Norton Internet Security 2010 17.7.0.12 Restarted

[SGFC]

Log Name:      System
Source:        Service Control Manager
Date:          7/23/2010 2:26:10 PM
Event ID:      7031
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      AMDPHENOMWIN7
Description:
The Norton Internet Security service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 120000 milliseconds: Restart the service.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7031</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2010-07-23T19:26:10.855678300Z" />
    <EventRecordID>90774</EventRecordID>
    <Correlation />
    <Execution ProcessID="532" ThreadID="4576" />
    <Channel>System</Channel>
    <Computer>AMDPHENOMWIN7</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Norton Internet Security</Data>
    <Data Name="param2">1</Data>
    <Data Name="param3">120000</Data>
    <Data Name="param4">1</Data>
    <Data Name="param5">Restart the service</Data>
  </EventData>
</Event>
-------------
- System

  - Provider

   [ Name]  Service Control Manager
   [ Guid]  {555908d1-a6d7-4695-8e1e-26931d2012f4}
   [ EventSourceName]  Service Control Manager
 
  - EventID 7031

   [ Qualifiers]  49152
 
   Version 0
 
   Level 2
 
   Task 0
 
   Opcode 0
 
   Keywords 0x8080000000000000
 
  - TimeCreated

   [ SystemTime]  2010-07-23T19:26:10.855678300Z
 
   EventRecordID 90774
 
   Correlation
 
  - Execution

   [ ProcessID]  532
   [ ThreadID]  4576
 
   Channel System
 
   Computer AMDPHENOMWIN7
 
   Security
 

- EventData

  param1 Norton Internet Security
  param2 1
  param3 120000
  param4 1
  param5 Restart the service

----------------------

Event just before this happened:

 

It's been working good for awhile now. Why this sudden problem?

[Stu]

Try a restart. What happens?

[SGFC]

It works okay on my other OS's. So maybe it was just a freak occurrence. Or WER (Windows Error Reporting) triggered NIS 2010 to restart.

 

Looks like there was a big dump file it wanted to send to MS.

 

It's just weird is all. Since I replaced my bad RAM everything has been smooth till this happened.

[Tech83]

Hi! SGFC,

 

I see you mentioned that you had to replace some bad system memory (RAM) on your system.  When system memory goes bad it can cause information to be stored on your hard drive incorrectly; I have seen it many times where bad memory actually corrupted a dump file and when the Error Reporting tool attempts to send it the either cannot or it sometimes will interfere with any security software program's proper operation. 

 

I would recommend that you run a complete disk check on the affected OS drive to check for any errors that may have occured while the bad memory was in use.

 

Tech83 :)

[SGFC]

I am pretty sure I've reformatted the hard drive in question since I replaced the bad RAM.

 

But I will run the disk check anyway. I will report back if it finds any errors.

 

Cheers.

 

Edit - 5:32am CDT - Chk Disk came up with nothing.

[reese_anschultz]

SGFC, this could be a one-time random neutrino crash or a real, but uncommon issue. As can be seen in the log entries, the service was automatically restarted. What OS were you using at the time of this problem (I susect XP, unfortunately.) Is there anything in Norton's History under Symantec Error Reporting around the same time? If so, in the More Details, what Error ID is provided?

 

[SGFC]

I was on Windows 7 Ultimate 64 bit.

Error ID: {2EC3C4C0-7A51-4B7C-B5C8-DF8515A07394}

and

Error ID: {4088D4C0-2BD6-418F-A6F5-09D00AC14A95}

 

Actually there are quite a few errors dating back to May.

[bjm]

FWIW

I had a recent WERFAULT Actor...do not recall a WERFAULT before ?

WERFAULT

just before WERFAULT

 

[reese_anschultz]

 

---

SGFC wrote:

I was on Windows 7 Ultimate 64 bit.

Error ID: {2EC3C4C0-7A51-4B7C-B5C8-DF8515A07394}

and

Error ID: {4088D4C0-2BD6-418F-A6F5-09D00AC14A95}

 

Actually there are quite a few errors dating back to May.

---

Thanks for the error IDs! Both errors types are very uncommon but after researching them, I think that I may have discovered another issue that I've asked one of our teams to research.

 

[reese_anschultz]

 

---

bjm_ wrote:

FWIW

I had a recent WERFAULT Actor...do not recall a WERFAULT before ?

WERFAULT

[image]

just before WERFAULT

[image]

 

---

These tamper protection detections, as with SGFC's previous one, are Windows Error Reporting detecting the ccSvcHst 'crash' and trying to submit it to Microsoft for analysis.

[bjm]

Hello reese_anschultz

Thnx for your time and interest...

re > the ccSvcHst 'crash' and trying to submit it to Microsoft for analysis.

I did review Problem Reports & Solutions....no event to match this time

I did review Norton's History under Symantec Error Reporting...last event was June 06

& Errors = 0

Would I have observed any behavior associated with the ccSvcHst 'crash' ?

Thnx

[reese_anschultz]

 

---

bjm_ wrote:

Hello reese_anschultz

Thnx for your time and interest...

re > the ccSvcHst 'crash' and trying to submit it to Microsoft for analysis.

I did review Problem Reports & Solutions....no event to match this time

I did review Norton's History under Symantec Error Reporting...last event was June 06

& Errors = 0

Would I have observed any behavior associated with the ccSvcHst 'crash' ?

Thnx

---

Depending upon which of the two instances of ccSvcHst crashes, the symptoms will be different. If the 'service' instance crashes, there should be nothing for you to notice, it should be automatically restarted within a few seconds. If the 'user' instance crashes, your tray icon may disappear. In some cases it may be automatically restarted but usually you have to log off and back onto your system.

 

[SGFC]

 

---

reese_anschultz wrote:

Thanks for the error IDs! Both errors types are very uncommon but after researching them, I think that I may have discovered another issue that I've asked one of our teams to research.

 

---

Good to hear. It hasn't happened since this post. The only way I noticed it is because I was running a Full System Scan and when I got back the UI was gone. I thought I was having Déjà vu.

 

[bjm]

@ reese

well, what ever occurred...I must have blinked. 

as Norton did not Log the event to Error Reporting & my System did not feel the event.

We all must have blinked 

Thnx

Cheers