BUG-Norton Security 22.10 degrades system performance

Ever since I updated to 22.10, I have noticed a severe issue regarding performance.  After installing the update, everything is fine for a few hours but then all hell breaks loose.  Windows becomes very slow to respond and opening IE results in a IE window that is frozen and windows explorer becomes very sluggish to navigate.  The hard drive is thrashing and I have seen the Norton Security process with active disk usage as high as 60%+ with it writing 8 MB/s for 20 mins or longer.  Opening the main Norton UI even takes about 5 or 10 mins and the disk thrashes when it does that as well.  I have to do a hard reboot because Windows takes forever to restart and then everything is fine until Norton Security does its degradation after a few hours and this has happened on both of my desktop systems with Windows 10 Creators Update.

22.10 should be pulled quite honestly with all of these problems going on.  Norton 22.9.4 had been running perfectly for me and I wish I could keep 22.9.4 installed without being auto updated to 22.10

OK, so now the issue seems to be clearing itself out for now.  The distrptr.dat file was at 93 MB on sept 28 and when I seen that I booted into Safe Mode, deleted the distrptr.dat and booted normally.  It once again went back from 23 KB to eventually 13 MB by last night.  I went to work today at 2pm with the file at 15 MB but by the time I got home from work at 11 pm, it was only 33 KB and now is only at 21 KB.  I have the Detailed Error Data Collection and NCW set to ON.  The only thing I did differently was I turned off my Email protection and Antispam as I can't use them in Outlook 2016 as I have Hotmail / Outlook.com accounts.  Performance of the system and Norton itself has been great so far, so I'm not sure whats going on, maybe a definition update or something.  I may turn the Email Protection and Antispam back on and see if that is what the problem is, however in the Norton Background Tasks window, on the very bottom, the task "Product Maintenance" shows as "Failed to Complete" and this started about the time I turned off Email Protection and Antispam.

I have disabled Norton Community Watch, and rebooted, still the same issue, it seems related to heavy use of the page file when memory runs low.

I have some applications that loses audio and other connections to the world as they need to run near “real time” during these events.

NIS 22.10.1.10, traditional channel, has occupied 6,3 GB since restart.

It seems related to new virus definition updates.

WIN7/64, 8 GB RAM, Pagefile (windows set) 8 GB.

All data related to NIS is under directories …26E7}\22.7.0.76\ in case that dindicates an error here.

Pcloverxp:

At the moment my distrptr.dat file is now up to 93 MB and it seems to affect the responsiveness of opening the Norton UI, the hard drive seems to have to really work just to open the UI and it takes 10 to 20 seconds to open.  My NCW history has 7 or 8 entries as Pending but overall I have 8 pages in my NCW history.  Is anyone from Norton monitoring this thread?

Can you post 4-7 entries (some new, some old) from the NCW history? After that, can you turn off NCW in the "Administrative Settings" section and reboot? Did that help things?

If that didn't help, can you delete the contents of the "diStRptr" folder from safe mode? Did that change anything?

At the moment my distrptr.dat file is now up to 93 MB and it seems to affect the responsiveness of opening the Norton UI, the hard drive seems to have to really work just to open the UI and it takes 10 to 20 seconds to open.  My NCW history has 7 or 8 entries as Pending but overall I have 8 pages in my NCW history.  Is anyone from Norton monitoring this thread?

FYI, thread in reference is here:
https://community.norton.com/forums/distrptrdat-product-maintenance-and-statsqalabssymanteccom

By the way, this occurred way before 22.10.  There is a similar forum thread from August 2014.  Norton response:

"Symantec is aware of both of these issues with the right context menu and the distrptr.dat file. The next version of the av agent will include fix's for both of these issue. We are expecting that version to be released in the next 30-60 days. Please let us know if you have any additional questions."

 

 

lmacri:
Pcloverxp:

The problem with that is when the system gets bogged down by the disk usage, opening the Norton UI will take 10 mins or longer, in fact right clicking on the tray icon is unresponsive as well....Yes, the Norton Tamper Protection is turned off for this particular reason so I dont have to reboot Windows every time Norton starts using the disk hard.

 Hi Pcloverxp:

I don't know all the specifics of how Norton Product Tamper Protection (NPTP) works, but I wouldn't be surprised if that's the cause of at least some of your disk thrashing.  When you disable NPTP and manually kill an instance of nsbu.exe that could be mistaken as a malware attack, and Norton could be launching a scan to check for malware after it restarts nsbu.exe.  This scenario is entirely speculation on my part, but if you're trying to troubleshoot with NPTP disabled it might make it more difficult to isolate the trigger for your disk thrashing.

It should prevent him from killing the process if it is enabled.

But as previously stated if some info as to what Norton is doing (taskwise) during the bog down it could be very revealing (even if that means leaving a window open or check the full log near the timespan -- without killing the process if possible).

The disk thrashing started well before I had resorted to turning off the NPTP and the disk optimizer has been turned off and hasn't run.  This whole drama started with the initial release of 22.10.  22.9 has never had this problem and my CPU usage is low during the hard drive activity and its the hard drive activity which is slowing down the system.  Its too bad I cant go back to 22.9 without being auto updated to 22.10.1.10.

Pcloverxp:

The problem with that is when the system gets bogged down by the disk usage, opening the Norton UI will take 10 mins or longer, in fact right clicking on the tray icon is unresponsive as well....Yes, the Norton Tamper Protection is turned off for this particular reason so I dont have to reboot Windows every time Norton starts using the disk hard.

 Hi Pcloverxp:

I don't know all the specifics of how Norton Product Tamper Protection (NPTP) works, but I wouldn't be surprised if that's the cause of at least some of your disk thrashing.  When you disable NPTP and manually kill an instance of nsbu.exe that could be mistaken as a malware attack, and Norton could be launching a scan to check for malware after it restarts nsbu.exe.  This scenario is entirely speculation on my part, but if you're trying to troubleshoot with NPTP disabled it might make it more difficult to isolate the trigger for your disk thrashing.

I recall an issue a few years ago where several users had background disk defrags running constantly in the background and thrashing their hard drive - see BugOutMachine's NIS 2012 - Optimization function will not stop "running" for one example.  If these users went to Performance | Graphs | Events they could see the these defrags (Optimizer tasks) running every day or so.  I can't recall the exact cause but some users noticed a setting for the Disk Defragmenter (Settings | Task Scheduling | Automatic Tasks | Disk Optimization) or Idle Time Optimizer (Settings | Administrative Settings | Idle Time Optimizer) would re-enable itself after being disabled, and a deep wipe and reinstall of Norton eventually solved the problem.  Once a disk defrag is scheduled to run the task can't be stopped until the defrag has run to completion so the disk thrashing can go on for hours even after the task is disabled.

NS Performance Graph Optimization Edited 24 Sep 2017.png

I'm not suggesting this disk defrag bug has returned, but it's just one example of how a problem with a background task can be monitored with the Performance Graphs. Even clicking inside the CPU Usage graph at Performance | Graphs | Usage | CPU tab can sometimes show you if some third-party software (blue peaks) that is not fully trusted by Norton is triggering periods of high of CPU consumption by Norton (yellow peaks) because Norton is "waking up" to monitor "suspicious" activity on your computer.

NS Performance Graph CPU Usage 24 Sep 2017.png

------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.3.0 * NS Premium v22.10.1.10 * MB v3.2.2

The problem with that is when the system gets bogged down by the disk usage, opening the Norton UI will take 10 mins or longer, in fact right clicking on the tray icon is unresponsive as well.  I may have to keep the Background Tasks window open at all times for the time being to see if any tasks are running when the disk usage is occurring.  When I mean I kill the service, I open Task Manager to the Processes tab and go down to the Norton Security entry with the "+" sign and kill that which makes the Norton tray icon disappear and after about a minute the service is restarted automatically and the Norton tray icon reappears and everything is normal until it uses the disk again.  Yes, the Norton Tamper Protection is turned off for this particular reason so I dont have to reboot Windows every time Norton starts using the disk hard.

Pcloverxp:

...I don't know if all this performance problems are related to NCW or not as when I kill the Norton Security service it will then restart and after maybe 5 mins or so, the disk will start running constantly again until I kill the service again.

Hi Pcloverxp:

Open your Norton Tasks window at Settings | Administrative Settings | Background Tasks | Configure and then check during a period of high disk activity to see if a specific task like a disk defrag (e.g., Disk Optimizer, Insight Optimizer, etc.) or Full System Scan is running.  Most of these background tasks will pause when you take your system out of idle mode and then attempt to run to completion the next time your system goes back into idle mode.  You might have to temporarily adjust your Windows power settings so your screen doesn't turn off or activate your screen saver while your system is idle.

NS Background Tasks ALU Running 23 Sep 2017_0.png

When you say "kill the Norton Security service", do you mean the main instance of nsbu.exe owned by SYSTEM (the instance that is responsible for your real-time protection) or the secondary instance of nsbu.exe owned by the USER (the instance that manages lower priority tasks like the NS graphical user interface and background tasks)?  Is Norton Product Tamper Protection still enabled when you try to kill nsbu.exe?

PE nsbu_exe Under SYSTEM 23 Sep 2017.png ------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.3.0 * NS Premium v22.10.1.10 * MB v3.2.2

At the moment I have only one page of NCW entries with about six entries with "Pending" as their status.  I don't know if all this performance problems are related to NCW or not as when I kill the Norton Security service it will then restart and after maybe 5 mins or so, the disk will start running constantly again until I kill the service again.  Restarting Windows doesn't fix this as after the system reboots shortly afterwards Norton will cause the disk to run and will do so for about half an hour.

password_password:

...could you post some entries from your NCW log. Maybe you are being flooded with some action that Norton is over-reporting and we can narrow things down a bit ourselves.

 ...or perhaps the Norton employees following this thread could just jump in here and clarify the function of diStRptr.dll (Stat Reporter Job Worker) and diStRptr.dat.  No one from Norton has even confirmed that these files have any connection to Detailed Error Data Collection and Norton Community Watch (NCW) or whether a backlog of unsubmitted NCW reports could cause the type of disk thrashing that OP Pcloverxp is observing.
------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.3.0 * NS Premium v22.10.1.10 * MB v3.2.2

Pcloverxp:

Well, guess what?  After that update, the system was fine for a few days then BAM it started using the disk hard once again and my distrptr.dat grew from 28 KB to 11 MB in 2 days.  I completely uninstalled NS and deleted everything in the Norton folder in C:/ProgramData folder.  I reinstalled with a 22.10.1.10 installer and ran LiveUpdate to install all the updates.  Once again It was fine for 2 days and then today the disk is running hard.  The distrptr.dat file is now 28 MB and the disk is still running hard after 30 mins and I can't open the Norton UI to turn off Tamper Protection so I can terminate the Norton process and now have to do a hard reboot to get my system back.  I never had any issues like this with 22.9 and I think 22.10 is a bad release all around (for me anyway) and they should go to the next release like 22.11 or something.

If you have it happening again and have you system usable (maybe wait long enough and/or unplug from the internet), could you post some entries from your NCW log. Maybe you are being flooded with some action that Norton is over-reporting and we can narrow things down a bit ourselves.

I've had this issue for well over a year. This computer was new in January, and I have had to do my workaround in March, May, and September. I turned NCW off for a week and had no issues. Turned it on last Friday, and am not having issues. Yet.

Well, guess what?  After that update, the system was fine for a few days then BAM it started using the disk hard once again and my distrptr.dat grew from 28 KB to 11 MB in 2 days.  I completely uninstalled NS and deleted everything in the Norton folder in C:/ProgramData folder.  I reinstalled with a 22.10.1.10 installer and ran LiveUpdate to install all the updates.  Once again It was fine for 2 days and then today the disk is running hard.  The distrptr.dat file is now 28 MB and the disk is still running hard after 30 mins and I can't open the Norton UI to turn off Tamper Protection so I can terminate the Norton process and now have to do a hard reboot to get my system back.  I never had any issues like this with 22.9 and I think 22.10 is a bad release all around (for me anyway) and they should go to the next release like 22.11 or something.

Pcloverxp:

Well, so then it appears that my disk usage problem and the Norton Peek issue were caused by the same bug and the patch fixed both issues, killing two birds with one stone so to speak.  I checked the distrptr.dat file and its only now 27 KB and have NCW and Error Reporting set to ON.  During this whole issue I never had enabled or played with Norton Peek and it never showed up at all for me.

From the sound of it you NCW submission cache got cleared somehow. Successful submission, relaunching the product (update did that), or coincidence? As far as documented/discussed fixes released to fix the issue, there were none as far as I know.

Well, so then it appears that my disk usage problem and the Norton Peek issue were caused by the same bug and the patch fixed both issues, killing two birds with one stone so to speak.  I checked the distrptr.dat file and its only now 27 KB and have NCW and Error Reporting set to ON.  During this whole issue I never had enabled or played with Norton Peek and it never showed up at all for me.

Tony_Weiss:

The product update downloaded via LiveUpdate is to address the Norton Peek issue. Thanks.

In that case it's seems that this user's issue resolved spontaneously this time. There was no attempted fix released at this time? (I guess)

Last I checked NCW doesn't seem to have limits on it as to how many samples to collect for submission.

If you are collecting water[malware/non-malware data points] samples at random locations and find yourself in the ocean[computer with tens of thousands of times more potential samples than you expected to ever see] don't take a "small" 64 billion gallon[enough to bog a computer down] sample of it.