Crash report for NIS2013 WEB component

Norton Security | Norton Internet Security
1

The problem is still the same with random browser crashes from a NIS2013 WEB component (usually when displaying URL safety level on Google search result pages). This happens randomly but the evidence shows it's a bug in SYMHTML.DLL:

 

Descrizione

Percorso dell'applicazione che ha generato l'errore: C:\Program Files (x86)\Internet Explorer\iexplore.exe

 

Firma del problema

Nome evento problema: BEX

Nome applicazione: iexplore.exe

Versione applicazione: 9.0.8112.16457

Timestamp applicazione: 50a2f9e3

Nome modulo con errori: SYMHTML.DLL_unloaded

Versione modulo con errori: 0.0.0.0

Timestamp modulo con errori: 507f1f1f

Offset eccezione: 5087b179

Codice eccezione: c0000005

Dati eccezione: 00000008

Versione SO: 6.1.7601.2.1.0.768.3

ID impostazioni locali: 1040

Informazioni aggiuntive 1: dda7

Ulteriori informazioni 2: dda7faddadee69062442018f466385bb

Ulteriori informazioni 3: 2e18

Ulteriori informazioni 4: 2e18a0eebff94ba036fd861e451fdeb5

 

Ulteriori informazioni sul problema

ID bucket: 50

 

If I disable Symatec plugin from IE9 it goes back to be rock stable. I run IE9 in protected mode, UAC at max level.

2

There have been issues with IE9. Have you made sure you have all Windows updates installed?

 

Be sure you have run LiveUpdate manually a few times, rebooting as necessary, until no updates are available.

 

Try taking IE9 out of protected mode to see if that makes a difference.

 

 

 

3

The problem is still the same with random browser crashes from a NIS2013 WEB component (usually when displaying URL safety level on Google search result pages). This happens randomly but the evidence shows it's a bug in SYMHTML.DLL:

 

Descrizione

Percorso dell'applicazione che ha generato l'errore: C:\Program Files (x86)\Internet Explorer\iexplore.exe

 

Firma del problema

Nome evento problema: BEX

Nome applicazione: iexplore.exe

Versione applicazione: 9.0.8112.16457

Timestamp applicazione: 50a2f9e3

Nome modulo con errori: SYMHTML.DLL_unloaded

Versione modulo con errori: 0.0.0.0

Timestamp modulo con errori: 507f1f1f

Offset eccezione: 5087b179

Codice eccezione: c0000005

Dati eccezione: 00000008

Versione SO: 6.1.7601.2.1.0.768.3

ID impostazioni locali: 1040

Informazioni aggiuntive 1: dda7

Ulteriori informazioni 2: dda7faddadee69062442018f466385bb

Ulteriori informazioni 3: 2e18

Ulteriori informazioni 4: 2e18a0eebff94ba036fd861e451fdeb5

 

Ulteriori informazioni sul problema

ID bucket: 50

 

If I disable Symatec plugin from IE9 it goes back to be rock stable. I run IE9 in protected mode, UAC at max level.

4

Yes, system is perfect. NIS2013 fully updated. Very expert user here who helps other users with Windows on forums.
Installation, IE9 etc. fully updated and perfectly working.
Randomly after a Google search passing the mouse over the Norton safe exploration icon it simply crashes pointing to a problem with symHTML.dll (I have version 7.2.0.31) and hence the browser plugin for Norton Safe Web.
If I simply disable the Symantec feature and/or that IE plugin everything goes back to normal and the browser very stable.
If some of symante tech-guys want I can provide a better log with windbg etc.
I like that feature and I don't want to disable it because it makes web browsing unstable :(

 

P.S.

Can't live without protected mode ;) web browsing would be very unsafe...

5

I understand your need for Protected mode, but can you try disabling as a troubleshooting step? This could help the symantec engineers diagnose the problem.

 

 

 

6

Thank you for your help.

Ok, I'll do some tests... the problem is that the crash is totally random.

I doubt it can be related to IE's PM and Integrity Levels... but I'll check this too.

 

All crashes have in common 1 thing though: they happen after a Google search, exactly when I click on a link from the Google list (with the Norton Safe Web icon aside). Must be something connected to that NIS2013 feature... Unfortunately they are quite random as I said. I'll try to find a reproducible pattern and use also the Symantec Tool https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?docid=kb20080507162141EN_EndUserProfile_en_us&lg=en&ct=us&product=home&version=current&pvid=f-home to help Symantec guys investigate the issue...

 

Last one just today:

 

Firma del problema

Nome evento problema: BEX

Nome applicazione: iexplore.exe

Versione applicazione: 9.0.8112.16457

Timestamp applicazione: 50a2f9e3

Nome modulo con errori: SYMHTML.DLL_unloaded

Versione modulo con errori: 0.0.0.0

Timestamp modulo con errori: 507f1f1f

Offset eccezione: 59d1b179

Codice eccezione: c0000005

Dati eccezione: 00000008

Versione SO: 6.1.7601.2.1.0.768.3

ID impostazioni locali: 1040

Informazioni aggiuntive 1: dda7

Ulteriori informazioni 2: dda7faddadee69062442018f466385bb

Ulteriori informazioni 3: 2e18

Ulteriori informazioni 4: 2e18a0eebff94ba036fd861e451fdeb5

 

Ulteriori informazioni sul problema

ID bucket: 50

 

Notice they are all identical (same DLL, offset etc.)...

7

A couple of other things to try.

 

Have you run a full system scan with Norton in safe mode?

 

I would suggest a second opinion scan using the FREE version of Malwarebytes. You can find it here http://www.malwarebytes.org/products/malwarebytes_free/

 

Have you tried clicking on Support - Get Support to allow Autofix to check your Norton installation?

 

 

 

8

Yes, nothing is wrong. NIS says install is ok. System (except this prob) is rock stable. Obviously I have no infections or whatsoever, system safe and checked also with other tools like the one you mention and HITManPro... Consider that I'm an advanced user with a certain knowledge in secuirty issues too (in fact I set also UAC at max level on Win7, browse the WEB only with IE9 or Chrome because of their sandbox, usually have Flash player deactivated, Java browser plugin disabled etc. etc.) so belive me when I say my system is safe and have no other crashes or BSOD, never.
Except this little problem since I in stalled NIS 2013 and enabled the Safe Web component.
As I said the clues point to that feature because they always (but totally randomly) happen after a Google search when I click on a link from the list with the NSW icon aside.

When I disable all Norton plugins for IE and/or disable the Norton Safe Web these crashes disappear.

It's just a random IE plugin crash. Something in the code of the symHTML.dll freeing already free mem or things like that....

The fact is that I like this feature and I don't want to renounce this, so I still hope for a fix in the next NIS2013 updates ;)

 

I'll try also to disable other IE plugins (but I "use" just Flash player, fully updated, and Speckie), maybe there is a strange conflict...

9

...mmh, after some other crashes and tests (still random) the clues show it's a DEP mem allocation issue with Norton Safe Web component....

Last time it reported an error like this (please, ignore the pic comes from another thread with IE8. The error is the same):

http://static.spiceworks.com/attachments/post/0011/1793/IE_crash2.jpg and as always the crash pointed to the same DLL:

 

Firma del problema

Nome evento problema: BEX

Nome applicazione: iexplore.exe

Versione applicazione: 9.0.8112.16457

Timestamp applicazione: 50a2f9e3

Nome modulo con errori: SYMHTML.DLL_unloaded

Versione modulo con errori: 0.0.0.0

Timestamp modulo con errori: 507f1f1f

Offset eccezione: 57e4b179

Codice eccezione: c0000005

Dati eccezione: 00000008

Versione SO: 6.1.7601.2.1.0.768.3

ID impostazioni locali: 1040

Informazioni aggiuntive 1: dda7

Ulteriori informazioni 2: dda7faddadee69062442018f466385bb

Ulteriori informazioni 3: 2e18

Ulteriori informazioni 4: 2e18a0eebff94ba036fd861e451fdeb5

 

Ulteriori informazioni sul problema

ID bucket: 50

 

10

I'm sure the last thing you like to hear is to reinstall a product. But, I think this is the next step in the troubleshooing

 

A rather painless way is using the Norton Removal and Reinstall tool.

 

Download the Norton Removal and Reinstall Tool from here   www.norton.com/nrnr
If you use Identity Safe, backup/export your data. Use the CSV format for compatibility.
Run the Norton Removal and Reinstall Tool.
Reboot.
Run LiveUpdate manually a few times, rebooting as necessary, until no updates are available.
Try to log into your Identity Safe. If you can, you are done. If not, Import your Identity Safe data.

 

 

If that does not fix things, you could do a more thorough removal with the Norton Removal Tool.

 

Download the Norton Removal Tool from here   www.norton.com/nrt
If you use Identity Safe, backup/export your data. Use the CSV format for compatibility.
Uninstall your Norton product with Windows control panel.
Reboot.
Run the Norton Removal Tool.
Reboot.
Log into your Norton Account from here   www.account.norton.com
Click on the Download button beside your current product subscription. This will download and install a preactivated copy of your product.
Run LiveUpdate manually a few times, rebooting as necessary, until no updates are available.
Try to log into your Identity Safe. If you can, you are done. If not, Import your Identity Safe data.

 

 

Let us know what happens if you try either option.

 

 

 

 

11

No it's not an install issue... I already cleaned up everything with the Removal Tool + full reinstall but nothing changes: still random crashes like those posted.

"Good" news anyway, since yesterday I've disabled another IE plugin: Speckie and I've got no more crashes (no changes to Norton) so it could be a conflict between these 2 plugins... Still strange the DEP crash/kill reports symHTML.dll as culprit.

For the next days I'll still test without any other plugins and report back here the results...

 

(I'm also in touch with the excellent Speckie plugin author)

12
LucaLongone wrote:
Still strange the DEP crash/kill reports symHTML.dll as culprit.

 

 

(I'm also in touch with the excellent Speckie plugin author)

 

 

I'm not a programmer, but more than one program may rely on the same Windows resources at the same time, and the confusion can freeze the computer. The crash report may list the last program/file to access the resource.

 

 

 

13

Yes, that’s why I wanted to disable everything else to be sure it’s a Norton-only component issue and… YES it is unfortunately.
Today it crashed the same way on a brand new test install + IE9 clean of any other plugin.

It’s definitiely a bug in the code of that component, when the dynamic library resource gets freed by normal Windows memory management system.

Do you know if tech experts from Symatech read this thread or should I email the support logs and the rest?

14

Norton employees do monitor these forums. You can tell them from their names in Red letters.

 

Do you have another browser installed that you can test with? Then we can see if it is an issue with just the Norton feature, or if it is an IE9 issue with Norton.

 

 

 

15

Ok, thank you.

Even if this an IE9-only bug I think it should be fixed: it's not a MS browser error, but a plugin defect. It is rock-stable without that Norton plugin.