• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Norton AntiVirus crash after scanning 21 million (out of 5 million) files

A couple of days ago, I manually started an AntiVirus scan on my iMac.

Since it crashed, I don't have the specific numbers, but the progress window said something like:

"Scanning 2 items

<filename here>

21,nnn,nnn of 5,199,nnn files.

Various questions follow.

  1. It had been running for over two days.  Is this "normal?"  I've used Norton AntiVirus on PCs and their scans were much quicker.
  2. Does "items" mean volumes?
  3. I assume the 21 million files it scanned were contents of zipped files?  After it passed the 5 million mark and kept going, I realized I never unchecked the "Scan compressed files" checkbox.  Is there any point to having the full scan also check packed files, since the software will automatically scan the file contents if I viewed/unpacked it?
  4. Since it crashed, is there any proof of whether it did or didn't find any viruses, so far?  I checked the Activity Log but saw no mention at of recent AntiVirus messages.
I'm a bit leery of repeating the scan now, since it takes so long to check my computer, and I don't have a warm fuzzy feeling about the product in general at this point.  You previously had me turn off Auto-Protect (since there was some bug in an Apple NTFS driver that caused your product to crash when checking the Bootcamp volume), and now I can't do a manual scan, without it taking days, and crashing.

Replies

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

Sorry for the problems you're having.

I am not sure why it was taking that long, but certainly turning off compression scanning would help.  "Items" does mean volumes, assuming you were doing an "Entire System" scan (as opposed to choosing something specific).  Do you have particularly large volumes or a lot of files?

Regarding automatic checking of unpacked files, this is true assuming you have AutoProtect enabled, but you mention disabling it for BootCamp.  I'm actually fuzzy about whether the NTFS issue applies to AutoProtect, but if so, you may want to add the BootCamp volume as an area not to scan, as opposed to disabling AutoProtect entirely.  I'll get back to you about NTFS vs. AutoProtect after a little research.

I believe if detections had been found, they should appear in the log, even after a crash.

Unfortunately, the crash log for the application doesn't give an indication of what went wrong in the scan.  Can you see if there are any crash logs for SymAVScanDaemon?

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

I recalled incorrectly about AutoProtect, it can be affected by BootCamp/NTFS.  So if you want to enable it only for other volumes, you can:

1. go into the Automatic Protection tab in Norton AntiVirus and hit the "Configure" button in the Auto-Protect section.

2. Then select the "Auto File Scan" tab, and select the "Don't Scan" radio button. 

3. Then hit the "Add..." button next to that section, and select the BootCamp drive.

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

I've turned off compression scanning as you suggested.

Yes, I was doing an "Entire System" scan.  I have 2 drives -- my iMac's 1 Tb drive, and a 500 Gb external drive dedicated to Time Machine (containing over a year's worth of backups).  I also have Xcode installed, which probably qualifies for "a lot of files" just by itself :)

I checked the console, but there aren't any other crash logs, so SymAVScanDaemon didn't appear to crash.

The console did have many repeated messages saying:

4/26/11 4:37:19 AM [0x0-0x8c08c0].com.symantec.nortonantivirus[23596] Norton AntiVirus(23596,0xa0848540) malloc: *** mmap(size=2097152) failed (error code=12)

4/26/11 4:37:19 AM [0x0-0x8c08c0].com.symantec.nortonantivirus[23596]  *** error: can't allocate region

4/26/11 4:37:19 AM [0x0-0x8c08c0].com.symantec.nortonantivirus[23596]  *** set a breakpoint in malloc_error_break to debug

Which was finally followed by:

4/26/11 4:37:32 AM com.apple.launchd.peruser.502[240] ([0x0-0x8c08c0].com.symantec.nortonantivirus[23596]) Job appears to have crashed: Bus error

Could it be that the system ran out of resources (swap space?) due to Norton AntiVirus scanning over 21 million files?  Memory leak?

Is there a way to just scan the Macintosh HD volume, without scanning the Time Machine volume?  I'd like to see the scan complete, and get the results from AntiVirus.

Thanks for the info on Auto Protect.  I wasn't aware that individual volumes could be excluded, and I've turned Auto Protect back on now for everything but BootCamp.

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

Yes, you can scan individual volumes (or files or folders) by changing the radio button from "Entire system" to "Specific files" in the main scan tab, and then using the "Choose files" button before hitting "Perform Virus Scan".  Another thing you may want to try is scanning portions of your main drive separately, rather than the entire drive, in case there is a particular file that is problematic.  But I realize that's inconvenient, so trying with compression off may be the best bet at least for now.

It's possible there's a leak, though obviously we go to some effort to find and fix any we've seen.  That error doesn't seem familiar. I don't think I asked, are you running the latest version of NAV (11.1.2)?

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

Version 11.1.2 (17).  LiveUpdate runs/succeeds every morning.

It's just finished a scan now of specific files.  I picked Macintosh HD.  It says:

Scanning /

...

... of 814,944

It took about 50 minutes, but completed, and it did happen to find one virus in an email attachment:

/Users/<username>/Library/Mail/IMAP-<email>/INBOX.imapmbox/Attachments/4568/2/patch23.exe, W32.Swen.A@mm

I picked Delete, and that dropdown sheet has just been sitting there for 8 minutes now.  The Status column says "De..." and the Delete/Repair/Repair All/Done buttons are grayed out.

I went into Terminal to delete the file itself, and it's gone, but the rm process is a zombie now.  Not sure what AntiVirus is waiting on now, but it didn't pick up on the fact that the file had been deleted.

USER       PID  %CPU %MEM      VSZ    RSS   TT  STAT STARTED      TIME COMMAND

502          39963   0.0  3.9   606336 161848   ??  S     9:38PM   1:28.66 /Applications/Symantec Solutions/Norton AntiVirus.app/Contents/MacOS/Norton AntiVirus -psn_0_10775110

0               40090   0.0  0.0        0      0   ??  Z    10:31PM   0:00.00 (rm)

Anyway, the scan had completed, so (compression off plus) not scanning the external drive made a difference.  I imagine that's where the 4 million additional files are.

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

I checked the Activity Log, and there was no mention of a virus being found.

The only non-"Product update" event for today is:

Date: 4/26/11 9:40 PM

Event Type: Manual Scan

Result: No Problems

Details:

I don't know if this missing information is due to AntiVirus hanging, or what, but shouldn't there have also been an entry in there, in addition to the scan results pane?

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

The hang after delete is a known issue which should be addressed in a future version, my apologies.  I am not sure if that affected the logging, I would have expected at least the detection to be logged.

Kudos0

Re: Norton AntiVirus crash after scanning 21 million (out of 5 million) files

Thanks for the info and help, Lee.

Glad I can scan the system disk now, without any crashes.

This thread is closed from further comment. Please visit the forum to start a new thread.