Would any of you be willing for a remote session today with our team? We’d really appreciate the help. Thank you.
Aside from the MS News service recently appearing across my systems, I also recently started using Norton's Backup and Norton's Secure VPN. I wish that I had more time to assist with troubleshooting. Unfortunately, I'll be away from my desktop for the next 8-12 days, but I will have my notebook which appears to be encountering the exact same issues. I'll continue to monitor this thread, and I'll try to assist as time permits.
What are the chances all the computers exhibiting this issue are actually infected by a virus, one that is either new or realtively unknown?
It happens this way for me only sometimes, but yeah.
I'm having the exact same issue as Levi40!!!
don't worry it is a ms feature just right click ur taskbar, and find news and interest and make it to turn off.
When this happened for me, Norton Security WSC Service remained running, but the Norton EXE, and the Norton Security Service both were shutting down
Be sure all three are running in task manager. As well the Norton service by default is set to restart after two minutes, which to me seems a bit long, but it was NOT restarting. I had to restart Norton form the desktop link then all three would be running again.
Not sure if this is the first time, but just right now I saw the notification icon disappear from taskbar, BUT Norton was running in taskmanager and there were NO entries in event viewer. This is getting cobnfusing. lol
I wonder if 'Intel Management Engine' has anything to do with this?
~~SYSTEM SPECS~~
intel i7 6700k
Asus Maximus VIII Hero
Corsair CMK32GX4M2A2666C16
Zotac Twin Edge OC RTX 3060
Samsung 980 1tb
Samsung 870 Evo 1tb
WD Blue 4tb
Coolermaster V850 80 Gold
~~DRIVERS~~
chipset: Intel INF 10.1.1.45
chipset additional: Intel Management Engine Interface 1909.12.0.1236
lan: Intel Ethernet Connection 12.19.1.37
gfx: Nvidia Geforce 471.41
steel series engine: 5.1.0
Windows 10 Pro 21H1
For me, this was happening any time I tried to run a full screen program that accessed the NET. Norton did not restart for me at all, automatically. I could start it from the desktop, and it would remain running, as long as I did nothing full screen. I have posted other related info here, if you're interested in reading it. https://community.norton.com/en/forums/cwindowssystem32werfaultexe-shutting-norton-down Please do not post on that thread however, as this seems to be the one needing to be followed.
I did have a recent system image, I restored my system to, and it SEEMED to correct the problem, for some programs, but not all. I actually thought it worked for a whole day. I am wondering if maybe the Windows updates being installed had a bearing on this, however since I restored I will not have the related logs. As well, I had to go back to an older restore image, and at this point, I am back to a previous version of my Norton Product.
The Windows Updates have been installed now, and I have turned off Norton auto updates, and plan to make an image before running them each time. I know this is not really an option for most of you, but it has stopped the issue for now. Running Norton updates manually, I have not received the new version again yet, so for me, this is a temp fix. Also if you do not have the newer version of Norton, you will not be much help with the logs, so this is not really a winning solution as for that.
My main concern is that WERFAULT attempted to write to protected memory, after the Windows updates installed, and then was involved in each crash of Norton. I am not sure if I had gotten the newer version of Norton before the Windows updates installed, but since they installed with no issues after reverting to the older version, It may be a good chance there is something related there.
This all being said, remember if you plan to go back to a system image, BACK UP ALL YOUR WORK AFTER THAT DATE!! lol
I myself have been a Norton user since around 1995, and have ALWAYS had good luck with the products. Since this issue seems so widely variated, It may hep to include you mother board specs, and BIOS versions in your reports, as well as graphics brands and drivers, since for me this only happened while running a full screen game. WEB browsing was not affected it seemed, and I never noticed Norton had shut down unless I was gaming. I also could not connect to the VPN, and reinstalled my WAN drivers, and it seemed to start after that, but then restoring the system image, to a point before I had changed them, did NOT correct it. So your NET adapter info and driver info may also help Norton sort this out.
I doubt that it's a "user's end" problem. As I've said, this issue is occurring on my desktop and my notebook computer. My notebook is pretty fresh, less than a year old, with only a handful of applications installed. I really only use Chrome on that system, but MS Office is also installed. My desktop is a completely different situation with all sorts of apps from CAD programs to development platforms and toolkits. I just thought of something. It may be a coincidence, but I'm fairly certain that I began noticing the issue around the same time this "Microsoft News" appeared in the Taskbars of my systems. I don't recall ever enabling or installing this; it just appeared in my Taskbars a little while ago. Anybody else?
I am aware they cannot be disabled from task manager and yes periodic scanning is turned off on this system. Never noticed those 2 things running on previous installs with Defender and other windows options disabled.
Do you have periodic scanning set to ON in settings? Check your "Check apps and files" under App and brower control as well. Showing in task manager only suggests they are running, they cannot be disabled from there.
SA
Sure did. I typed a message and then selected the file and then clicked the upload button. Nothing happened. Tried on edge and firefox, same results.
It's comforting to see I am not alone with this issue, but as much as I hate to admit it, I feel this is almost certainly an issue on the users end and not specifically windows or norton. That being said if I can't solve it, I'll just have to reinstall windows or run a different av on this machine.
Windows Defender is disabled as it should be for Norton and also reputation based browser control aka smartscreen is off, but I just checked task manager and noticed that they are running. On my other machines they are not and those machines don't have this issue.
Windows Security Health Service
Windows Defender SmartScreen
Both running even though they should be disabled.
Did you compress the log file to .zip, rar or 7z format? Files larger than 100 mb will upload.
SA
Tried to upload a log file, but nothing happened. I see the note about mods allowing 300mb files in this thread, but the dialog box for the upload says 100mb. In any case the file I tried first is 150mb and when I clicked the upload or save buttons, nothing happened.
@AJR78 I wouldn't be viewing the event viewer while the MATS tool is running, it can cause the issue you are seeing with error: 0xC0000188. Are you seeing a statement with the error that says there is an event ID 3 with"Circular Kernel Context Logger" entry? That would be the cause of MATS stopping due to interferance with its processes. Please re-run the MATS without any other programs running or other user interactions other than following its prompts until it has completed.
SA
For me with Norton Security it's random but a couple of times a day since the 20th from looking at Event Viewer - an Error 1000 as above and a error 7031 "The Norton Security service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service." and a error 7034 "The Norton Security service terminated unexpectedly. It has done this 3 time(s).". Today the taskbar icon did disappear but most people are probably not aware of it happening.
Ok so I have NortonMAT running to log and try to reproduce the error. While it runs I keep checking event viewer to see if it happens.
I think NortonMAT may have crashed? Got this message in event viewer while it's running:
Session "symhelp-norton" stopped due to the following error: 0xC0000188
Hi @AJR78,
I have already sent you a private message. Please take a look at your inbox when you get a chance. Thanks.
-Gayathri