Norton Community Watch Feedback / W7 PC constipated:

1mcrtd · December 2, 2013, 11:13pm

I have reported elsewhere in this forum about high NIS CPU usage coming up & sticking at about 8% on my W7 Desktop PC, eventually even after it is rebooted. I have shut down several applications in an attempt to see if one of them is causing this _new_ problem, which has been constant for nearly 2 & 1/2 days (almost 60 hours). No luck, so far.

My W8.1 Laptop does not have this problem with high NIS CPU usage.

One difference between the two PCs is that the W8.1 PC's Norton Community Watch "phones home" and submits a Feedback report soon after NIS creates one. However, the W7 PC has been constipated with several Norton Community Watch Feedback reports in the "Pending" status for about the same length of time that it has been stuck with 8% NIS CPU usage...about 60 hours.

Norton Community Watch being constipated on the W7 PC may or may not be contributing its new high NIS CPU usage problem, but to the folks at Symantec/Norton....why is it that the W7 PC's Norton Community Watch is not submitting reports for 2 &1/2 days when the W8.1 PC is submitting reports?

1mcrtd · December 5, 2013, 9:43pm

To the Symantec Norton employees who read this forum, here is a follow-up: The problem on my W7, SP1 64-bit PC with NIS CPU usage rising and running at 8 %...intermittantly continues and appears to be caused by what was explained earlier. Most Norton Community Watch reports are eventually submitted, as NIS is designed to do. But, every few days, the reporting process get stuck in a Pending status, and the reports are never submitted.

During NIS's repeated and failed attempts at NCW reports being submitted, the following random samples repeatedly appear in the NIS Firewall activities history:

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
12/5/2013 10:20:17 AM,Info,"An instance of \"C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities
An instance of "C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe" is preparing to access the Internet.

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
12/5/2013 12:53:04 PM,Info,"An instance of \"C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\symerr.exe\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities
An instance of "C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\symerr.exe" is preparing to access the Internet.

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
12/5/2013 1:18:35 PM,Info,"An instance of \"C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities
An instance of "C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe" is preparing to access the Internet.

---

This only happens on my W7, SP1 64-bit OS. Full system scans for antimalware, including scans with two other standalone applications, indicate no malware on the PC. And the only way I can get the high NIS CPU usage to stop running at 8% is to clear out the Norton Community Watch reports that are stuck in a Pending status, and to reboot the PC.

ispalten · December 6, 2013, 2:13pm

1mcrtd wrote:
Hello all,

FYI, I deleted the W7 PC's Norton Community Watch reports that had been stuck in a Pending status for over 2 & 1/2 days, which was also the same amount of time the PC was stuck at 8% NIS CPU usage. The PC was then rebooted (again) and has idled at 0% NIS CPU usage, occasionally rising to 1% usage with misc. PC activity, for more than one hour. So, the high NIS CPU usage problem may be fixed. We will see if future NCW reports get stuck in a Pending status again, and if that affects the NIS CPU usage percentage.

How do you 'delete' these tasks? My submission history shows it is 4 pages long. Only a few show submitted, a few more show waiting, and most are pending.

All are from 12/02/2013.

I did have the high hd I/O and tried the suggested fix which did sort of aleviate that problem, but it was also though I had a corrupted install and I needed to re-install. That high HD O/I (actually a workaround) was impossible to have set when ISS is first installed. Until the internet access list of programs is basically filled too many prompts and system slowdown on boot happened.

I do not have high CPU usage, at least not unless an idle scan is running though.

I don't know why the submissions are showing as pending for so many days, but I did turn off the community setting so I don't accumlate more. I guess if I deleted all the old ones and turn it on again I should be OK, but can't see how to do it?

FWIW, I'm on W8.1.

yank · December 6, 2013, 2:23pm

Hi 1mcrtd,

Just curious why you do not turn Community Watch Off if it is casuing high CPU useage?

1mcrtd · December 2, 2013, 11:13pm

I have reported elsewhere in this forum about high NIS CPU usage coming up & sticking at about 8% on my W7 Desktop PC, eventually even after it is rebooted. I have shut down several applications in an attempt to see if one of them is causing this _new_ problem, which has been constant for nearly 2 & 1/2 days (almost 60 hours). No luck, so far.

My W8.1 Laptop does not have this problem with high NIS CPU usage.

One difference between the two PCs is that the W8.1 PC's Norton Community Watch "phones home" and submits a Feedback report soon after NIS creates one. However, the W7 PC has been constipated with several Norton Community Watch Feedback reports in the "Pending" status for about the same length of time that it has been stuck with 8% NIS CPU usage...about 60 hours.

Norton Community Watch being constipated on the W7 PC may or may not be contributing its new high NIS CPU usage problem, but to the folks at Symantec/Norton....why is it that the W7 PC's Norton Community Watch is not submitting reports for 2 &1/2 days when the W8.1 PC is submitting reports?

ispalten · December 6, 2013, 2:40pm

yank wrote:
Hi 1mcrtd,

Just curious why you do not turn Community Watch Off if it is casuing high CPU useage?

Not 1mcrtd, although turning it off does remove the problem, isn't it better to find out why submissions are not being sent?

Do you know how to delete ones pending?

yank · December 6, 2013, 3:06pm

Hi ispalten,

Yes, it would be better to find out why submissions are not being sent. But (you knew that was coming), I feel the situation has been identified and now Norton can work on getting it sorted, especially since they have all the assets to troubleshoot and possibly correct the situation.

I suggested to turn it off, as there is no need for you to sit there with high CPU usage while they hopefully attempt to find the cause and correct it.

How to delete the pending? Actually, my Community watch has never been turned on since I installed NIS, but I do have it enabled in my NSS on another system and I do not show but 2 submitted entries since Nov 23. I am not sure if using the Clear Entries button (alongside the Close button in History will remove the actual pending item - or merely remove it from sight on the list.

1mcrtd · December 7, 2013, 9:45am

Hello ispalten & yank,

Sorry for the delay in getting back to you. I choose to participate with the Community Watch option just in case something weird shows up. It began causing high NIS CPU usage a little over one week ago, and is intermittant.

In the first of two steps to eliminate the intermittant problem, the stuck Pending NCW reports are cleared thusly: Open the GUI, click on History, open the drop-down menu, go to Norton Community Watch & open it, click on the yellow Clear Entries button, afterwards close that window.

That does not stop the high NIS CPU usage by itself. And, simply restarting the PC does not stop the high usage, either. For the W7 PC involved, it takes clearing the Pending (stuck) NCW reports, then restarting the PC. (I may have incorrectly used the term "reboot" in previous postings.)

---

After being away from the W7 PC for the past 10-plus hours, I returned to find it in high NIS CPU usage, again. For Symantec's consideration, below are two reports that were stuck in the Pending status:

Category: Norton Community Watch
Date & Time,Risk,Activity,Status,Recommended Action,Date Updated,Submitted By,Description,Submission Details
12/6/2013 2:14:03 PM,Info,Norton Community Watch Feedback,Pending,No Action Required,12/6/2013 2:14:03 PM,Norton Internet Security,Norton Community Watch Feedback,"ProductSku:21174908 Product Version:Norton Internet Security:21.1.0.18 OS Language:0409 OS Locale:0409 OS Major Version:6 OS Minor Version:1 OS Service Pack Major Version:1 OS Service Pack Minor Version:0 Time Zone Bias:480 ProcessorArchitecture:0 Submitting 1 DLL Associations. Process Image:d4599e706d8a814cc0f8b92ed55d8035a6407fbb5a38575f746d3faaf394b533. DLL Image:e28f2903f86d39c5a69b5f89ccd6594e93a1bf1e4acd613a0f2e2348dfa88d65. "

Category: Norton Community Watch
Date & Time,Risk,Activity,Status,Recommended Action,Date Updated,Submitted By,Description,Submission Details
12/6/2013 6:14:08 PM,Info,Norton Community Watch Feedback,Pending,No Action Required,12/6/2013 6:14:08 PM,Norton Internet Security,Norton Community Watch Feedback,"ProductSku:21174908 Product Version:Norton Internet Security:21.1.0.18 OS Language:0409 OS Locale:0409 OS Major Version:6 OS Minor Version:1 OS Service Pack Major Version:1 OS Service Pack Minor Version:0 Time Zone Bias:480 ProcessorArchitecture:0 Submitting 14 File Votes. 1. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\pdmproxy100.dll. size:97880. Digest:9e6b473eca001e5d8cc6333f39c9463a37a384c5934202b7177e1f39977dec7f. Signed By:Microsoft Corporation. Version:12.0.20712.1. SecurityZoneID:65535. AVEBlob:08021210324303bd538acbd1000000000f91e9f31830300040024800. UberHash:010000004e8b29c9f3ff44e61b4c7c9763d18d457ed42237cc1cccab3f042fcebad22000. 2. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\pdm.dll. size:410680. Digest:63adb06c8228632607f38c0a85624271bcf495ba4c5f18930a7912161af7ebb3. Signed By:Microsoft Corporation. Version:12.0.20712.1. SecurityZoneID:65535. AVEBlob:08021210b5e77f2d9e4a66e700000000529e2fa01830300040024800. UberHash:01000000fb397c4e09ca093d124332ea69f2dcb82675fc40bb390901fac808fa72313d88. 3. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\networkinspection.dll. size:999936. Digest:94be7bcfae2d74aa97fae0eee4eec430f7d5b983104af321c6be58bebf5e78c6. Signed By:Microsoft Corporation. Version:11.0.9600.16428. SecurityZoneID:65535. AVEBlob:08021210625a54222268b90700000000a1468be61830300040024800. UberHash:010000007d498306c0dbe48bc64583ec24aa535a3b65d75b10dc71ccd56bb85f29357465. 4. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\msdbg2.dll. size:312392. Digest:f0e76c940be8949b5b7158bdab50798544205e581be8dcfdd14121a42a443c80. Signed By:Microsoft Corporation. Version:12.0.20712.1. SecurityZoneID:65535. AVEBlob:08021210f7f72b52b67f54d500000000bd75ee5b1830300040024800. UberHash:0100000070d3d531f267b4767f62e2b5d40167450ec9b05fa5df0b98fafaa5b3a4fc1012. 5. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\jsprofilerui.dll. size:503808. Digest:e4d36a6f92341ac32b9c7e705a334ea22fadec42604e8667787cd7734793e963. Signed By:Microsoft Corporation. Version:11.0.9600.16428. SecurityZoneID:65535. AVEBlob:08021210f7f72b52a60b8eb300000000d3dd8da31830300040024800. UberHash:010000006b3b473f7c2ef22c4307be956834bc429d26ea040fd0a51eec6043721457e804. 6. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\jsprofilercore.dll. size:53760. Digest:1dea91e1b71c53ebdac56535ad18b0c406a15a86f59e4f9694023a2a338c30bb. Signed By:Microsoft Corporation. Version:11.0.9600.16428. SecurityZoneID:65535. AVEBlob:08021210f7f72b52cf1a1fe6000000004a66305f1830300040024800. UberHash:0100000065d28fe7425f7a9d62aafdb123820d3b77f1ee41c8047ae724cacfd5b25d7920. 7. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\internet explorer\jsdebuggeride.dll. size:105984. Digest:b26612755ad29c2f028f5a8023c1d13248e427b2f02c3ae3fb52859b6b2c7c28. Signed By:Microsoft Corporation. Version:11.0.9600.16428. SecurityZoneID:65535. AVEBlob:08021210625a5422edc12b0c00000000882c96a31830300040024800. UberHash:01000000e6a139ff279081f964bfb15edecd894aa0c05a42b4ef7593f7609ae80cfed12f. 8. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\ati technologies\ati.ace\core-static\cli.component.systemtray.dll. size:417792. Digest:5518cce2dc6afb77b110458ca63dd0bef3f1f713945cf13ed3086c2fa54cdc3d. Version:3.5.4226.30394. SecurityZoneID:65535. AVEBlob:080212109cc88bceaa83d747000000008ece01e91830300040024800509803. UberHash:010000001cf36dce0568ff7ca4160fdb4f62271f841a21422b600e10d10854197eb77c4a. 9. timestamp:1386372778. Path:CSIDL_PROGRAM_FILES\ati technologies\ati.ace\core-static\cli.component.erecord.dll. size:24576. Digest:88872f3138c4a61189d242dabdfea501d33a6529c748bcf8eaab918996be8028. Version:3.5.4226.30385. SecurityZoneID:65535. AVEBlob:080212109cc88bce4268865200000000841c6ae118303000400248005018. UberHash:010000002c51c5dd57ac6cbeb45868892ae078e4283bf44b5e9a45a5cbfe9eeeec1e0598. 10. timestamp:1386372778. Path:CSIDL_WINDOWS\winsxs\x86_microsoft-windows-webdavredir-davclient_31bf3856ad364e35_6.1.7601.22376_none_961f7487c9cdefd9\davclnt.dll. size:89088. Digest:b61216efda4cb232ef7cec29026789dfa84be4e4800944e5f16e241ca9db86ad. Signed By:Microsoft Corporation. Version:6.1.7601.22376. SecurityZoneID:65535. AVEBlob:08021210324303bdd9ec72f00000000016c206ee1830300040024800. UberHash:01000000390399b5982b9d825a38b945d25b00209b1358a7744d9c556024eef40db08786. 11. timestamp:1386372777. Path:CSIDL_WINDOWS\installer\$patchcache$\managed\00004119110000000000000000f01fec\14.0.7015\scnpst64.dll. size:348304. Digest:30f2ea22c18208908fcb0d0fad508080c91695c7c47cc739345904e913051f51. Signed By:Microsoft Corporation. Version:14.0.7010.1000. SecurityZoneID:65535. AVEBlob:08021210b5e77f2d6f641b2c00000000f492aa911830300040024800. UberHash:010000001a0ae241af7026535d91f23928f5eced4688ec770d21864f73b0d5823097719f. 12. timestamp:1386372777. Path:CSIDL_WINDOWS\winsxs\amd64_wpf-presentationcffrasterizernative_31bf3856ad364e35_6.1.7601.18219_none_27c04982a4ed9c56\presentationcffrasterizernative_v0300.dll. size:124112. Digest:1027d8e0c269459979ae9d1405e9cc94b3c670ddfaf101fa63829ed84175cb53. Signed By:Microsoft Corporation. Version:3.0.6920.5459. SecurityZoneID:65535. AVEBlob:08021210324303bd46f22f8f0001e4d0676f086b1830300040024800. UberHash:01000000b6b2a65b506b0c2612113c22d7e392760a815bc4b5baddf1837854791a1d90ed. 13. timestamp:1386372777. Path:CSIDL_WINDOWS\winsxs\wow64_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.22403_none_d5372c787612c3d0\shell32.dll. size:12874752. Digest:d2ed7cab9bff7e8c6583456ec14c9396d923729efb53cffb1bf9ef820c7b1024. Signed By:Microsoft Corporation. Version:6.1.7601.22403. SecurityZoneID:65535. AVEBlob:08021210625a5422f5ad397300000000546162d71830300040024800. UberHash:01000000ad45a00a6e32536e178e21a0a151c3832a9bea3e6e343a451876f3e49abcc16f. 14. timestamp:1386372777. Path:CSIDL_WINDOWS\assembly\nativeimages_v2.0.50727_64\system.data.linq\6bb38e67e4e4ffca3badde9cead1bd6c\system.data.linq.ni.dll. size:3480576. Digest:0b98e2d8569aea6dd6826ecead83d81727e7aad98ecf50b72179d679e7af30e0. Version:3.5.30729.5455. SecurityZoneID:65535. AVEBlob:08021210163e39ef50a372c800351c001144b4671830300040024800. UberHash:010000003c270392eae61a7bd563a529e2774ca1b246318dc2687f34c120484fa2be00d8. "

---

Below is one example of what appeared repeatedly in the Firewall-Activities History as the above-NCW reports became stuck in the Pending status, with simultaneous high NIS CPU usage:

Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
12/6/2013 3:38:01 PM,Info,"An instance of \"C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe\" is preparing to access the Internet.",Detected,No Action Required,Firewall - Activities
An instance of "C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe" is preparing to access the Internet.

---

I am hanging in there, trusting Norton will do what they can, when they can.

1mcrtd · December 7, 2013, 10:04am

To anyone at Symantec, maybe the following NIS Error report will shed some/additional light on the situation (?). This Error report appears to have been successfully submited at 6:18:18 PM, local time:

Category: Norton Error Reporting
Date & Time,Risk,Activity,Status,Error Type,Error Time,Error ID,Error Class,Product Name,Product Version,Process ID,Thread ID,Process Name,Process Version,Process Timestamp,Module Name,Module Version,Module Timestamp,Module Offset,Hash Code,Exception Code,Error File
12/6/2013 6:16:18 PM,Info,Norton Error Reporting Submission,Submitted,Application Failure,12/6/2013 3:03:53 PM,{5BDCBEB2-8320-4E73-9DDD-6F3A97288FFB},0x8ECFD50,Norton Internet Security,21.1.0.18,0x944,0xD34,NIS,12.11.0.16,10/3/2013 12:33:34 AM,ccL120U,12.11.0.16,10/3/2013 1:49:39 AM,0x520B4,0x9B9CF203,0xEFFFFFFE,"C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\CmnClnt\ErrorInstances\08ECFD50\5BDCBEB2-8320-4E73-9DDD-6F3A97288FFB.dat, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\ErrMgmt\Queue\Incoming\SQ_{08549249-CF21-4680-A76E-629321FF48D2}\NIS.2372.dmp, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\ErrMgmt\Queue\Incoming\SQ_{08549249-CF21-4680-A76E-629321FF48D2}\SQ_{A1416135-99FD-4DA3-B8C5-20BBD33A2057}.etl, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\ErrMgmt\Queue\Incoming\SQ_{08549249-CF21-4680-A76E-629321FF48D2}\SQ_{FE0935FE-3A24-46D2-B439-C92171B08D94}.plist, C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\ErrMgmt\Queue\Incoming\SQ_{08549249-CF21-4680-A76E-629321FF48D2}\SQ_{F1CC7EC7-2C24-4E30-B90B-127D728FAD23}.dlist"

ispalten · December 7, 2013, 1:03pm

1mcrtd wrote:
Hello ispalten & yank,

In the first of two steps to eliminate the intermittant problem, the stuck Pending NCW reports are cleared thusly: Open the GUI, click on History, open the drop-down menu, go to Norton Community Watch & open it, click on the yellow Clear Entries button, afterwards close that window.

That does not stop the high NIS CPU usage by itself. And, simply restarting the PC does not stop the high usage, either. For the W7 PC involved, it takes clearing the Pending (stuck) NCW reports, then restarting the PC. (I may have incorrectly used the term "reboot" in previous postings.)

Reboot and restarting (not a cold boot) are basically the same.

Clearing the report in the 'history' only clears the log. It doesn't clear the actual report and I would assume it is still pending, unless Symantec connects to the PC and reviews the log itself?

So basically you believe that once the log file is cleared and then rebooting it will stop it (high I/O and CPU usage)?

My suspicion is that it will just either continue or happen again with the next report starting to go into the pending state.

One oddity, we have another computer, also a Dell XPS but newer and also running W8.1 and NIS 2014 and it doesn't exhibit this problem (Community Watch enabled too)?

Norton Community Watch Feedback / W7 PC constipated:

Announcements