My computer start freeze during booting today

Norton Security | Norton Internet Security
1

Hi!

 

My computer start freeze during booting today. It can be started only in Safe Mode. If I scan computer in Safe Mode no virrus will be found.


After many experiments I localized the error: If I manually deactivate Norton Antivirus (NAV service) in the Registry the computer start working.

 

If I enable NAV service the computer start freeze directly after booting. If I start repairing of Norton AntiVirus I get message from "Norton AutoFix": Error: 8504,101. The NAV service will be actevated and computer freeze: no keyboad, mouse or other input work.

 

I have Windows 7 Ultimate W64 with SP1and all last Windows Updates and the last Version of Norton Antivirus with last updates.

 

My hardware is Lenovo W510 with 24 GB RAM and 256 SSD.

 

I have to work currently in internet without any antivirus protection. So I need some solution of the problem: how I can bring Norton Antivirus working.

 

Thanks for advices.

 

Oleg

2

Do you now or have you ever had another security program on your computer? If so, you will have to remove it with the removal tool for that program.

 

What version of Norton Anti Virus are you using? Support - About.

 

 

 

3

Thanks for your answer and for the attempt to help me!

 

The terminology "security program" is too wide. I don't have any other virus scanner and the only firewall which I use is Windows Firewall.

 

Of cause I use additional "security program" like AdBlocker (web browser plugin), Outlook 2013 Spam filter, some drivers from Lenovo like finerprint scanner etc. I have Wireshark 1.8.0 installed on my computer some months before. I can update it to the last 1.8.3 version if required. I can continue... I suppose that no from instaled software should make problem to Norton AntiVirus. I didn't updated any from the software explicitly. I suppose that Norton AntiVirus made some silent updated 2 days before and I get problems after the next booting of computer (yesterday).

 

Yestearday some person from Semantic examined my computer using remore control. All his appempts to repare or to install the latest Vesrion of NortonAntivirus (NAV-ESD-20-1-1-2-EN.exe) after clean uninstalling of Semantec products bring my computer to freeze. I had to use always hard power off of computer to reboot it. He forwarded me to escalation manager (I hope I use correct name). Today somebody should contact me one more time.

 

Best regards

Oleg

4

A couple of things to try...

 

Do you use Nero burning software? There is an issue with a recent update to the BluRay components that has caused problems with Norton. If so, uninstall Nero, reinstall it but do not allow it to update.

 

This sounds like a new computer. They often come with trial versions of Security programs. Look through your Start Menu to see if there are any signs of this. Even a trial program would benefit from removal with the removal utility from that company.

 

Please let us know how the escalated support call goes.

 

 

5

Thanks your your interest for the problem and all your attempts to help me.

 

Sorry, but it's not not a new computer. I work on it (on the hardware) since 2,5 yeas. 4 months ago I upgrated my hard disk to SSD and reinstalled Windows 7 from Pro x64 to Ultimate x64. All 4 months I had no problems. Yerstaday morning I began to have described problems.

 

If I boot Windows 7 in Safe mode, start msconfig.exe and deactivete all non-Microsoft serveices and deactivete all startup programs the Antivirus software will be not deactivated. So If I boot Windows with really minimal Microsoft services and Norton AntiVirus the computer freeze in about 20 seconds after I see login screen. By the way It's not important whether I login or not, but login seems to make freezing more quickly.

 

If I activate all existing services and startup programs and deactivate Norton AntiVirus in registry manually (change Start value from 2 to 4) the computer start working all the time without any problem. I can't use msconfig.exe to deactivate VirusScanner so I deactivated it manually.

 

By the way I have no Nero burning software installed. I use "Alcohol 120%" to burn DVDs or to mount images. As I wrote before deactivating of all standard software with respect of msconfig.exe don't solve the problem. So I suppose that the reason of the problem is Norton Antivirus (I mean some of updates installed silent at Saturday).

 

Till now nobody from Symantec called me back. I waited some hours today morning and contacted Symantec myself per chat. It was about 6 hours ago. One promised me one more time to call me back in 3-4 hours. I am waiting till now for the callback...

 

Thanks again

Oleg

6

Just for info: I had now a long remote control session with one more person from Symantec. Many different attempts, but no success.

 

At morning I will be called by another person.

7
OlegKi wrote:

 

If I boot Windows 7 in Safe mode, start msconfig.exe and deactivete all non-Microsoft serveices and deactivete all startup programs the Antivirus software will be not deactivated. So If I boot Windows with really minimal Microsoft services and Norton AntiVirus the computer freeze in about 20 seconds after I see login screen. By the way It's not important whether I login or not, but login seems to make freezing more quickly.


 


Oleg

As this is an older Lenovo computer, did you use the Lenovo recovery to set up your new SSD?

 

Check to see if you have Rapidboot installed. There have been many issues with this to the point that Lenovo no longer uses it and recommends users remove it.

 

If this is not the problem, go back to your settings in msconfig. After disabling everything, start enabling a few at a time, reboot and see if it freezes. If it does, disable half again and test. If it does not, enable a few more, reboot and test.

 

When you identify the culprit, we can try to find the solution.

 

 

 

8

4 months ago I made clean installation on my computer without usage of Lenovo recovery. I don't use Rapid Boot.

 

The main problem with any experiments with Norton AntiVirus was the following. Norton AntiVirus was uninstalled during Support Chats (with remote control on my compuer). One used Norton_Removal_Tool.exe to remove all Symantec products. Every start of the installation program (NAV-ESD-20-1-1-2-EN.exe) followed to freezing of the system imediately after one could see GUI of setup. It hangs my computer even if I start it under builtin Administrator account or if I start setup on Windows booted in Safe mode.

 

I installed for the test purpose free Microsoft antivirus solution (Microsoft Security Essentials - KB2754295). It works without any problem on my computer.

 

After many experiments I do could able to install Norton Antivirus. I hope the most parts of the Software were successfully installed. I started installation inside of debugger. I started Visual Studio 2012 with elevated rights with parameter /debugexe (see here):

 

"C:\Program Files (x86)\Microsoft Visual Studio 11.0\Common7\IDE\devenv.exe" /debugexe NAV-ESD-20-1-1-2-EN.exe

 

After that I started debugging of the program. Visual Studio run debugged program in Windows Job. So all child processes (with exception of indirectly started services and device drivers) were running inside of the same debugging Job. The installation could go forward. I enabled Source Code Debugging to see more information which executable were loaded (the attempt of loading of debugging symbols from Internet take some time and one could see the name of executable or dll in the status bar). The last message which I could see was loading debugging symbols of InstCA.exe (from C:\Program Files (x86)\Norton AntiVirus\Engine\20.1.1.2). After that the computer freezed as usual. I suppose that some service or device driver which were started indirectly by setup after the step with InstCA.exe was the origin of hanging of my computer.

 

Now I have some (it could be not full) installation of Norton AntiVirus. At least 2 Services: "Norton AntiVirus" and "Norton Identity Safe" are installed. At least 12 device drivers which I could identified are installed on my computer too. Two from 12 device drivers (NAVENG and NAVEX15) are configured for manual start (Start 3 in registry).

 

Now my computer freeze again imediatly after booting and login. If I use msconfig.exe and disable all services (inclusive Microsoft services) and all startup programs the computer stay freezing at the next reboot. Even if I disable all services with respect of msconfig.exe some services still not disabled:

  • Group Policy Client
  • Norton Antivirus
  • Norton Identity Safe
  • RPC Endpoint Manager
  • Task Scheduler

Even with such small number of services (and some device drivers which can't be managed by msconfig.exe) my computer become freezed.

 

If I disable (Start 4) or configure to start manually (Start 3) Norton Antivirus (NAV service) then my computer start working.

 

If I enable all existing services and startup programs and stay Norton Antivirus be manually started my computer work without any problem.

 

If I start the service Norton Antivirus the computer freeze imediately.

 

I spend many time in different experiments. I am sure that either Norton Antivirus or some other programs (inclusive drivers) which it starts is the origin of freezing on my system. Even if some conflicts exist with some other software installed on my computer it must be really small subset of drivers which Microsoft don't want to deactivate in Safe mode.

 

I have to make my main job and continue to develop software for my customers. I will wait till Symantec contact me later today. I will inform in the thread everybody about the progress of investigation of the problem.

 

Best regards

9

One other possibility.

 

As you are a developer, do you use Tortoise SVN software? There is a know issue that is fixed by updating Tortoise.

 

Let us know.

 

 

10

Thanks for the advice, but I have no Tortoise SVN software installed on my computer.

11

Since your testing, have you fully removed Microsoft Security Essentials? If not, it could be conflicting with Norton.

 

 

12

Microsoft Security Essentials was removed in my tests. By the way if Microsoft Security Essentials is installed the setup of the current version of Norton AntiVirus detect it and uninstall it before the main installation.

 

Therefore, Microsoft Security Essentials isn't my problem. I install Microsoft Security Essentials at the end of my experiments because I have to work on my computer and I use (like the most other people) Internet.

 

I spend so many time in the investigation of the problem, that it would be much cheaper for me to by different other AntiVirus programs existing on the market.

 

By the way, nobody from Symantec called me yesterday as promised. :-(

13

If you are willing as a diagnostic step, can you uninstall NAV 20 (2013) and reinstall NAV 2012? You will need to use the Norton Removal Tool to do a thorough uninstall.

 

Download the Norton Removal Tool from here   www.norton.com/nrt

Download NAV 2012 from here   www.norton.com/nav12
Uninstall your Norton product with Windows control panel.
Reboot.
Run the Norton Removal Tool.
Reboot.
Run the NAV installer.
Run LiveUpdate manually a few times, rebooting as necessary, until no updates are available.
Click on Settings and look for Updates, and a setting for Automatic Download of New Version. Turn this setting off, to stop downloading of 2013 for now. You can always upgrade at a later date. I use NIS so not sure what or where the settings are.

 

Let us know if this helps.

 

 

14

Thanks for the advice!

 

Unfortunately setup of NAV 2012 (NAV-ESD-19-8-0-14-EN.exe) has the same problem: the computer freeze imediately after I can see the first dialog of the setup.

 

Nobody from Symantec contacted me till now.

 

P.S. I wrote before that Microsoft Security Essentials works without any problem on my computer. I tried today Kaspersky AntiVirus 2013 (30-days trial version). It works also without any problem till now.

15

There is something interfering with Norton, and this usually is another A/V program or some malware.

 

Have you been able to run any full system scans with whatever A/V you have now, in Safe Mode?

 

I would suggest a second opinion scan using the FREE version of Malwarebytes. You can find it here http://www.malwarebytes.org/products/malwarebytes_free/

 

 

16

I scanned my computer with respect of Norton AntiVirus, Kasperski and Microsoft scanner. No problems was found.

 

I beleave that the problem could be some other hardware or software problem, but my problem is that the total freezing of computer don't allow my any analyse. All attepmpts (with Process Exploreres started in boot logging mode for example) gived me no help.

 

I will probably to make Ghost image of my hard disk as full backup of the system and will try to install on the same computer my operation system one more time. Because I want not only help Symantec, but mostly help myself, I will probably install Windows 8 in the case.

 

Regards

17
OlegKi wrote:

 

I will probably to make Ghost image of my hard disk as full backup of the system and will try to install on the same computer my operation system one more time. Because I want not only help Symantec, but mostly help myself, I will probably install Windows 8 in the case.

 

Regards

Your patience and help will be appreciated.

 

Have you run 'sfc /scannow' from an administrative command prompt? This might fix Windows problems without having to reinstall.

 

A clean install of the OS is something none of us want to do but sometimes is a necessary evil with a Windows system.

 

As there are some teething pains with Win 8, you might want to stay with the OS you now have for the first test.

 

Install the OS and all drivers, then Norton. Then one at a time, install the other software and test after each program. That way you can isolate a conflicting program, or if you do not see the problem again, it probably indicates a problem that occured with your Windows installation.

 

18

Hello!

 

The usage of run 'sfc /scannow' bring no new results, so I didn't wrote anything before. No person from Symantec called me more.

 

Nevertheless I didn't reinstalled my computer (I hadn't found just the time for it). Today I had a new idea and solved the problem myself. I decide to describe the solution here to help other people who could have the same problems.

 

The reason on my problem was debugging setting in boot.ini. I started some developer tool from Windows DDK and it changed silently my boot.ini.

 

For understanding: if somebody write kernel mode driver he have problem to debug the driver. The common solution in the way is the usage of remote debugging from another computer connected per COM port, 1394 port or USB port. In the case one includes in the code of driver starting/connection to debugger. The computer will be freezed at the time till the execution will be continued with respect of the corresponding command ("GO") executed inside of the kernel debugger running on the remote computer.

 

The problem is that both the final code of Norton AntiVirus (NAV) and the code of Setup have code which initialize remote debbugging session. So if there are exist debugging setting in boot.ini the computer freeze on starting of Norton AntiVirus service or on starting of Norton AntiVirus Setup.

 

One can solve the problem mostly easy using msconfig.exe. One need just start it, need choose "Boot" Tab and to click "Advanced option" button. In my case I had

 

NAV1.png

 

I unchecked "Debug" field and rebooted computer with new settings:

 

NAV2.png

 

I hope that my post could help other people who could have the same problem. I want remind that changing of the corresponding setting of boot.ini could be made indirectly. So the user of the computer could don't know about the changes.

 

In my opinion Symantec should consider to remove the part which connects to debugger (and freeze the computer if no remote debugger are connected) from the release version of the product (and from setup too). If needed one could introduce some additional registry value which could enable remote debugging, but one should not do this per default.

 

Best regards
Oleg

 

[Edit: Removed hyperlink to a webpage with personally identifiable information to conform with the Participation Guidelines and Terms of Service]

19

Great detective work.

 

Has this change been running smoothly for a few days now?

 

Not sure why the Norton installer would set the debug value, but who knows why anything is done in Windows.

 

Thanks for posting this.

 

 

 

20

Everything work stable. Absolute no problem. Thank you for asking!

 

For clarification: Norton installer didn't set the debug value in boot.ini. The changes was made by another program.

 

The problem in Norton AvtiVirus and in Norton installer is following. It's release code contains call of debugger. It's the function like DbgBreakPoint(), KdBreakPoint(), DbgBreakPointWithStatus(), DebugBreak() or something like that. The developers of the kernel mode drivers used the API in the debug version of the code to start debugger. Typically one use virtual machine now to debug drivers. You can read here for example. One of the simplest form to debugger the driver is including one from above API in the debug version of the code. The entire operating system freezes until the kernel debugger allows execution to resume. It's practical for debugging, but it's wrong to leave such calls in release version of the product.

 

So how I understand the problem, some DLL, EXE or SYS used by release version of Norton AvtiVirus and Norton Installer still have call of DebugBreak(), DbgBreakPoint() or close API. It's a bug which was the origin of my problem. If would be great if you would forward the problem to Symantec developers (if you have any contact) or to some other place in Symantec support which would take the problem seriously.

 

Best regards

Oleg