Norton ISS 2014 causing me a problem of freezing?

Norton Security | Norton Internet Security
21

Hi,

 

The ci.dll file, opens a kernel file and if that has a problem you will get the ci.dll fault report.
The problem could be caused by downloading stuff from the net that contains a very nasty rootkit virus/trojan. It is often in a .rar file. 

It overwrites your boot and drive headers so there is no easy way to kill it.

I'm not saying that it is your case, but try to download MBAM free and run a full system scan with the Rootkit option enabled. (It could take a while).

See if it picks something and report back.

 

Regards,

22
Apostolos wrote:

Hi,

 

The ci.dll file, opens a kernel file and if that has a problem you will get the ci.dll fault report.
The problem could be caused by downloading stuff from the net that contains a very nasty rootkit virus/trojan. It is often in a .rar file. 

It overwrites your boot and drive headers so there is no easy way to kill it.

I'm not saying that it is your case, but try to download MBAM free and run a full system scan with the Rootkit option enabled. (It could take a while).

See if it picks something and report back.

 

Regards,

Did all that already, even got V2 of MBAM and tried it.

 

What doesn't make sense to me and I consider a clue is the 'once a day'' happening? If it were a rootkit it would happen on every boot, no?

 

Once a day is leading me to suspect an Update that runs ONCE every day or a Scheduled Task? I've got no scheduled task that are like that though? Also, usually an update runs on every boot?

 

So the next thing I'm thinking is are there updates done every day? Am I getting it down and the having it install and THEN the system locks? Of course on the next boot that update is already d/l'ed and installed so nothing is done? Could also help explain why I don't have this problem some day, i.e., there was NO update?

 

I tried running a command prompt drilling down into every directory and sub-directory looking for new files on the date but that wasn't much help at all?

 

I'm pretty sure there is some 'event' happening that causes the lock-up? I was hoping with the 8.1 update if it were system related it would be fixed. Looks like that is not the case?

 

I've also tried other rootkit detection programs and didn't find anything either, so I'm pretty sure it isn't an infection. I'll run MBAM again though to be sure. It says my last scan (with RootKit) was 4 days ago and I've had this problem for a long time before this.

23

" Once a day is leading me to suspect an Update that runs ONCE every day or a Scheduled Task? I've got no scheduled task that are like that though? Also, usually an update runs on every boot?"

 

Hi,

 

Glad to know that you are probably malware-free.

What kind of updates do you mean??

Is there a particular scheduled update that you suspect??

If you open Task Scheduler, you will probably find 40+ scheduled tasks so it's difficult to narrow down.

 

Regards,

24
Apostolos wrote:

" Once a day is leading me to suspect an Update that runs ONCE every day or a Scheduled Task? I've got no scheduled task that are like that though? Also, usually an update runs on every boot?"

 

Hi,

 

Glad to know that you are probably malware-free.

What kind of updates do you mean??

Is there a particular scheduled update that you suspect??

If you open Task Scheduler, you will probably find 40+ scheduled tasks so it's difficult to narrow down.

 

Regards,

I mean something like Norton, Google, iTunes, HP, etc. All these load an update app on startup that 'call home' and take appropriate action. It makes sense that there might be only a daily update and the install completes but then hangs the system. Next boot it determines the file(s) are up to date and does nothing. However I can't find any file that would match this scenario.

 

I was thinking it would have to be Auto-Started or a scheduled task. Some are also done by a Service. However I've not been able to find a likely candidate to have done this?

 

I've also looked for comparison with my wife's computer. I can't see a difference.

 

MBAM declared the computer OK:

 

==============

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 04/12/14
Scan Time: 1:53:27 PM
Logfile:
Administrator: Yes

Version: 2.00.1.1004
Malware Database: v2014.04.12.05
Rootkit Database: v2014.03.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Irv

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 375937
Time Elapsed: 13 min, 42 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

==================

 

It was interesting to find someone else with the same problem, but no solution though, sigh...

25

Hi,

 

Try either a clean boot from Windows, see if the issue persists.

Also, try later, a safe mode with networking.

Do you see any difference??

It might be a third party software utility, iTunes, HP etc but the issue would also be present on your wife's pc.

Strange...

 

Regards,

26
Apostolos wrote:

Hi,

 

Try either a clean boot from Windows, see if the issue persists.

Also, try later, a safe mode with networking.

Do you see any difference??

It might be a third party software utility, iTunes, HP etc but the issue would also be present on your wife's pc.

Strange...

 

Regards,

Hadn't though about the Clean Boot or Safe Mode... I'll probably give that a try I guess? About all that will do is rule out h/w as the culprit I guess?

 

Tomorrow I'll boot normal and see if Google's removal helps.

27

Up well over an hour now with no lock-up/freeze.

 

Not call this 'fixed' yet though. I've had days when it doesn't happen and then pops up again. Especially after I take some action to what I think will fix it, like remove programs, stop and autostart, or even run CHKDSK on the drives.

 

Time will tell.

28

By the way, I've taken some 'steps' to see if I can figure out what was happening 'last'.

 

I have a program, WhatsGoingOn (http://www.pcmag.com/article2/0,2817,2341617,00.asp) running now. It shows a lot of info such as disk access programs and tasks running. If I should freeze it will tell me the time the system froze and how long it was running and the tasks actually active at that time.

 

I also created a CMD file to locate files accessed:

 

dir *.* /s|findstr %1

 

All I need do it run the cmd file and supply today's date. I'll get a TON of files and I usually just send it to a .TXT file. Then I edit the TXT file and search for the time it locked up. So far I have found NOTHING of interest from yesterday's lock-up though.

 

I figure is this is a file writing problem it might show up? I might need to add an /ASH as well to the DIR command, but I'll play with that once I get an actual fail. To probably make it easier to locate I'll probably boot to another source so nothing gets writen to the disk and it makes it easier possibly to locate something?

29

Hi,

 

As an additional step, please download and install, if you haven't already, Autoruns from Sysinternals.

Look at the different app tabs and see what's exactly loading, including registry entries.

See if there is something you might suspect interfering with Norton and OS, including third party software.

Let me know how it goes...

 

Regards,

30
Apostolos wrote:

Hi,

 

As an additional step, please download and install, if you haven't already, Autoruns from Sysinternals.

Look at the different app tabs and see what's exactly loading, including registry entries.

See if there is something you might suspect interfering with Norton and OS, including third party software.

Let me know how it goes...

 

Regards,

I have that and also StartUpCop from PCMAG (which I like better). I review stuff with these ALL the time. Win8.x's Task Manager also has a STARTUP and SERVICES tab you can manage these items from.

 

I'm pretty sure of what is showing there and these have never been a problem to me.

31

Hi,

 

Try running your pc a while in Safe Mode with Networking.

I'm asking this because in safe mode Windows loads the Standard VGA Graphics driver and I want to be, as sure as possible, that the ATI Graphics Card Driver and/or connection is not the culprit. 

I think that, so far, you have taken all the necessary steps to capture all info if any BSOD occurs.

Please post back as soon as possible if you have any new unexpected error.

Also, the Google service tweak may have resolved the issue but it's a bit early to be sure.

 

Regards,

32
Apostolos wrote:

Hi,

 

Try running your pc a while in Safe Mode with Networking.

I'm asking this because in safe mode Windows loads the Standard VGA Graphics driver and I want to be, as sure as possible, that the ATI Graphics Card Driver and/or connection is not the culprit. 

I think that, so far, you have taken all the necessary steps to capture all info if any BSOD occurs.

Please post back as soon as possible if you have any new unexpected error.

Also, the Google service tweak may have resolved the issue but it's a bit early to be sure.

 

Regards,

Until I get another freeze I'll keep booting normally. If I do, then I'll go to Safe Mode... which ISN'T the easiest to do under Win8.1. I did put a patch in so F8 will always 'usually' show, but Win8 is almost too fast for F8 to register. I want to go directly into Safe Mode, not have to get to it via another boot from real mode as it might just bypass the problem that day doing so?

 

I really do not have faith that it was Google, although trying to DELETE the updater gave the error, that could have been just for the MSI uninstall? My wife has the same apps and update installed and it doesn't bother her. Only difference, I can't recall the last time I used Chrome while she uses it often. Possible, but I don't think likely, that the version I had was different from hers?

 

I also can't resolve mentally why I would be getting different results. For awhile it was unexpected reboots and then it ran fine, then the lock-ups/freezes and it would run fine on reboot, and recently about 5 random BSOD's and after rebooting running fine for the day? Doesn't make sense? A majority of the times the computer was IDLE.... but all the above happened while in use too. NO logical reason for any of this happening once a day.

 

I'm wondering if I've got 'flakey' RAM? I've got 4 2GB's sticks. Motherboard handles 3 in triple channel speed (matched color slots) and the 4th is not in that configuration. It has been like that 'forever' and Dell shipped it that way. I might remove 2GB's and see what happens as well? It could be Win8 is more sensitive about this? Still doesn't explain why only on the first boot and never after that?

33

Well, it was 'different' this morning...

 

Within 3 minutes the computer rebooted without warning. Then, on the reboot, in less that a minute as it was coming up, a BSOD. DRIVER_IRQL_NOT_LESS_OR_EQUAL (BTHPORT.SYS) and the dump NEVER finished, stuck at 45%?

 

Running DUMPCHK tells me the dump is corrupt as well. About all that is useful out of it is:

 

===========

BugCheck D1, {1400d58f, 2, 0, fffff8017ba41edf}

GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.

GetContextState failed, 0xD0000147
Unable to get current machine context, NTSTATUS 0xC0000147
ReadControl failed - kernel symbols must be loaded first

.

.

.

===========================

 

From THIS it seems IRQ2 was trying to do a READ? Only do not know 'who' was on IRQL 2?

 

Event log as usual shows nothing? At least nothing that is always there.

 

BTHPORT.SYS is BlueTooth, and my mouse and keyboard connect that way. I have the latest Logitech drivers, and these devices have been on the system from day 1 without a problem.

 

I've seen too many different 'files' and BSOD's to beleive this one is 'real'.

 

Since I've rebooted 45 minutes ago the computer is working fine. I think the BSOD is bogus. Especially since if didn't complete the dump so the true culprit could be found.

 

Just the fact that the computer works correctly after the BSOD should rule out something? If h/w I'd expect it to happen again. If s/w, well it is possible it is a timing issue, but why does it always work correctly AFTER the first instance and rebooted? Doesn't make sense?

34

Well, I decided to try Driver Magician and see what it can find for the drivers that need to be updated. See the attached PDF.

 

Now I really DO NOT trust that app. In the PDF you'll see the info on the display driver. I know I have the latest and as you see between DM and CCC (ATI app) there is some discrepancies, but the data is the same and CCC basically reports it is newer. Below that is the ATI page for d/l. Different date, but that is the date posted. Possible error (1603 vs. 1603) between versions on ATI web page and CCC app which I assume reads the data on the computer.

 

The other 4, well,

  • Audio works, why change it?
  • Intel INF Update?
  • RealTek items... They all work now, and normally if they do, you don't need to replace them (Audio, Network, and USB)

Looking on-line at the Intel INF Update that can be tested on-line, I get this:

 

========

Intel Chipset Software Installation Utility (Chipset INF)

Product Detected

Current Version Installed 10.0.13

This version is valid.

========

 

DM says this:

 

=========

Supported OS: Windows 7/8/8.1
Driver Provider: Intel
Driver Version: 10.0.13
Digitally Signed: Yes
Release Date: 2014-02-25
File Size: 2.49MB
Download URL: http://www.driversint.com/IntelDrivers/SetupChipset.exe

------------------

 

Version IS the same???? Ran it anyway, only installed the UPDATE program...

 

The USB one is really not stock RealTek, it is Dell for the front ports. The USB part is under the control of the MS USB driver.

 

DM says:

 

=========

Supported OS: Windows XP/Vista/7/8/8.1
Driver Provider: Realtek Semiconductor Corp.
Driver Version: 6.2.9600.30171
Digitally Signed: Yes
Release Date: 2013-11-21
File Size: 10.2MB
Download URL: http://www.driversbulk.com/DownloadDrivers/realtek_rts5176_cardreader_drv_30171_win.zip

==========

 

MS driver version is 6.3.9600.16384. Slightly older. Dell has drivers for them and they are not easy to get. I've replaced the RealTek drivers in the past and lost the 'card' slots and USB connectors on Explorer. There are NONE that have anything in them now, so I'm reluctant to try to replace it now. I did get the file, I'll try it after the C: drive backs up friday though.

 

I do NOT think any of these are a problem basically. Again, if they were, it would happen all the time I think?

35

Hi,

 

How do you connect to the internet from this particular pc, ethernet or wireless?

 

 

Regards,

36
Apostolos wrote:

Hi,

 

How do you connect to the internet from this particular pc, ethernet or wireless?

 

 

Regards,

Wired via a 1GB on-board RealTek chipset. My driver is the one before the one listed by DM, about 6 months before and for W8.1 from the last time I updated it.

37

" Wired via a 1GB on-board RealTek chipset. My driver is the one before the one listed by DM, about 6 months before and for W8.1 from the last time I updated it."

 

Hi,

 

So a conflict with 2.4Ghz wireless devices is not likely the culprit.

I suggest that you either open a case with Microsoft and/or visit a technician to inspect your h/w because it's certainly not normal to have BSOD's at small intervals of time.

If this continues, you will probably end up with also a corrupted OS.

 

Regards,

38
Apostolos wrote:

If this continues, you will probably end up with also a corrupted OS.

 

Regards,

Beleive it or not, I am fairly competent on this sort of stuff. Worked in Support for  a desktop OS before retiring. I know the Windows (old) code and was a programmer and had written device drivers too.

 

This has not been something recent, but it has started with Win8.0. Comes and goes.

 

I run CHKDSK on the drives often and very rarely will it need to correct a FS problem. I've run SFC so many times I can't remember and have never had it do anything either?

 

Someday I'll probably get a hint that will pan out. Right now, I'm thinking I want to go to 6GB's triple Channel and see it that helps.

 

The ONLY other situation that I now think could be the case is some h/w not initializing properly on boot. However it does on a reboot, hence why I don't see it happen. The reboots are basically 'warm', that is not from a power-off situation of hours (although it didn't fail a few days when it was off for hours and then turned on?) which might have allowed the h/w to respond correctly.

 

At this point, since the video card and first hard drive (SSD) were  replaced and that didn't fix it, RAM, one of the other 2 hard drives, and PSU, Motherboard, or DVD drive as possible culprits, but it doesn't seem reasonable that they would be?

 

I'm really thinking s/w that does an update and connects. Some days there is nothing to get and it exits, however on days there are, they install the s/w and then crash/lockup the system...

39

" Right now, I'm thinking I want to go to 6GB's triple Channel and see it that helps"

 

Hello,

 

What you describe above makes sense, could be related to Intel(R) processor Integrated Memory Controller Channel not working as expected sometimes, or could be not..

It's very difficult to narrow down the issue, other than using trial & error method.

I'm not saying it's impossible, but it's difficult to believe that some s/w installed on your pc, would try to update during boot time and give you BSOD's. Have you tried disabling also Bluetooth devices??

Post back if you have any new info.

Thank you.

 

Regards,

40
Apostolos wrote:

" Right now, I'm thinking I want to go to 6GB's triple Channel and see it that helps"

 

Hello,

 

What you describe above makes sense, could be related to Intel(R) processor Integrated Memory Controller Channel not working as expected sometimes, or could be not..

It's very difficult to narrow down the issue, other than using trial & error method.

I'm not saying it's impossible, but it's difficult to believe that some s/w installed on your pc, would try to update during boot time and give you BSOD's. Have you tried disabling also Bluetooth devices??

Post back if you have any new info.

Thank you.

 

Regards,

I guess I could put in an old keyboard and mouse, I have others. Only thing on the BT, but I've had that as long as the computer. No reports like this in the Logitech forum's for my specific combo (MX5500) or any other BT combo's.

 

I decided to update the 3 RealTek drivers. Need to reboot and I'll see what happens.