4   com.symantec.daemon.framework 0x000880d8 SymDaemon::SocketObserver::createClientSocketConnectedTo(char const*, __CFRunLoop*, double) + 96

5   com.symantec.uiagent.framework 0x001003a8 SymUIA::RemoteConnection::RemoteConnection(__CFRunLoop*, bool) + 156

6   com.symantec.uiagent.framework 0x00101200 SymUIA::MsngrRmtConnection::MsngrRmtConnection(UIAgentMessenger*, __CFRunLoop*) + 40

7   com.symantec.uiagent.framework 0x000fa890 UIAgentMessenger::Register(__CFRunLoop*, bool) + 136

8   com.symantec.uiagent.framework 0x000fa8fc UIAgentMessenger::StartupListener() + 20

9   com.symantec.avscandaemon     0x000055c8 0x1000 + 17864

10  com.symantec.avscandaemon     0x00004e80 0x1000 + 16000

11  com.symantec.avscandaemon     0x0000507c 0x1000 + 16508

12  com.symantec.daemon.framework 0x00086fbc SymDaemon::SocketObserver::doCallBack(__CFSocket*, unsigned long, __CFData const*, void const*) + 224

13  com.apple.CoreFoundation      0x9049fbd8 __CFSocketDoCallback + 352

14  com.apple.CoreFoundation      0x904a14d0 __CFSocketPerformV0 + 292

15  com.apple.CoreFoundation      0x90496260 CFRunLoopRunSpecific + 1104

16  com.apple.CoreFoundation      0x90496dac CFRunLoopRun + 60

17  com.symantec.avscandaemon     0x0000427c 0x1000 + 12924

18  com.symantec.avscandaemon     0x000054cc 0x1000 + 17612

19  com.symantec.avscandaemon     0x000026d4 0x1000 + 5844

20  com.symantec.avscandaemon     0x0000257c 0x1000 + 5500

Thread 1:

0   libSystem.B.dylib             0x92a10904 kevent + 12

1   com.symantec.avscandaemon     0x00005364 0x1000 + 17252

Thread 2:

0   libSystem.B.dylib             0x92a32d74 select$DARWIN_EXTSN + 12

1   com.apple.CoreFoundation      0x904a1998 __CFSocketManager + 764

Thread 3 Crashed:

0   libSystem.B.dylib             0x92ad92b0 __semwait_signal_nocancel + 8

1   libSystem.B.dylib             0x92ad8d7c nanosleep$NOCANCEL$UNIX2003 + 176

2   libSystem.B.dylib             0x92ad1fe0 usleep$NOCANCEL$UNIX2003 + 68

3   libSystem.B.dylib             0x92aebc04 abort + 92

4   libstdc++.6.dylib             0x94396e24 __gnu_cxx::__verbose_terminate_handler() + 400

5   libstdc++.6.dylib             0x94394940 __gxx_personality_v0 + 1240

6   libstdc++.6.dylib             0x943949a4 std::terminate() + 68

7   libstdc++.6.dylib             0x94395208 __cxa_pure_virtual + 44

8   com.symantec.uiagent.framework 0x00100944 SymUIA::RemoteConnection::handleDataInternal(void*) + 92

9   com.symantec.uiagent.framework 0x00100b40 SymUIA::RemoteConnection::handleDataForSocket(__CFSocket*, __CFData const*, __CFData const*) + 380

10  com.symantec.daemon.framework 0x00086fbc SymDaemon::SocketObserver::doCallBack(__CFSocket*, unsigned long, __CFData const*, void const*) + 224

11  com.apple.CoreFoundation      0x9049fbd8 __CFSocketDoCallback + 352

12  com.apple.CoreFoundation      0x904a14d0 __CFSocketPerformV0 + 292

13  com.apple.CoreFoundation      0x90496260 CFRunLoopRunSpecific + 1104

14  com.apple.CoreFoundation      0x90496dac CFRunLoopRun + 60

15  com.symantec.uiagent.framework 0x00101c8c RunLoopMain(void*) + 192

16  libSystem.B.dylib             0x92a110c4 _pthread_start + 316

Thread 3 crashed with PPC Thread State 32:

  srr0: 0x92ad92b0  srr1: 0x0000d030   dar: 0xf011400c dsisr: 0x40000000

    r0: 0x000001a7    r1: 0xf01130e0    r2: 0xa05223c0    r3: 0x0000003c

    r4: 0x00000000    r5: 0x00000001    r6: 0x00000001    r7: 0x00000000

    r8: 0x00989680    r9: 0x00989680   r10: 0x92a19a04   r11: 0xa05267fc

   r12: 0x92ad8ccc   r13: 0x00000000   r14: 0xa0083478   r15: 0x7fffffff

   r16: 0xffffffff   r17: 0x00000000   r18: 0x00000000   r19: 0x00000000

   r20: 0x00000000   r21: 0x00000000   r22: 0x0021da50   r23: 0x00000001

   r24: 0x0021da10   r25: 0x0021da30   r26: 0x00000010   r27: 0x0022c6e0

   r28: 0x0021da40   r29: 0xf0113178   r30: 0x00000000   r31: 0x92ad8ce0

    cr: 0x42022228   xer: 0x00000000    lr: 0x92ad8d80   ctr: 0x92ad8ccc

vrsave: 0x00000000

 --Bob 

[BobP1776]

I have more info on this problem.  The crashing of the scan daemon is apparently due to some sort of corruption that happens when you Restart the computer.  For example:

PRELIMINARIES:  Run Live Update and make sure everything is already up to date.  In addition download the 5/21 Intelligent Updater from the following page (in my case I'm using the PowerPC version):

http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=nmc 

UnZip the download and stash the resulting PKG file in a convenient location such as the Desktop.  Do NOT run it yet.

-----------------------------------------------

STEP 1:  Close all applications and restart the computer.  Log in to a non-administrator account.  Launch Applications > Utilities > Console and select All Messages in the column on the left to see what happens.  Right click on any single file (I use a .rtf text file) and initiate a manual scan on that file.

RESULT:  The scan daemon crashes as described in my previous post. 

-----------------------------------------------

STEP 2:  Close Console and Restart the computer again.  Log in to the same non-administrator account.  Launch Console as above. Now run the Intelligent Updater PKG file.  It should say the install will take no additional space.  Authenticate with an Administrator password when asked.  When Intelligent Update finishes, exit it and right click on the same test file you used above and initiate another manual scan.

RESULT:  The manual scan completes without problems.  You can do additional manual scans as well without problems.

-----------------------------------------------

STEP 3:  Close Console and Restart the computer again.  Log in to the same non-administrator account.  Launch Console as above.  Right click on the same test file and initiate another manual scan.

RESULT:  The scan daemon crashes as before.

CONCLUSION:  Something is getting corrupted during the Restart of the computer.

WORKAROUND:  Re-run the Intelligent Updater once after each Restart of the computer.

----------------------------------------------

Using that workaround, I'm now 30,000 files into a whole disk scan without any errors.

--Bob 

[BobP1776]

Just to complete the story from yesterday, the manual, "Perform Virus Scan" of the Entire System completed without finding any problem files and without producing any messages in the Console (using the Workaround described in my previous post).

Upon doing a Restart of the computer, the scan daemon was back in the state where it crashes again. 

NOTE:  When I did the update from Mac OS X 10.5.6 to 10.5.7 a couple weeks back, I downloaded the 10.5.7 Combo Updater and ran that to do the update.  So using the Combo Updater is also not a cure for whatever is going wrong here.

NOTE 2:  The reason I didn't discover this Workaround during the reinstalls I tried in my first post above was, apparently, that I was doing a Restart of the computer after each reinstall attempt -- as a matter of course -- prior to actually trying a manual scan, with the exception of the one case where I reported the scan daemon working again.  So those results are fully consistent with what I've now found as the Workaround.

NOTE 3:  Looking in Console > All Messages after a Restart like this, I've spotted no messages that might be related to whatever is getting screwed up during the Restart to cause this -- either from Symantec processes or otherwise.  All the messages are consistent with what Restarts produced under 10.5.6 when this problem with the scan daemon didn't exist. 

--Bob 

Message Edited by BobP1776 on 05-24-2009 12:31 PM

[Cajarosz]

Hi Bob, I tried to install the software and it tells me that the main disk is not a system disk and will not go any further.  My guess now is that my system may have been rooted.  I need to examine it a bit more, but I'm thinking of doing a complete wipe of the system.... Thanks for your help so far.  You have been my rock star!!!!!

Thanks again...

chrisj 

[BobP1776 · Accepted solution]

Your installation problem may be something entirely unrelated -- perhaps trying to install the wrong version.  Perhaps not properly uninstalling the prior stuff first.  If the install you are talking about is the Intelligent Updater, note that there are two versions of Intelligent Updater on that page I cited above both of which apply to the 11.0.2 product.  As I recall your computer is also a PowerPC Mac.  If so, be sure you are downloading and using the version intended for PowerPC Macs.

We'll have to wait for someone from Symantec to reply on this scan daemon crash, but so far I don't see anything in what I've reported to indicate my computer has been compromised or infected.

It just looks like a bug in the 11.0.2 Symantec product.  It happens.

If you can't figure out your installation problem, you may want to start another thread with details of what you are trying and what's happening.  (Refer to this thread to connect the two problems.) 

--Bob 

[Cajarosz]

Cool,  Thanks Bob for your help!!!!  I'll let you know what I discover.

[Cajarosz]

Hi Bob!!!

I just looked at the website and you're right.  I was downloading the intel image instead of the PPC one.  It ran fine and updated the scanning engine.  It is right now chugging along doing well.

My hat is off to you.  I have a sacrificial chicken for your altar!!!!

Many thanks,

Best and finest regards!!!

chrisj 

[BobP1776]

That's great.  So we've got a Workaround.  Now we just need a fix.

Perhaps the new definitions that come out this week will fix the problem so we don't have to keep re-running Intelligent Updater after every Restart.

By the way, just in case it isn't obvious, until Symantec actually fixes this problem you will need to re-download the new version of Intelligent Updater to use for this Workaround each time Symantec rolls out a new set of virus definitions.  If you keep re-running the one you have now, you will stay stuck at last week's virus definitions.

--Bob 

[BobP1776]

The updates brought in this week via Live Update (the Live Update code itself yesterday, and the 5/29 virus definitions today) have changed the behavior of this failure -- almost a fix but not quite.

Immediately after Live Update completed installing the 5/29 definitions this evening I was able to do a manual scan without problems.

Then I did a Restart of the computer and was STILL able to do a manual scan without problems.

Then I did a second Restart, and this time when I tried to do the manual scan I got the same crash reported earlier in this thread.

Finally, I did a third Restart, and this time I was once again able to do a manual scan without problems.

I then started a whole system scan, and it is in progress without any problems so far.  So I have *NOT* had to use the Intelligent Updater  as a Workaround this week to get things going.

Anyway, something is clearly improved this week, but apparently it is STILL possible for a Restart to leave the 11.0.2 product in a state where you can't do manual scans.

--Bob