Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.
This is a known problem. It is referred to as the Zombie problem or where zombie processes are left running.
There is a workaround which, with the exception of Firefox, has resolved those users reporting zombie processes. Go here please.
BTW, thank you for posting your system details, this always helps.
Let me know when your problem is resolved please.
Thanks for the prompt reply. I did what was requested to eliminate the Zombie problem. But, it did not work and the following error message appeared: "DLLUnregisterServer in buShell.dll failed. Return code was: 0x80070005."
Please advise.
MAF
Most people do not have a problem with this. You are I think the 2nd. It indicates an access issue. Look here
You should enter 0x80070005 in the search field for this forum and look at other posts.
Also go here
Basically, try again in "safe" mode. Reboot machine, F8 select safe mode.
I checked out both links, and tried in Safe Mode...to no avail - even as Administrator.
The use of the ProcessMonitor (which replaced RegMon) did not show any requests that were denied.
Any ideas?
MAF
curious indeed. And the code was the same in safe mode. I cannot understand why you would not be able to unregister even in safe mode.
In safe mode can you copy the file to another directory?
If yes, can you rename the file in its original directory?
Forget process monitor, please get Procexp Process Explorer. Return to safe mode.
then Click Find in Procexp menu bar, then find handle or DLL
enter bushell.dll.
what results do you get please?
I cant test this right now, so if you cannot run procexp in safe mode, please run in normal mode, before running any other programs.
i.e. after reboot.
Another idea, can you please search for bushell.dll across your hard drive. Lets make sure there is not more than one version and we are trying to unregister the wrong one.
If I have another idea, I'll let you know.
Ok, another idea to follow after all my previous reply.
Please attempt to register
regsvr32 bushell.dll from the backup directory of course.
Please advise error code it produces.
Thanks for your help. Here are the replies to your questions:
1. In safe mode can you copy the file to another directory? > Yes.
2. If yes, can you rename the file in its original directory? > Yes.
3. Forget process monitor, please get Procexp Process Explorer. Return to safe mode, then Click Find in Procexp menu bar, then find handle or DLL - enter bushell.dll. what results do you get please?
[System Process] 168 DLL C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll
procexp.exe 168 DLL C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll
iexplore.exe 440 DLL C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll
explorer.exe 1428 DLL C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll
4. I cant test this right now, so if you cannot run procexp in safe mode, please run in normal mode, before running any other programs. i.e. after reboot. > Ran in safe mode without problems.
5. Another idea, can you please search for bushell.dll across your hard drive. Lets make sure there is not more than one version and we are trying to unregister the wrong one. > There is only one copy of buShell.dll on hardrive, and it is located in C:\Program Files\Common Files\Symantec Shared\Backup\.
6. Ok, another idea to follow after all my previous reply. Please attempt to register regsvr32 bushell.dll from the backup directory of course. Please advise error code it produces. > The same error appears as when attempting to un-register.
Any ideas?
Once again, thank-you for your help.
MAF
Please bear with me, the information is useful if a little surprising. I want to run a test and will then come back.
As you know I cannot explain your situation. I would suggest you rename bushell.dll, and reboot in normal mode, and retest if the original zombie problem has gone away. I have tried this once this end, I had no issue. I do not think you should get any complaining messages. It is far from ideal, but it would be a shame to spend a lot of time to get bushell unregistered only to find that it then does not work.
If it does work, then you will not be able, like others, to turn bushell on and off without rebooting. If necessary you could ask Symantec employee to advise whether renaming the file has any further consequences rather than deregistering.
Going back to your last info. Procexp clearly only sees one copy, and yet the hook is correct into both IE and explorer.
If I didnt ask before, did you install any registry management programs and did you turn off sym protect.
Congratulations. Renaming buShell.dll (in Safe Mode), then rebooting in Normal Model worked. The Zombie is history.
Norton 360 is not preventing any processes from shutting down, and is working well (i.e., with Backup turned off). Just to make sure, I have re-booted a couple of times and ran a complete scan with Norton 360. All is well.
Thank-you for your help.
Renaming seems to be an acceptable alternative when and only when bushell.dll cannot be deregistered. The effect of renaming the file, rather than deregistering it, is that Explorer and Internet Explorer will continue to attempt to load the extension and when they cannot find it (because it is renamed) they will continue on.
For the avoidance of doubt, I would like to state that I do not recommend removing bushell.dll but only renaming it. This is a workaround, and if a fix is produced, it may be necessary to reinstate bushell.dll first.
My thanks to Matt Boucher for his valuable input as always.
Hopefully in a future version of Norton 360 the Zombie issue will be resolved. Until then we stick to the band-aid.
Add me to the list of people that can not unregister even in Safe Mode. I get the same error code everyone else gets and the zombie processes have slowed my computer to a crawl. I am re-booting at least once or twice a day. I work for a software company so this really doesn't help my workflow. However, I am able to supply a decent amount of information and would have no problem sharing my desktop to let people see what is going on if it would help! I am running 360 2.0 with Windows XP media Center SP3
My subscription comes up in less than a month and I am afraid I will be going elsewhere unless I can get the issue reliably resolved.
Kim
PS. On the Process Explorer, I have the same 4 as above AND an hp file (hpqste08.exe) also involved:
I am not clear here. Did you rename the file as suggested in my earlier post in this thread?
The renaming finally worked!!!!!!!!! THANK YOU!!!! I have been searching for an answer to this problem for months. I actually replied to an earlier thread before I read your renaming idea. Even though I have several computers with different operating systems on them, this is the one I use, and I haven't been able to access about half of my programs on it without re-booting for a long time.
I do intend to e-mail tech support and see what the impact of re-naming that file is, and speaking for myself, I know I want as much information as possible when troubleshooting a bad file or process, which is why I offered viewing of my desktop.
However, all is not completely well. As I look to my task manager, I now have 5 instances of LUCallBack Proxy running-so something is hung there. But it isn't the major memory hog that some of the Adobe or Video programs that I have are. And I hope it doesn't corrupt the update if I close them out, like my Outlook Database does. (Heaven forbid I ever loose that!)
Haven't tried re-installing Firefox yet, but will keep checking in here to see what is going on with this.
Glad that worked. Dont forget to reboot, and run luall. The LUCallBack Proxy should fall away if the system is uptodate and there are no liveupdate sessions in progress etc. There is no impact on renaming the file except that a call will be made on a file that does not exist. You really do not need to worry about the renaming.