Norton Antivirus 2003: ccapp.exe hangs during shutdown . . . suggestions?

[Tarobap]

I have Norton 2003 installed on XP SP1 and have tried everything I know to fix the following problem: when I shutdown the system, the icons in system tray disappear one at a time . . . until it gets to NAV2003 . . . at which point it hangs for about 2-3 seconds, and then the "End Now"screen appears and kills "ccapp.exe" and then the rest of the system shuts down. I just formatted my HD, and after installing NAV2003, it works normally (during shutdown) for some while, but after several boots, it does what I described above. Maybe one of the other programs I installed is interfering with it. I've reformatted over 4 times now to fix this!!!

My questions for fellow ATers:
1. Does anybody else have this problem? Solutions?
2. Will this interfere with background scanning and NAV performance?
3. Should I switch to AVG?

I'm running this on a HP 1210 Laptop (bought at Staples for your hotdeals peeps . . . mebbee one of you has one )

Thanks people . . .

 

[bsobel]

Got your PM, ccapp is indeed one of ours. Let me ask the consumer team tomorrow if they've seen this...
Bill

 

[LiLithTecH]

ccApp.exe (Common Client App) new to NAV2003 (is not used in Nav2002)
is tied to Outlook, Outlook Express, IE, Windows Explorer.

Have you tried DISABLING Norton then shutting down to see if the problem persists?

 

[Tarobap]

Thanks Bill for looking into it for me . . .

LiLithTecH . . . yeah disabling autoprotect fixes the problem . . . but dats a pain in the @ss to do everytime. You say ccapp.exe is tied into outlook express, windows explorer, and IE . . . did not know that. . .

Thanks guys . . . hopefully Bill will have a solution . . . or anyone else for that matter . . .

 

[mikable]

ccapp.exe also seems to limit programs that use DirectX. I can't get programs like Age of Mythology, and Shadowflare to work unless I shut ccapp.exe down first.

 

[Bytre]

mikable, was your ccapp / directx conflict with NAV, or with NIS or NPF? We do have a fix for a NIS/NPF "Alert Tracker" related problem pending release in a liveupdate, but it is not in NAV. ccApp hosts a number of different services, so it is difficult to generalize with it.

Tarobap, what operating system are you using, and what version of the product? There were two potential shutdown issues fixed with a previous liveupdate, but I want to make sure it isn't something else. Also, if you turn off boot record scanning (in the NAV options), does the problem persist?

Brendon Woirhaye
Symantec Corporation

 

[bsobel]

Originally posted by: mikable
ccapp.exe also seems to limit programs that use DirectX. I can't get programs like Age of Mythology, and Shadowflare to work unless I shut ccapp.exe down first.

I was gonna jump in with what I got in email, but I see Brendon's already here
Bill

 

[Tarobap]

This is great . . . people from Symantec helping us!!! Much thanks . . .

I'm runing XP Pro Service Pack 1 with all updates, and NAV 2003 with most recent virus definitions and all updates as well, including the "redirector" (whatever that is).

The "boot record scanning" option I only found on Manual scanning . . . and disabling it did nothing for me.

I have script blocking on, comprehensive file scanning, office plugin disabled, and auto scanning of incoming email only . . . if that helps at all.

Call me a perfectionist I guess . . . I like my boot up and shut down to be smooth and error free. I'm assuming my NAV is working but something is just messing it up during shutdown . . . safe assumption?

Again thanks for any help . . . I found a thread on this same problem a while ago (can't seem to dig it up now) . . . people were saying that windows is trying to shutdown before giving ccapp enough time to shutdown and so the "end now" kills it. I didn't know what to make of that . . . prolly a bunch of bull . . . just FYI . . .

Cheers

 

[ggupta]

yeah. so, I am having the same problem as well, but usually, windows is able to shut down ccapp after a few seconds. It brings up one of those wait to end the program boxes at shutdown. So my question is, are you saying that there will soon be a fix that will be downloaded by liveupdate? or do i have to go get the patch on the website? and i have to say that its pretty sweet that symantec folk are helping out on this. makes anandtech a pretty sweet forum. thanks.

 

[MDesigner]

I've given up on Norton Antivirus and am switching to McAfee. I get random blue screens when auto-protect is turned on. If it's off, everything is cool. The last blue screen I got w/ NAV, I loaded up the windebugger and pinpointed the crash to SYMEVENT.SYS

 

[bsobel]

Originally posted by: MDesigner
I've given up on Norton Antivirus and am switching to McAfee. I get random blue screens when auto-protect is turned on. If it's off, everything is cool. The last blue screen I got w/ NAV, I loaded up the windebugger and pinpointed the crash to SYMEVENT.SYS

MDesigner, different issue obviously, but first do you have the latest Symevent (either via liveupdate or download from us?). If so can you send me your machine specs, the symevent guys would definately like to get more details.

Best,
Bill

 

[MDesigner]

Originally posted by: bsobel

Originally posted by: MDesigner
I've given up on Norton Antivirus and am switching to McAfee. I get random blue screens when auto-protect is turned on. If it's off, everything is cool. The last blue screen I got w/ NAV, I loaded up the windebugger and pinpointed the crash to SYMEVENT.SYS

MDesigner, different issue obviously, but first do you have the latest Symevent (either via liveupdate or download from us?). If so can you send me your machine specs, the symevent guys would definately like to get more details.

Best,
Bill

Stats: AMD Athlon 900MHz WinXP 512MB RAM
SYMEVENT.SYS version: 11.0.1.1

 

[bsobel]

SYMEVENT.SYS version: 11.0.1.1

That one is a bit older (I'm on 11.0.2.2 here). You should see the update via LiveUpdate or you can grab 11.1.0.7 from here. Let me know if that does or doesn't resolve the issue.

Best,
Bill

 

[bsobel]

Originally posted by: ggupta
yeah. so, I am having the same problem as well, but usually, windows is able to shut down ccapp after a few seconds. It brings up one of those wait to end the program boxes at shutdown. So my question is, are you saying that there will soon be a fix that will be downloaded by liveupdate? or do i have to go get the patch on the website? and i have to say that its pretty sweet that symantec folk are helping out on this. makes anandtech a pretty sweet forum. thanks.

We haven't (yet) identified the issue here (e.g. if it's known and fixed, known and still in work, or unknown). The update that was refered to does help for the DirectX issue that was raised. It should be available via LiveUpdate within a week.

Best,
Bill

 

[MDesigner]

Originally posted by: bsobel

SYMEVENT.SYS version: 11.0.1.1

That one is a bit older (I'm on 11.0.2.2 here). You should see the update via LiveUpdate or you can grab 11.1.0.7 from here. Let me know if that does or doesn't resolve the issue.

Best,
Bill

Oh wow, don't know how I missed that. Got it. Autoprotect is back on (braces himself). We'll see how it goes...

BTW, did you know NAV does not catch some instances of the syscfg32.exe (Backdoor sdbot virus) unless the bloodhound is set to paranoid? Default setting is "normal" or something like that. You guys ought to look into that...very very dangerous.

 

[bsobel]

Autoprotect is back on (braces himself). We'll see how it goes...

Crossing fingers here I can't find the older thread, where you the person on the Highpoint RAID controller?

BTW, did you know NAV does not catch some instances of the syscfg32.exe (Backdoor sdbot virus) unless the bloodhound is set to paranoid? Default setting is "normal" or something like that. You guys ought to look into that...very very dangerous.

Actually thanks to someone here (actually, it might have been you in an older thread), we should now a) be catching it correctly at the normal level with the current defs and b) be updating the backend system (scan & deliver) to test against the low heuristic setting (S&D was testing against with it's bloodhound set to high, thus causing some confusion as S&D saw it but you didn't with bloodhound set to anything below high). For the future that should fix the problem of you attempting to report it and the automation saying we already know about it with current defs because of the level mismatch.

Best,
Bill

 

[VicodiN]

Any reason NAV'03 Pro causes Win2kPro to NOT shutdown properly? I can never shutdown my Windows properly now with NAV'03 Pro installed... I uninstall NAV, and voila! Proper shutdown... Instead of 'Shutting Down' my Win2kPro will 'Restart'... Odd =/ and quite irritating.
Rather then start a whole new thread, I figured someone would get a gander of this thread and hopefully help me out..
Thanx fellas.

 

[MDesigner]

Ok.. bad. Worse than ever. System lockups & stuff.. no BSODs though.

I don't think this is entirely NAV's fault. I have some pretty weird hardware & software going on.. but you guys should look into it anyway.

I use Dantz Retrospect Backup 6.0.. seems to act odd when autoprotect is on.

Weird hardware: sound card = M-Audio Delta Audiophile 2496 (www.m-audio.com)
Weird software: GigaStudio96 (www.nemesysmusic.com)

I've never had probs w/ NAV until I installed the above. I have a feeling it's the Audiophile card and GigaStudio. I really just need a separate machine for my musical composition work, that's all.

 

[bsobel]

Ok.. bad. Worse than ever. System lockups & stuff.. no BSODs though.

What Symevent version did you wind up with after the update?

Bill

 

[mikable]

mikable, was your ccapp / directx conflict with NAV, or with NIS or NPF?

Hmmm, I got the whole gauntlet of Norton protection products installed! NAV NIS NPF. I'd really love to re-enable autoprotect so I hopw the upcomming update solves it.

 

[Bytre]

There are updates in the works for SymEvent (to 11.1.0.7), Norton Antivirus (to 9.05 I think), Norton Personal Firewall (6.03), and Norton Internet Security (6.03). I do not like to quote dates because we won't ship them until they are ready, but I will say that we are close on them. I do not know if they will address the issues mentioned here. I'd appreciate it if you could try the NAV update, Tarobap & ggupta, and let me know if your shutdown issue is or is not solved with it. If not, I'd like to work with you futher to figure it out.

Regarding highpoint - there is a known problem with a highpoint 374 chipset driver, which is actually Highpoint's fault. Their advice to us was to tell people to use the drivers that shipped with Windows. We should have a knowledge base article on it somewhere on our support site, and there is also a similar KB article on Microsoft's support site discussing the problem without any Symantec involvement. We should have as workaround for it built into SymEvent 11.1.

MDesigner, if you do get a bluescreen with autoprotect on, try to do a full memory dump, and get the dump to us. We can analyse it and pinpoint the problem. The mini dumps are considerably less useful.

Also, if you find something that autoprotect does not catch, you can submit it via scan and deliver to our AV response center.

Brendon Woirhaye
Symantec Corporation

 

[Tarobap]

Brendon--

Thanks for addressing the issue . . . I will try the updates and report how they work!

 

[ggupta]

While I know that I can get ahold of Norton people, I have a question. I am trying to get Speed Disk to run a defrag before windows boots up. I am running win 2k and just like you can get disk doctor to do its checking before windows loads, i want to defragment at boot up, in that fun text mode. it would be really cool if you could show me how to do this. thanks.

 

[Bytre]

>> I am trying to get Speed Disk to run a defrag before windows boots up. I am running win 2k and just like you can get disk doctor to do its checking before windows loads, i want to defragment at boot up, in that fun text mode. it would be really cool if you could show me how to do this. thanks.

SpeedDisk on 2k can move all clusters within windows, it doesn't need a console mode like some of the competition (and thus doesn't have one). I'd recommend setting it on a schedule to go in the background when you're not using your machine. That's how I've got all mine set up.

 

[Bytre]

The first of the updates is available (for common components). It should, among other things, address the directx issue.