Norton quickly fills my system drive with files leaving 0 bytes free

Norton Security | Norton Internet Security
1

I am using Norton AntiVirus 2011, version 18.1.0.37, fully updated.  My OS is Win7 64bit.

 

Yesterday I found my C drive completely full, and consequently the computer was basically unusable. I rebooted, no change. I then did the first obvious thing, a disk cleanup.  No good.  I used a program that graphically maps out where your drive space is being used (I had to run it from drive E), and discovered that Norton was the culprit.

 

All the free space on my drive (about 70 Gig) was taken up by files in the following folder:

 

C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\ErrorManagement\Queue\Staging\ccSvcHst.1820

 

The file names are all of the following format: {FFF426E0-F05D-40B0-8515-088077A3050F}.etl, with only the hex numbers changing in the file names.  The files are all identical in size and almost identical in content.  Looking at them with a hex editor, I found two (sort of) interesting things:  they all contain the same two sections of ascii content, first is a reference to tzres.dll (with no path), and second is their own full path and file name.  After that, starting at 0x2D8, the rest of the file is all ones (i.e. FF bytes in hex).

 

I also checked the Norton AV event history, but found nothing special or repetitive that corresponded in any way with the timestamps of the .etl files.

 

By turning off tamper protection and with a bit of effort, I was able to delete the files and reboot, in the hopes that the problem involved some error that rebooting would fix, but by this afternoon, the disk was full again, and NAV wouldn't show its UI until after a reboot.

 

Any help would be apprecitated.

 

Small edit, for completeness: I performed a full file system / surface scan of the drive and found no errors.

 

2

Hi msaint,

 

Welcome to the Norton Community.

 

Had you previously run the NAV (Norton Antivirus) BETA? The abundance of these files looks like log files which are created while running BETA code.

 

Also, do you have any other security software installed on your computer besides NAV? What security software did you previously have before you installed NAV? How long has NAV 2011 been installed and has this problem been present all along?

 

Best wishes.

Allen

3

First of all, this problem seems to be identical to the one posted 2 hours later in this thread: http://community.norton.com/t5/Norton-Internet-Security-Norton/Norton-Internet-Security-Creating-Thousands-of-Error-Files/td-p/333485 In case a moderator wants to join them or add a link and close one. I'm not familiar with the norms of this forum.

 

In answer to your first question, I have never installed a NAV beta.

 

To the second question, I have never installed any other antivirus or "internet security software" on this system other than the unavoidable default Microsoft ones, with one exception: the last time I updated Flash for my browser I missed a checkbox and Adobe jumped on the opportunity to infect my system with a McAfee product, which I immediately removed in the conventional way (cp->add / remove programs). I have no idea if this could be related, although this seems to be absent in the thread I linked above.

 

Third, Norton 2011 has been on my system ever since my previous version of NAV offered to upgrade itself.

 

Last, this problem is new. I came back from a two day trip yesterday to find my drive full, and as I posted previously, after successfully deleting the files and rebooting the problm recurred today.

 

Thanks for the quick answer, by the way. Let me know if there is any more information I can provide that would be helpful.

4

This may not be related or solve the problem but please run the mcaffee removal tool just to make sure that its good: http://service.mcafee.com/FAQDocument.aspx?id=TS100507

5

HI msaint,

 

Thanks for the information.

 

I would second what Tywin7 said about running the McAfee removal tool just to be sure.

 

I would then recommend that you uninstall and reinstall NAV with the use of the Norton removal tool to ensure a clean install.

 

It is interesting to be sure that two threads were started within a few hours of each other with the same issue. But this is not normal behavior and I think the first step will be to go through the steps to ensure that we get a 100% clean install of NAV.

 

Before you use the removal tool, please download the full version of NAV 2011 from here. Please note that this is the English version so please let me know if you need a different language and I will provide the appropriate link.

Once you have downloaded NAV, you can proceed with use of the removal tool as indicated below.

Please NOTE that this removes ALL Symantec products so be sure to have your license keys ready as you will need to reinstall all your Symantec software products. You can get your Norton product key from your Norton Account.

Once done please download the Norton Removal Tool from Symantec from this link.


For your protection, disconnect from the Internet before continuing.


Do a conventional uninstall of NAV via the Control Panel and then restart your computer.


Run the Norton Removal Tool and once it is completed, please reboot your computer. Once up please run the Removal Tool one more time and once again reboot.

 

Before reinstalling NAV you can safely remove all of these files and any Norton/Symantec directories left over.


Then please install NAV 2011 from the full version downloaded earlier. Once installed please reconnect back to the Internet and run Live Update repeatedly (rebooting as requested) until it reports there are no more updates.


Hope this helps.


Best wishes.

Allen

6

Allen, sorry to break the flow. Are you observing a similiar behavior on your system? I dare not to on my pc just in case its a faulty update.

7
Tywin7 wrote:
Allen, sorry to break the flow. Are you observing a similiar behavior on your system? I dare not to on my pc just in case its a faulty update.

No I don't.

 

Certainly if even more reports come in on this it will start to make me suspicous and I will involve Symantec at the appropriate time. I am keeping an eye out for new threads with a similar problem.

 

Best wishes.

Allen

8



Hey folks, thought I had better come back and say that the problem is gone.  Because I needed to get the problem fixed, I couldn't afford to make one change at a time and wait . . . so I'll just tell you the changes I made before it stopped happening, in the hopes that if this problem persists for anyone else they can locate a similarity:

 

 

1) After looking for errors on my computer I found that the TMM task (which uses TMM.dll) was failing to run.  It is not at all necessary on my desktop, so I disabled it.  This task is a momentary thing that only runs at login, so this seems like an extremely unlikely candidate.

 

2) TueCrypt:  I have an encrypted file that get's mounted as a drive.  My setup was such that it unmounted after a certain amount of idle time, and offered to mount (requiring key) at login / activity.  This has some potential, but it is not my top suspect, for two reasons: it unmounts and mounts only on inactivity and activity/login, and the Norton errors were stacking up constantly during inactivity.  Since Norton generally deals gracefully with other drives when they are unmounted, I see no obvious reason why this would cause Norton much confusion.  And since the drive was not mounted (due to inactivity) during most of the time Norton was generating the errors, trouble with the mounted encrypted drive doesn't seem like a great candidate either.

 

3) McAfee cleanup:  I did do the McAfee cleanup suggested in one of the responses.  However, being in Spain, I did not see this post or do the cleanup until today (it was suggested during my nighttime), and there were no Norton files stacking up overnight before I did this.  So this is not my top choice.

 

4) My top choice:  Norton updated itself (as it does with great frequency) and the problem was fixed.  The biggest reason that this possibility gets my vote is not just that the others changes I made don't seem especially likely as fixes.  The biggest reason is that, aside from the error file's path, the only other ascii text I could make out in the error files was a direct reference to tzres.dll.  I could be totally off base here, but I can't think of a reason that library would be explicitly mentioned in an error file other that that Norton thought it had a problem with that library.  Since there is no other evidence of any problem with that dll on my system, my thinking is that there was some arcane and version specific issue that Norton quickly figured out and fixed.

 

Please understand, I am not at all claiming to know that that was the cause!  It's just my best guess, and I'm not the most informed person to be making the guess.  The Norton folks themselves would be a much better source.

 

I do hope this information is helpful if the problem shows up again.