HP Pavillion
Windows Vista, SP2
Norton Internet Security 20.3.1.22
Friday night NIS ran a scheduled full system scan at 9:30 pm. I've noticed since I upgraded that I have trouble shutting down my computer if I do it right after closing my internet / browsers. I have Firefox 20 and IE9. So I usually close my browsers and wait and let NIS do whatever it has to before I shut it down for the night.
I did the same thing Friday night but Saturday morning my internet connection was extremely slow and I couldn't open some sites at all. I tried resetting my modem and the suggestion in Windows Network Diagnostics with little improvement. I can't even download a small 7MB zip file and I have Broadband.
The only thing I did with Norton settings was to look around and default everything. I don't understand about the Smart Firewall and and there are so many settings, I didn't want to mess anything up more.
When I check Security History there is a whole lot of blocking going on and I wondered if the firewall is just blocking everything. Also some "Connected to a protected network.....Your computer is currently protected from the local network."
I looked in Windows Event viewer to see what was going on just before shutting down and found this:
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 4/20/2013 1:44:25 AM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Bobbie-office
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001:
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-04-20T06:44:25.000Z" />
<EventRecordID>257312</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bobbie-office</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001:
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office
</Data>
</EventData>
</Event>
-------------------------------------------
Warning 4/20/2013 1:44:25 AM User Profile Service 1530 None
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-04-20T06:44:25.000Z" />
<EventRecordID>257312</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bobbie-office</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001: Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001 Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office</Data>
</EventData>
</Event>
Hi lexiemac,
If your internet provider has determined that there is a problem with your service, I think all you need to do is wait until they fix it. Errors and warnings in Windows Event Viewer are usually inconsequential. It does not sound like a firewall issue either, since you have connectivity, albeit slow.
Hi Lexiemac
May I suggest running c cleaner that has buttons on the RHS of the c cleaner screen, the two buttons you need to use are cleaner and registry, but first back up your registry with mzbackup, both the software are free. If your connection won’t allow the download maybe someone you know or an internet café. Then use Norton to scan the software for bugs before installing it. The cleaner doesn’t need a registry back up and should be used regularly to keep the system working well.
C cleaner 4 mb
http://www.filehippo.com/download_ccleaner/
mzbackup 1.2 mb seventh one down.
http://www.freewareplanet.net/registry.php?page=5
ATB
intesec
Thank you so much for replying. 
Cable repair came and checked everything. The modem is working fine. They checked the cables outside and everything was alright. They checked some of my pc settings like IE9 Security and it was alright. They plugged a netbook into my modem and it worked fine.
There is IPv6 limited connectivity though. ??? They also seem to think something is blocking downloads somewhere. The only suggestion they could make was to change the cables which means going through the attic.
I still feel something changed on my pc that caused this and I can't think where to look. Maybe a new program or virus or something. I posted the Even Viewer info because it shows something to do with Norton and Internet Settings and thought it meant something. This definitely happened suddenly.
I did an extra full system scam but haven't run Power Eraser yet. I think I've run all the Windows Network diagnostics. Don't know what else to do.
Thanks intersec. Your post showed after I had posted. Thanks for the suggestions. I will try.
I'm always wary of messing around with registry because I don't understand it well enough. I'll try c-cleaner first.
Internet cafe? I live in the middle of a sugarcane field. LOL But I'll find a way to get it on the pc.
Okay.....
I opened my computer in Safe Mode. I went to Microsoft.com images and tried to download a background image file size about 1.69 mb and it went about 50% and then just stalled. I restarted pc normally.
I have tried downloading a file of photos from SendSpace. Same thing.
I tried downloading the uninstaller for Adobe Flash Player so I could manually reinstall. Same thing. (FYI I just manually updated Flash and Shockwave on the 17th and some pages were still saying I need to install flash in both Firefox and IE9 even though my program files show the correct version. That's why I tried to reinstall.)
I had trouble opening a friends album page of images. Large images wouldn't load.
BUT...I have a program that downloads image from web pages. I went to a news page and had no trouble downloading all the pictures I wanted from the page. It did take a little longer than normal but it didn't hang or stall.
That program is listed in my Smart Firewall Program Rules as 'Auto' and when I checked Norton History firewall rules were automatically created for the program.
I still suspect that Norton settings may be blocking me from downloading anything with my browsers. I just don't understand the firewall rules or which ones to look at and possibly change.
NIS Startup Manager is showing Windows Defender User Interface is ON.
Control Panel shows it is OFF. ???
Is this a problem?
HP Pavillion
Windows Vista, SP2
Norton Internet Security 20.3.1.22
Friday night NIS ran a scheduled full system scan at 9:30 pm. I've noticed since I upgraded that I have trouble shutting down my computer if I do it right after closing my internet / browsers. I have Firefox 20 and IE9. So I usually close my browsers and wait and let NIS do whatever it has to before I shut it down for the night.
I did the same thing Friday night but Saturday morning my internet connection was extremely slow and I couldn't open some sites at all. I tried resetting my modem and the suggestion in Windows Network Diagnostics with little improvement. I can't even download a small 7MB zip file and I have Broadband.
The only thing I did with Norton settings was to look around and default everything. I don't understand about the Smart Firewall and and there are so many settings, I didn't want to mess anything up more.
When I check Security History there is a whole lot of blocking going on and I wondered if the firewall is just blocking everything. Also some "Connected to a protected network.....Your computer is currently protected from the local network."
I looked in Windows Event viewer to see what was going on just before shutting down and found this:
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 4/20/2013 1:44:25 AM
Event ID: 1530
Task Category: None
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: Bobbie-office
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001:
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-04-20T06:44:25.000Z" />
<EventRecordID>257312</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bobbie-office</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001:
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D
Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office
</Data>
</EventData>
</Event>
-------------------------------------------
Warning 4/20/2013 1:44:25 AM User Profile Service 1530 None
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-04-20T06:44:25.000Z" />
<EventRecordID>257312</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bobbie-office</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">6 user registry handles leaked from \Registry\User\S-1-5-21-2709170319-37780521-2991840718-1001: Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001 Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Windows\CurrentVersion\Explorer Process 1276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Direct3D Process 12208 (\Device\HarddiskVolume1\Program Files\Norton Internet Security\Norton Internet Security\Engine\20.3.1.22\ccsvchst.exe) has opened key \REGISTRY\USER\S-1-5-21-2709170319-37780521-2991840718-1001\Software\Microsoft\Office</Data>
</EventData>
</Event>
Hi Lexiemac
On my system Norton is disabled in safe mode only allowing a full scan. Please disable the internet before checking yours is the same by clicking on the Norton icon in safe mode. If it is disabled its not Norton, if you’d like to try what I suggested earlier but first back up your data meaning files, pics, vids it might give you a little more confidence.
There’s a link below that has one of the problems as slow internet. I realise that there were other things done but from my process of deduction from the post c cleaner had some affect. And find this text on the thread to confirm. Check the last post on the first page for,
IExplorer still slow.
and the third post on the second page
Pc so far back to normal
I really think all the advice given was useful here. The lesson is perhaps to properly uninstall your previous version of NIS with Ctrl Panel first, then with NRT. Also perform regular virus/ file/ program and registry scans (particularly the latter in my case).
http://community.norton.com/t5/Norton-Internet-Security-Norton/BSOD-or-Freeze-on-Shutdown/m-p/944595#M236427
As far as NIS and defender is concerned I’ll check and get back to you if you let me know exactly step by step where you click.
ATB
intesec
Hi intersec. Thanks for the suggestions. I just need to clarify.
I did a system scan in safe mode. There was no Norton icon in my system tray so I clicked on the Norton shortcut on the desktop. It said that some of Norton wasn't available in safe mode and did I want to start a full system scan now. I clicked start. The scan found a lot of tracking cookies as usual.
Was I susposed to unplug the broadband cable modem to do the scan? I used Safe Mode without networking.
It will be awhile before I can put C-Cleaner on a flash drive and get it on this pc. I'm waiting for my daughter to finishing restoring her pc and internet.
Yes, you're right! Backing up my files would make me feel better before runnng a registry cleaner and I can do that while I wait. Thanks for the suggestion! My computer programs are running fine. It's just my internet connection that is slow and won't let me download anything.
BTW....I do regular maintenance on my pc and have always had Norton to run on schedule and do whatever it needs to do. That's why this is so frustrating.
About Windows Defender.....I had a screen cap of all the programs in Norton Start Up Manager before the upgrade and before all the problems and Windows Defender User Interface was checked so it may mean nothing.
So for now the problem is still ongoing. I just wish I could pinpoint what caused it to begin with.
Hi Lexiemac
I’ve reread you thread and here’s some of my thoughts.
You mention running Norton power eraser I have no direct experience of this but have read these threads.
http://community.norton.com/t5/Norton-Internet-Security-Norton/Help-System-devestated-by-Zeroaccess-I-think-it-s-gone-but/m-p/948281#M236980
http://community.norton.com/t5/Other-Norton-Products/Do-not-use-Norton-Power-Erase-In-fact-might-want-to-stop-using/m-p/949429#U949429
I had a problem with my DVD drive and set up a new user account and the new user account allowed me to use the DVD drive. I’m not a techie so this may have no effect but it doesn’t take long and if you only have one user on the system and gat a ransom viruse you can’t shut the system down correctly it has to be done with a hard shutdown. But with another account it may be possible to switch users by pressing, ctrl, alt del and select switch user to shut down.
Problems with java.
http://community.norton.com/t5/Norton-Internet-Security-Norton/Is-the-most-recent-Java-update-safe/m-p/947459#M236834
Try deleting your browser history, see help and support from the start menu.
When some programmes deliver problems re-installing them sometimes sorts out the problems? Check to see you’ve got them first?
ATB
intesec
Hi Lexiemac
I’ve seen another post that has used the Norton power eraser successfully and the posting dates are the same, being 24 April 2013. I was concerned about an update that may have been causing problems but I don’t know now, but I’m going to keep a check on the forum about it. See the link below.
Fifth one down.
http://community.norton.com/t5/Norton-360/Norton-306-didn-t-delete-a-virus-and-it-cost-me-99-99/td-p/947637
ATB
intesec