Norton auto-start problem

**erickei** · August 27th, 2003, 12:57 PM

Ok...I've got an unusual one for ya.

I work at a small computer/repair shop, and we're having an unusual problem with a Norton Antivirus 2003 install on a client's WinXP Home computer. (the problem happens in Norton SystemWorks 2003 as well)...We've tried at least 3-4 separate installs now, with a complete uninstall and usage of the NAV Removal Tool (from symantec's site) after each uninstall. During each install, we sued the atest NAV update, latest virus definitions, full scans in Safe Mode each time; we even used another company's AV tool to check in order to make sure the NAV executable files weren't infected with something.

XP has the latest updates (including SP1 with the msblast fix), as does NAV. The problem is this: Norton's Auto-Protect refuses to work after installation and a single reboot. Specifically, Auto-Protect and Email Protection will not load, tho there is no warning pop-up to advise us of this (there shoudl be one)...In the past, on different systems, uninstallation and reinstallation solved the problem, but not so this time. I tried going into Options and making sure AutoProtect is turned on, but each time, after hitting OK, the checkboxes would clear themselves immediately, and the AP would not load up.

I went into Services to check AP's dependencies (RPC only), which were starting properly as Automatics; the AP and Norton Event Manager were set to auto-start, but did not start properly (AP says it started in Services, but NAV says it's not working; NEM's started/stopped field was blank). In Event Viewer, I got the following messages (hand typed, on 2 different comps here):

ERROR: EventID: 13
ccEvtMgr - user: NT AUTHORITY\SYSTEM
description: ccEvtMgr: Application Tempering Detected, terminating process!

INFO: NProtect Service - started
INFO: ccPwdSvc - started (self-terminates shortly after loading); then, terminated on its own.

I checked Task Manager for any unusual processes, msconfig for unknown startup items, cleared the Startup folder, etc. Nada.

Symantec's service site wasn't very useful for this, either.

Can anyone help out here? Thanks in advance.

edit: edited for clarity

**NooNoo** · August 27th, 2003, 01:09 PM

Originally posted by erickei

ERROR: EventID: 13
ccEvtMgr - user: NT AUTHORITY\SYSTEM
description: ccEvtMgr: Application Tempering Detected, terminating process!

INFO: NProtect Service - started
INFO: ccPwdSvc - started (self-terminates shortly after loading); then, terminated on its own.

Did you cut and paste this event id or did you type it by hand? If it was cut and paste, that is not norton - tampering is spelt with an A!!

**Matridom** · August 27th, 2003, 01:27 PM

And welcome to windrivers....

**DocPC** · August 27th, 2003, 01:38 PM

Blaster?

**erickei** · August 27th, 2003, 02:40 PM

noonoo - no, hand typed and I was evidently in a hurry and I wanted to summarize, I am on 2 different comps (typing from my comp, the problem is on another system)

Matridom - thanks ^_^

doc - nope, as I said, windows is updated with all patches...plus, I checked Task Manager to see if it was running. Moreover, unless I'm terribly mistaken, if I had blaster, I wouldn't be able to stay online long enough to po-*error: connection reset by peer*

**NooNoo** · August 27th, 2003, 02:53 PM

I declare Doc the winner!

Seriously, all points to msblaster or a variant thereof still going undetected.

**erickei** · August 27th, 2003, 05:16 PM

Possible, but unlikely - blaster would force my comp to shutdown as soon as it detected that I was online, and that hasn't happened. I'm not sure if a virus is interfering with NAV or what...this type of thing IS a known problem with NAV, but their workarounds didn't help. At all.

**Snowbound67** · August 27th, 2003, 08:35 PM

The last time I had a prob with NAV Auto-Protect not loading on 1 of my PC's, the harddrive (40 GB Fujitsu) went south on me, and I had to replace it.

My thoughts.

**Archer** · August 28th, 2003, 05:10 AM

Just a thought you've not got Ad aware`s Ad watch running on the system in the background have you,as this can prevent registry keys installing sometimes?

**CeeBee** · August 28th, 2003, 06:34 AM

For all the NAV problems my fix is this:
-uninstall NAV
-backup the registry!!!!
-manually delete all registry entries that reffer to "Norton Antivirus" (this is a pain, takes about 20 minutes and seems to never end)
-reboot
-reinstall NAV
It has worked every single time so far.

**erickei** · August 28th, 2003, 01:58 PM

Good point on Ad-Aware, but we're using the free version.

We tried uninstalling, reg-editing and reinstalling several times to no avail. After 2+ hours on the phone trying to ge tthrough to a human at Symantec's tech support, we finally threw in the towel and put McAffee on there instead, the alternative being to wipe the system and start over.

Oh well, thanks for your help anyhoo

**geoscomp** · August 28th, 2003, 02:08 PM

Just out of curiosity, did you delete the antivirus definitions folder after uninstalling and cleaning the registry of all norton items?

here is what Symantec has to say about it

Thread: Norton auto-start problem

Thread Tools

Display

Norton auto-start problem

Re: Norton auto-start problem

Bookmarks

Bookmarks

Posting Permissions