NIS 2011 - Unable to run scan + error on reboot/shutdown:

Norton Security | Norton Internet Security
1

Hello,

 

Today having attempted to run a quick scan and full system scan multiple times I found nothing happening. I have previously experienced this behaviour (although for other reasons I ended up formatting then anyway and so never got to the bottom of it). Since nothing was happening, although Norton still displayed as 'secure' I attempted to reboot, which then resulted in an error message pop up, Norton totally vanished and the 'force shut down' option popped up blocking the error message. Unfortunately the PC shut down to fast for me to read the message so I have no idea what it said.

 

Norton appears to be functioning normally at the moment, but my main concern is what might have caused this behaviour and also if it is possible Norton (particularly the firewall) was not functioning prior to my attempt to run the scan.

 

To try and determine whether Norton was working prior to my attempt at a scan, I had a look through the history.

 

Norton's security history shows 'No User Logged in' for 13:02, which normally is the reboot/shutdown time, though given Norton vanished prior to the shutdown I have no idea what that would mean.

 

My last definite action before all this was a scan at 11:59. Between 11:59 and 13:01 there a whole range of entries, including:

 

1) programs entering/exit full screen mode

2) programs accessing the internet 

3) rule default block epmap  (last one is at 12:39

4) Using antiphising definitions version 20111026.006 (at 13:01 only).

 

Now to my rather unknowing mind that seems to suggest Norton (and it's firewall) was working right up until 13:02, and so I shouldn't need to worry about anything nasty sneaking in during that time? I'm primarily concerned with figuring out if it's possible something could have gotten in (IF the firewall was not working) so I can just get the pain of formatting over with now rather than leave it and find there is something later.

 

So in summary:

 

1) What could have caused the odd non-scanning behaviour/error on shutdown/norton to vanish

2) Should I be concerned/was Norton/Firewall working up until the error popped up based on the history logs.

 

Thanks.

 

2

Thanks for your reply, I have checked the event viewer and the only things I've found that may be relevant are the following:

 

In Windows Logs - System at 13:02:17 on the 26th.

 

Application popup: ccsvchst.exe - Application Error : The instruction at 0x6ae863fe referenced memory at 0xff05e1fa. The memory could not be read.

Click on OK to terminate the program

 

In Windows Logs - Application, on the 25th at 20:35:06

 

Faulting application name: ccSvcHst.exe, version: 10.1.1.16, time stamp: 0x4daa1893 Faulting module name: AVPAPP32.DLL, version: 18.6.0.29, time stamp: 0x4dba03e8 Exception code: 0xc0000005 Fault offset: 0x000171db Faulting process id: 0x7ac Faulting application start time: 0x01cc9317c72be9fe Faulting application path: C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe Faulting module path: C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\18.6.0.29\AVPAPP32.DLL Report Id: 70d89633-ff40-11e0-8c44-001e8c7dba2a

 

(I have no idea if the second is relevant at all, I merely include it since it is a norton error less than 24 hours prior to the other one and because this also occured on shut down, however there was no pop up/error message displayed at the time)

 

Also to clarify on my first post, by attempting to run multiple scans I meant roughly the following:

 

Click run quick scan - wait 10-15seconds, nothing happened, clicked it again, wait 5-10 seconds, nothing, clicked full system scan, nothing, - rebooted.

 

Thanks.

3

I had a similar issue lately but I can't say it is the same because it happened on a dual-boot system.  It was a disc controller on my machine, which could be hardware related rather than software.  Try running Bluescreenview from Nirsoft.  It reads Windows dump files and may provide more info as to whether Norton files are the problem or just being affected by something else.  The download is near the bottom of the page.

 

http://www.nirsoft.net/utils/blue_screen_view.html 

 

There is another app called Appcrashview at the top of the page that could be interesting as well.

 

What operating system are you running and service pack level? 

4

Windows 7 64, Service Pack 1

 

However previously this (or something very much like it) occurred on Vista 64 on this PC as well as some other incidents a second PC running Windows 7 64 and a Laptop with 7 64 as well.

 

As you ask about something interfering with Norton files, is it possible therefore that even though it was logging security history up to the 'windows error' on shutdown, Norton may not have actually been working?

 

Or does the fact that it was still logging internet access etc = firewall etc was working as normal

 

5

If it was logging, it was working.  Best I can say without more info.

6

Unfortunately I haven't been able to get that program working right so I can't respond to that yet.

 

However tonight I got another error.

 

I ran live update, did a quick scan (it found tracking cookies and nothing else). Then Norton vanished. The sidebar display lost the 'secure' bar and greyed out the buttons, the NIS icon in the tray in the bottom right was still there but also vanished as soon as I moused over it. There was however no error message pop up when I hit reboot, Norton appears to have just totally shutdown immediately after the scan as the security history is:

 

Quick Scan 18:50

An instance of c:\Windows\SysWOW64\Werfault.exe is preparing to access the internet. 18:50

Firewall Enabled 18:52 (boot up)

 

Eventviewer had the following error log:

 

28/10 18:50:35

Faulting application name: ccSvcHst.exe, version: 10.1.1.16, time stamp: 0x4daa1893 Faulting module name: AVPAPP32.DLL, version: 18.6.0.29, time stamp: 0x4dba03e8 Exception code: 0xc0000005 Fault offset: 0x000171db Faulting process id: 0xb90 Faulting application start time: 0x01cc957d203a3f3d Faulting application path: C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe Faulting module path: C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\18.6.0.29\AVPAPP32.DLL Report Id: 5617c210-018d-11e1-b36e-001e8c7dba2a

 

Details

System

 

Provider

   [ Name]  Application Error     - EventID 1000

   [ Qualifiers]  0      Level 2      Task 100      Keywords 0x80000000000000  

EventData  

ccSvcHst.exe   

10.1.1.16   

4daa1893   

AVPAPP32.DLL   

18.6.0.29   

 4dba03e8   

c0000005   

 000171db   

b90   

01cc957d203a3f3d   

 C:\Program Files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe    C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\18.6.0.29\AVPAPP32.DLL    5617c210-018d-11e1-b36e-001e8c7dba2a

 

Obviously I'm guessing this is about as much use as the other two error reports, but no harm in posting it.

 

Thanks for any more advice anyone might have...

7

Hi Falco:

 

Have you tried running Check Disk (chkdsk) and System File Checker (SFC) as described here to see if there's a problem with your hard disk or Windows system files?  If you recently performed a disk defragmentation, it's possible that one of your Windows or NIS files (e.g., AVPAPP32.DLL) was moved into a bad sector on your hard drive and was corrupted.

 

I would also suggest that you try running an online One Click Support session (Support | Get Support) to see if NIS can detect and possibly fix any common problems with your NIS installation.

 

This doesn't apply to NIS Full Scans, but when the Insight Protection feature is turned on, NIS Quick Scans perform a traditional scan and an Insight Network scan simultaneously. The traditional scan uses the definitions delivered by LiveUpdate and stored on the local hard drive, and the Insight Network scan uses the latest definitions that are hosted in the Cloud on the Symantec servers.  If you turn off Insight Protection from the Main NIS GUI (or Settings | Computer Settings | Insight Protection | OFF) and re-boot your PC, do your Quick Scans run to completion when they don't have to connect to the Symantec servers?

 

NIS 2011 Insight Protection.jpg

 

 At this point, I might even consider performing a clean re-install of NIS 2011 per PapauZ's instructions here using the Norton Removal Tool just in case your NIS installation has been damaged somehow.

-----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 7.0.1
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

8

Thanks for your reply Imacri.

 

To answer your suggestions:

 

Check disk & System File checker came up with nothing.

One Click Support also found nothing.

Quick scans completed fine with Insight Protection Off.

 

However just to be clear, these issues aren't happening consistently whenver I try to scan, on the 27th it went all day without anything happening. In fact something has only gone wrong twice so far (not counting previous possible incidents).

 

As for a clean install of NIS 2011, well the PC was formatted barely 3 weeks ago after something much like this happened before. (Essentially, got new hard drives as the old ones were clicking like mad, formatted them and installed 7 64, installed NIS and then a couple of days later something a lot like the first error I posted about occured and thinking that maybe something got corrupted I decided to just re-format again since there was barely anything on the PC anyway at that point.)

 

One suggestion that has been raised is upgrading to 2012, but that might just muddle things/cause more issues given something is playing up somewhere already without introducing that into the mix. The other suggestion is, could running quick scan/live update too frequently (e.g every 30 min for 1-2 hours) cause Norton to go a bit...odd or should that have no effect at all.

 

Also re: AppCrashView from Nirsoft that was mentioned above, whilst Norton scans of it don't detect anything, file insight flags it as Bad.

9

Hello,

 

Today having attempted to run a quick scan and full system scan multiple times I found nothing happening. I have previously experienced this behaviour (although for other reasons I ended up formatting then anyway and so never got to the bottom of it). Since nothing was happening, although Norton still displayed as 'secure' I attempted to reboot, which then resulted in an error message pop up, Norton totally vanished and the 'force shut down' option popped up blocking the error message. Unfortunately the PC shut down to fast for me to read the message so I have no idea what it said.

 

Norton appears to be functioning normally at the moment, but my main concern is what might have caused this behaviour and also if it is possible Norton (particularly the firewall) was not functioning prior to my attempt to run the scan.

 

To try and determine whether Norton was working prior to my attempt at a scan, I had a look through the history.

 

Norton's security history shows 'No User Logged in' for 13:02, which normally is the reboot/shutdown time, though given Norton vanished prior to the shutdown I have no idea what that would mean.

 

My last definite action before all this was a scan at 11:59. Between 11:59 and 13:01 there a whole range of entries, including:

 

1) programs entering/exit full screen mode

2) programs accessing the internet 

3) rule default block epmap  (last one is at 12:39

4) Using antiphising definitions version 20111026.006 (at 13:01 only).

 

Now to my rather unknowing mind that seems to suggest Norton (and it's firewall) was working right up until 13:02, and so I shouldn't need to worry about anything nasty sneaking in during that time? I'm primarily concerned with figuring out if it's possible something could have gotten in (IF the firewall was not working) so I can just get the pain of formatting over with now rather than leave it and find there is something later.

 

So in summary:

 

1) What could have caused the odd non-scanning behaviour/error on shutdown/norton to vanish

2) Should I be concerned/was Norton/Firewall working up until the error popped up based on the history logs.

 

Thanks.

 

10

Hi Falco:

I downloaded and unzipped the AppCrashView.zip file from the NirSoft site at http://www.nirsoft.net/utils/app_crash_view.html and it works fine on my 32-bit Vista system without being flagged by NIS.  If Download Insight or File Insight flagged AppCrashView as a problem on your system, it's possible that your background idletime Norton Insight task hasn't been able to query the Symantec servers recently and download the latest trust ratings for the application.  Try doing a manual update by either clicking the Application Ratings link on your main NIS GUI or go to Performance | Application Ratings and then try to download and install AppCrashView again.

When you check the Last Run date of your background idletime tasks in your Norton Tasks window (Performance | Norton Tasks), do all your tasks appear to be running as scheduled?  For example, if you have idletime scans configured to run on a weekly basis (Settings | Computer Settings | Computer Scans | Idle Time Scans), has your Idle Full System Scan run in the past week?

 

Norton Insight Task.jpg

 

 

I don't know of any reason why the frequency of automatic LiveUpdates and Idle Quick Scans would be a problem.  There have been several reports in the forum in past week about users having problems with LiveUpdates (see GORPY1's post here for one example) but this appears to be related to an intermittent problem with connections to the Symantec servers and this shouldn't cause the type of Windows errors that you're seeing.

 

delphinium's suggestion that this could have something to do with a driver conflict or failure of your hard disk controller is sounding more and more likely.  You mentioned in message # 5 that you used to have 64-bit Vista on this machine before you upgraded to 64-bit Win 7.  Could you let us know the model of your PC as well as the original OS that came installed at purchase?  Does your PC manufacturer still provide software and driver updates for your model of PC that are compatible with 64-bit Win 7, or do you have to do all your BIOS, chipset, etc. updates manually now?

If you have an Intel chipset you can run a check of your drivers with the online Intel Driver Update Utility here - I think it works 64-bit as well as 32-bit Windows.  I wouldn't perform any upgrades at this point but the report may give you a quick snapshot of the state of your drivers.

You might still want to consider a clean re-install of NIS 2011 as I suggested in message # 8.  If NIS 2011 is behaving badly after a re-install that would indicate to me that the problem might be specific to your PC hardware/software configuration and not to NIS.

 

Edit:

 

Just an afterthought, but do you have any other security software like Malwarebytes' Anti-Malware, Spybot Search & Destroy, etc., running in real-time protection mode on this PC in addition to NIS 2011?

--------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 7.0.1
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS