20.3.0.36 Not Changing Systray "Warning" Icon Back To "Secure" Icon

Norton Security | Norton Internet Security
21
Saganized wrote:

 

Rainbow_2, hiya and hope you had a good weekend.  Gosh...us, and all our "issues."  LOL~  Yours might be the same, it might be similar, it might be different; but if it involves that blasted "X" in the systray, my guess is they're somehow related.  If you see it again--and the program's status reads Green (secure)--my bet is that it's the same issue.  I just hope the programmer people figure out why the program sends these "conflicting messages" (YES, your computer IS secure--NO, your computer is NOT secure!  lol).

Hi, Saganized.  I've had some experience with NIS where things happened - similar to what you are describing.  The problem occurs when anything that causes ccsvchst.exe to be suspended and then reactivated to "pause" between the suspended and reactivated moments.   

 

Note:  The suspended and reactivated moments occur whenever Live Update installs new forms of the various definition files NIS uses to scan for malware.  There is always a "switchover" which occurs as part of the LiveUpdate process - where an obsolete set of definitions is abandoned and the freshly-downloaded-and-installed set of definitions is instantiated.  Each time this occurs, there is an opportunity for ccsvchst.exe to "stall" - if something interferes with the rapid switchover between the obsolete and the new set of definition files.

 

The usual thing that causes the "pause" is a deadly-embrace between ccsvchst.exe and some other program - where those two programs "argue" for a while before one or the other "gets out of the way" - and thus allows both programs to do their required housekeeping.

 

Note for lurkers: If the Deadly Embrace never resolves - this is what causes the "red x" to come up and not go away again until the system is rebooted.  All that changes between a temporary stall and the more serious form is that a temporary stall normally resolves after a few seconds - where as the more serious form of a Deadly Embrace does not resolve until the machine is rebooted.  The very most serious forms of Deadly Embrace do not resolve - until one or the other of the two programs causing the embrace are actually fully uninstalled on the system exhibiting the problem.

 

 

 

There are some common things that cause Deadly Embraces.  The most common is the Control Panel installed along with a set of Video Drivers.  These are constantly being upgraded - and as we know Video Drivers have a very poor reputation as far as bugs and stability is concerned.  NIS sometimes ends up being the victim of a Deadly Embrace caused by a poor Video Driver Control Panel applet.   The "magic bullet" is often a Video Driver update.

 

There are lots of different things that can cause Deadly Embraces.  I have seen them occur with Printer Driver Notification Panels in the System Tray, Wired Network Drivers, Wireless Network Control Panel Applets, Mouse and Keyboard Control Panel Applets and so on.  A common one for Laptops is the Power Management Applet in the System Tray.  Another common one for Laptops is the Laptop Manufacturer's automatic-update utility (their version of LiveUpdate).  Both Sony and Lenovo have been guilty of this in the past - and I have personally seen and installed updates that try and resolve this problem.

 

 

Try checking in the forums for your Computer motherboard's make and model - to see if there are recommendations as to which drivers and other software is recommended for your particular situation.  Getting "the right stuff, the replacement stuff that updates the bugridden drivers and applets that came with the laptop" is often a solution to many different "weird" behaviours.

 

 

Hope this helps your understanding.

 

22
twixt wrote:
Saganized wrote:

 

Rainbow_2, hiya and hope you had a good weekend.  Gosh...us, and all our "issues."  LOL~  Yours might be the same, it might be similar, it might be different; but if it involves that blasted "X" in the systray, my guess is they're somehow related.  If you see it again--and the program's status reads Green (secure)--my bet is that it's the same issue.  I just hope the programmer people figure out why the program sends these "conflicting messages" (YES, your computer IS secure--NO, your computer is NOT secure!  lol).

Hi, Saganized.  I've had some experience with NIS where things happened - similar to what you are describing.  The problem occurs when anything that causes ccsvchst.exe to be suspended and then reactivated to "pause" between the suspended and reactivated moments.   

 

Note:  The suspended and reactivated moments occur whenever Live Update installs new forms of the various definition files NIS uses to scan for malware.  There is always a "switchover" which occurs as part of the LiveUpdate process - where an obsolete set of definitions is abandoned and the freshly-downloaded-and-installed set of definitions is instantiated.  Each time this occurs, there is an opportunity for ccsvchst.exe to "stall" - if something interferes with the rapid switchover between the obsolete and the new set of definition files.

 

The usual thing that causes the "pause" is a deadly-embrace between ccsvchst.exe and some other program - where those two programs "argue" for a while before one or the other "gets out of the way" - and thus allows both programs to do their required housekeeping.

 

Note for lurkers: If the Deadly Embrace never resolves - this is what causes the "red x" to come up and not go away again until the system is rebooted.  All that changes between a temporary stall and the more serious form is that a temporary stall normally resolves after a few seconds - where as the more serious form of a Deadly Embrace does not resolve until the machine is rebooted.  The very most serious forms of Deadly Embrace do not resolve - until one or the other of the two programs causing the embrace are actually fully uninstalled on the system exhibiting the problem.

 

 

 

There are some common things that cause Deadly Embraces.  The most common is the Control Panel installed along with a set of Video Drivers.  These are constantly being upgraded - and as we know Video Drivers have a very poor reputation as far as bugs and stability is concerned.  NIS sometimes ends up being the victim of a Deadly Embrace caused by a poor Video Driver Control Panel applet.   The "magic bullet" is often a Video Driver update.

 

There are lots of different things that can cause Deadly Embraces.  I have seen them occur with Printer Driver Notification Panels in the System Tray, Wired Network Drivers, Wireless Network Control Panel Applets, Mouse and Keyboard Control Panel Applets and so on.  A common one for Laptops is the Power Management Applet in the System Tray.  Another common one for Laptops is the Laptop Manufacturer's automatic-update utility (their version of LiveUpdate).  Both Sony and Lenovo have been guilty of this in the past - and I have personally seen and installed updates that try and resolve this problem.

 

 

Try checking in the forums for your Computer motherboard's make and model - to see if there are recommendations as to which drivers and other software is recommended for your particular situation.  Getting "the right stuff, the replacement stuff that updates the bugridden drivers and applets that came with the laptop" is often a solution to many different "weird" behaviours.

 

 

Hope this helps your understanding.

 

twixt, I think it helps, I'm still trying to make more sense of it.  However, what you say sounds very reasonable.  For example, like you, I know buggy drivers can create havoc on any system; perhaps the most serious (at least in my desktop's case) being the Windows "Blue Screen Of Death (BSOD)."

 

Coincidentally, I recently updated my video card's (AMD Radeon HD6570) driver and Catalyst Control Center software; and since that time, I have seen no red X's.  This seems to give even more credibility to your assertion!

 

I will keep an eye on the systray icon and see how things go with this new driver version, and if I continue to not see red X's, great!

 

Furthermore, if I update my video driver/CCC files again, I'll keep looking for red X's.  If I do see one, I can always roll-back the driver to the previous version (since revisions to my particular driver software don't often contain "performance enhancements" necessary for my components to operate more efficiently/effectively, anyhow).

 

Excellent suggestion--and I hope you're right!  :smileyhappy:

 

PS  I'm curious, how did you make the connection between NIS's LiveUpdate process and ccSvcHst.exe's "deadly embrace" behavior?  That seems like a "moment" so subtle, only a programmer might know it was taking place.  Most impressive.  :smileywink:

23
twixt wrote:
 

Note:  The suspended and reactivated moments occur whenever Live Update installs new forms of the various definition files NIS uses to scan for malware.  There is always a "switchover" which occurs as part of the LiveUpdate process - where an obsolete set of definitions is abandoned and the freshly-downloaded-and-installed set of definitions is instantiated.  Each time this occurs, there is an opportunity for ccsvchst.exe to "stall" - if something interferes with the rapid switchover between the obsolete and the new set of definition files.

 

The usual thing that causes the "pause" is a deadly-embrace between ccsvchst.exe and some other program - where those two programs "argue" for a while before one or the other "gets out of the way" - and thus allows both programs to do their required housekeeping.

 

twixt, also, if you know, what exactly is ccSvcHst.exe?  I ask, because it seems this "deadly embrace" could conceptually occur with any program (besides NIS) which utilizes it--would you agree?  (My Windows Task Manager shows FOUR instances of ccSvcHst.exe running, at this very moment.  I am assuming each one is not being "shared" by more than one program at the same time.)

 

Therefore, is it possible that there are any number of programs causing ccSvcHst.exe to run--thereby bringing up (or, increasing) the possibility a "deadly embrace" will transpire?

 

Another possibility:  Does each ccSvcHst.exe perform a different function--for a different program--at the same time?  (I can't imagine why FOUR of them would be running simultaneously!)  Thanks again.

24
Saganized wrote:

twixt, also, if you know, what exactly is ccSvcHst.exe?  I ask, because it seems this "deadly embrace" could conceptually occur with any program (besides NIS) which utilizes it--would you agree?  (My Windows Task Manager shows FOUR instances of ccSvcHst.exe running, at this very moment.  I am assuming each one is not being "shared" by more than one program at the same time.)

 

Therefore, is it possible that there are any number of programs causing ccSvcHst.exe to run--thereby bringing up (or, increasing) the possibility a "deadly embrace" will transpire?

 

Another possibility:  Does each ccSvcHst.exe perform a different function--for a different program--at the same time?  (I can't imagine why FOUR of them would be running simultaneously!)  Thanks again.

ccsvchst.exe is the Norton program. You will see one instance of this for each user logged onto your system, including the System user which I believe would be the main Norton services ( Firewall, AutoProtect, etc).  You will also see another instance open when you open the User Interface.

 

I believe you also see this if you have Norton Utilities.

 

It is confusing that the same file name is used for all instances of the Norton products, and Norton has already had a suggestion to somehow identify which itteration of ccsvchst does what.

 

 

 

25
peterweb wrote:
Saganized wrote:

twixt, also, if you know, what exactly is ccSvcHst.exe?  I ask, because it seems this "deadly embrace" could conceptually occur with any program (besides NIS) which utilizes it--would you agree?  (My Windows Task Manager shows FOUR instances of ccSvcHst.exe running, at this very moment.  I am assuming each one is not being "shared" by more than one program at the same time.)

 

Therefore, is it possible that there are any number of programs causing ccSvcHst.exe to run--thereby bringing up (or, increasing) the possibility a "deadly embrace" will transpire?

 

Another possibility:  Does each ccSvcHst.exe perform a different function--for a different program--at the same time?  (I can't imagine why FOUR of them would be running simultaneously!)  Thanks again.

ccsvchst.exe is the Norton program. You will see one instance of this for each user logged onto your system, including the System user which I believe would be the main Norton services ( Firewall, AutoProtect, etc).  You will also see another instance open when you open the User Interface.

 

I believe you also see this if you have Norton Utilities.

 

It is confusing that the same file name is used for all instances of the Norton products, and Norton has already had a suggestion to somehow identify which itteration of ccsvchst does what.

 

 

Thanks, peterweb.  It's peculiar, because I am the only user/administrator for my desktop computer, and I don't have Norton Utilities...but I still see four ccSvcHst.exe's.  In fact, I see four right now--and all I have open is IE8, to write this post.  Also NIS 2013 (in the system tray) along with Creative Volume Control, WUSB600N (my wireless adapter), and AOL - Connection Available (AOL Fast Start?).  That's all--nothing else--four ccSvcHst.exe's.  Even if it did include the "System user," that would only equal two users...wouldn't it?  Oh, well.  :::scratches head:::  Anyway, thanks.