• Gesamte Community
    • Gesamte Community
    • Foren
    • Ideen
    • Blogs
Erweitert

Nicht was Sie suchen? Die Experten fragen!

Danksagungen0

Symantec, what is ...this???

XP SP3 with NS installed.

Ok, I uninstalled/reinstalled NS 4-5 times just to be sure.

EACH time a new set of Virus defs is delivered, after the idle quick scan, (idle timer set to 2 minutes), after completion of scan IF I continue to leave my pc in idle state, about 4-5 minutes more, there is a HDD activity starting and at the same time network exhange packets from/to my router.

This activity, the first time I install NS lasts 40 mins, and subsequent idle quick scans make this activity occuring for about 5-10 minutes.

I enabled, on purpose, the Performance Graph to pick some info but NS shows this HDD thrashing as "No activity".

See image attached below. (zip file).

I'd like to know if this is by design, what is it and if it's a bug.

Hope also that it is not the SRTSP NIS 21 issue revisited.

I will not install NS on both my W7 x64 systems, if I have not clear info from Symantec before...

Thank you.

Dateianhang: 

Antworten

Danksagungen1 Stats

Re: Symantec, what is ...this???

XP is EOL. I am surprised it would even work with NS.

Danksagungen0

Re: Symantec, what is ...this???

Quoted from Symantec for NS and NSwB (v.22)

System Requirements

Operating Systems Supported

  • Microsoft® Windows® XP (32-bit) Home/Professional/Tablet PC/Media Center (32-bit) with Service Pack 3 (SP 3) or later
  • Microsoft Windows Vista® (32-bit and 64-bit) Starter/Home Basic/Home Premium/Business/Ultimate with Service Pack 1 (SP 1) or later
  • Microsoft Windows 7 (32-bit and 64-bit) Starter/Home Basic/Home Premium/Business/Ultimate with Service Pack 1 (SP 1) or later
  • Microsoft Windows 8/8 Pro (32-bit and 64-bit)
  • Microsoft Windows 8.1/8.1 Pro (32-bit and 64-bit)
  • Current and previous two versions of Mac OS® X
  • Android™ 2.3 or later (must have the Google™ Play app installed)
  • iOS® 6 or later
Danksagungen3 Stats

Re: Symantec, what is ...this???

Second screenshot including Performance Graph Memory, in case of needed.

P.S. FattiesGoneWild, I was not waiting for your comment to be aware that XP is EOL, if you read NS System Requirements XP is still supported.

You do not use XP, fine, so it does not concern you, fyi, I have also 2 x W7 x64 systems and I can tell you from experience that usually, if there are problems with XP and Norton, like a recent SRTSP issue, it affected, before it was fixed, all platform OS's.

This particular issue seems to affect XP, for the moment....

Cheers,

Dateianhang: 
Danksagungen0

Re: Symantec, what is ...this???

They should remove line about XP support since this OS is obsolete. But if they want to... Well, I bet they have real issues to deal with, other then fighting with dead OS.

Danksagungen0

Re: Symantec, what is ...this???

I know you did not get the answer you want or wanted to hear. But. Its still a waste of time and resources to assist. You should upgrade to 7 or 8. Whatever issues that may pop up with XP. I would assume its at the lowest level of priority. Why Symantec would even try to support a dead OS is beyond me. Good luck.

Danksagungen11 Stats

Re: Symantec, what is ...this???

I don’t think it is proper for other members to post negative comments when XP is mentioned.

There could be a variety of valid reasons why people still run XP.  It could be due to financial constraints, due to specialized software/hardware which was designed exclusively for XP or numerous other scenarios.

Similar to Apostolos, I have two XP machines in addition to two Windows 7 x64 machines.  And yes, I am aware that XP has reached EOL, thank you.

I have over $3,000 invested in Adobe Creative Suite software which is not compatible with Windows 7, yet it still performs the required tasks very well on my XP systems.  One of my XP machines has a rather expensive Matrox video capture and graphics acceleration card which is designed for high quality video editing and it also will only run on XP. The finished projects turn out beautifully and no one can tell which operating system was used for production.

The point is that as long as Symantec lists XP as a supported platform, discussions about XP are legitimate and should not be judged by others.

"Anyone who isn't confused really doesn't understand the situation."   Edward R. Murrow
Danksagungen0

Re: Symantec, what is ...this???

"

Similar to Apostolos, I have two XP machines in addition to two Windows 7 x64 machines.  And yes, I am aware that XP has reached EOL, thank you.

I have over $3,000 invested in Adobe Creative Suite software which is not compatible with Windows 7, yet it still performs the required tasks very well on my XP systems.  One of my XP machines"

Amen!!

Thank you Phil_D,

I already mentionned, but other users did not even bother to read, that I also have 2 W7 x64 machines and I have as well Photoshop CS full suite which is not compatible with W7 x64.

I also have, sound editing expensive sw which is not compatible with W7.

I've raised this issue because it is highly reproducible, each time a new set of Virus set is installed, if the pc remains idle 4-5 minutes after the idle quick scan has finished.

I have this machine since 2005, it came with NIS 2005 preinstalled, I had all subsequent NIS versions installed and the issue was not present.

I installed NIS 14 for a while again, everything is smooth, then, when reverting back to NS it comes back.

FYI, this activity is NOT logged in NS History nor in XP Event Viewer, according to NS Performance Graph it's something related to NS.exe.

Any other constructive comments are welcome.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

"There could be a variety of valid reasons why people still run XP.  It could be due to financial constraints, due to specialized software/hardware which was designed exclusively for XP or numerous other scenarios.

Similar to Apostolos, I have two XP machines in addition to two Windows 7 x64 machines.  And yes, I am aware that XP has reached EOL, thank you.

I have over $3,000 invested in Adobe Creative Suite software which is not compatible with Windows 7, yet it still performs the required tasks very well on my XP systems.  One of my XP machines"

Amen!!

Thank you Phil_D,

I already mentionned, but some users did not even take the time to read, that I also have 2 x W7 x64 systems and yes I have Photoshop CS Full suite which is not compatible with W7.

Similarly, I have very expensive Sound editing sw which will run only on XP.

I have this laptop since 2005, it came with NIS 2005 preinstalled, and all subsequent versions of NIS gave me no trouble.

The issue is highly reproducible ONLY when a new set of Virus defs is installed,if the pc remains at idle state 4-5 after the idle quick scan has completed.

I tested again with NIS 14, everything runs properly, when I switch to NS the issue is back.

FYI, this activity is NOT logged in NS Security History, neither in XP Event Viewer and according to NS Performance Graph it's NS.exe related.

Any other constructive comments are welcome.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Ok, just ran a manual LU, new set of Virus defs, same old story.

The problem is, imo, that most XP users are still on NIS v.21 , thus the lack of several posts reporting that issue... with NS.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Apostolos  wrote: Hope also that it is not the SRTSP NIS 21 issue revisited.

Hi Apostolos:

Have you checked the threads running under NS.exe with Process Explorer to see if SRTSP.SYS is the specific Symantec process responsible for the high activity, as described in the thread NIS 20.x SRTSP.SYS (Real-time AutoProtect) High CPU and I/O Reads During Idle?  I know you're familiar with that thread, and it's just about time that I gave it another bump to prevent the forum mods from locking it again.  Elsewhere and I both observed this SRTSP.sys bug on 32-bit Windows machines and I'd be very interested to know if the problem still exists in NS.
-------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 32.0.3 * IE 9.0 * NIS 2013 v. 20.5.0.28
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Danksagungen0

Re: Symantec, what is ...this???

Are you able to trace the network activity you mention? As the new NS is supposed to rely more and more on cloud based detections, it could be these features kicking in when system is idle.

Things happen. Export/Backup your Norton Password Manager data.
Danksagungen0

Re: Symantec, what is ...this???

Hello Lori,

I tried on several occasions to capture this activity with PE, BUT there is a problem, this activity seems to depend on NS idle handlers because as soon as I try to look in PE this activity stops instantly.

How am I supposed to look at it???

A few more info:

1) If I leave my pc idle, but NS has not installed any Virus defs, this activity never occurs.

After about 25 mins of idle time, there is the Windows normal background tasks but everything is logged in Event Viewer so it's not windows related imo.

2) this pc connects via wireless adapter & the NS Firewall Network setting is set to "Private" as it should.

 I could disable the wireless adapter after ran LU, and check if it's NS Network related but I do not see how it could help.

3) As other users already mentionned, with both W7 & W8, there are shutdown issues, I'm seeing this also on XP but it's not as severe as in W7 where pc's take 5-10 mins to shutdown.

The delay in XP is 30-40 seconds in addition to normal, AND during that time there is a high pitched strange sound coming from the HDD, but pc eventually shuts down.

Cheers,

Danksagungen0

Re: Symantec, what is ...this???

Peter,

I believe that you are on the right "path", that is why I asked to Symantec if this is by design or a potential bug.

One thing I find "odd" is that, according to W7 & W8 users I have PMed, this activity is not happening.

I also tried some netstat commands but when I try to use the keyboard the activity stops immediately.

Let me know if you need more info...

By the way, are the zip folders I've uploaded with .jpeg pics show anything valuable to you??

Regards,

Danksagungen0

Re: Symantec, what is ...this???

@ LMacri,

If you have some time, please take a look at my uploaded jpegs.

You will notice that the graphs are somewhat different from the graphs inside the links you provided.

You may see that after the Yellow NS idle quick scan activity, everything stops, there is no Blue or Yellow activity for 4-5 minutes, then the Blue activity starts again.

The graphs describing the SRTSP issue with NIS v.20 & v.21, show constant activity, no activity+pause+activity...I think.

Again, if I revert to NIS 14 nothing of the above is present.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Peter,

I believe that you are on the right "path", that is why I asked to Symantec if this is by design or a potential bug.

One thing I find "odd" is that, according to W7 & W8 users I have PMed, this activity is not happening.

I also tried some netstat commands but when I try to use the keyboard the activity stops immediately.

Let me know if you need more info...

By the way, are the zip folders I've uploaded with .jpeg pics show anything valuable to you??

Regards,

 I only threw this out as I have not yet upgraded to NS. Hopefully someone else can test this theory.

Things happen. Export/Backup your Norton Password Manager data.
Danksagungen0

Re: Symantec, what is ...this???

Ok, quick update:

Ran manual LU , Virus defs installed, but this time left taskmgr opened.

Same scenario, when the post idle quick scan activity occurs, now there is no network exhange traffic.

The invoqued processes in taskmgr are:

NS.exe, under System, CPU usage and memory usage constantly changing (CPU usage from 0-3%, memory from 10-20 MBs)

System,  CPU usage constantly changing, memory usage unchanged

System Idle Process,  CPU usage constantly changing, memory usage unchanged.

Hope this helps,

Regards,       

Danksagungen0

Re: Symantec, what is ...this???

" as if you had an entire core of your CPU saturated by this unidentified activity that occurred both inside and outside of a system idle "

Hi Lori,

I will check with PE when next Virus defs will be available and report back.

FYI, this XP laptop has a single core Intel M760 CPU which supports SSE2 instruction, although very old.

Regards,

Danksagungen1 Stats

Re: Symantec, what is ...this???

Apostolos wrote:

You may see that after the Yellow NS idle quick scan activity, everything stops, there is no Blue or Yellow activity for 4-5 minutes, then the Blue activity starts again.

The graphs describing the SRTSP issue with NIS v.20 & v.21, show constant activity, no activity+pause+activity...I think.

Hi Apostolos:

I looked at your images last night - NS.jpg looked very similar to my issue (blue peaks labeled as "No Activity" during a system idle immediately following a Norton Quick Scan) but NS2.jpg looks completely different - as if you had an entire core of your CPU saturated by this unidentified activity that occurred both inside and outside of a system idle .  I noticed in NS2.jpg that the Performance graph says that NS.exe, Windows Explorer and your Intel wireless event log service accounted for only 6% of your CPU so some unidentified process referred to as "No Activity" in Norton's Performance graph accounted for a significant portion of your total CPU consumption.

Launch Process Explorer, choose View | System Information | CPU and let it collect data in the background until one of these periods of high CPU activity occurs.  The CPU graph in Process Explorer will display the past 15 min or so of CPU activity on your system, and just like the Norton performance graph, you can click inside this graph and see a pop-up listing all the processes that were running at the time of your high CPU .  In my case Process Explorer shows that this "hidden" activity labelled as "No Activity" in the Norton Performance graph can actually be attributed to the generic Windows System process, and not ccSvcHst.exe or NIS.exe (see the screenshots here).

Once you've identified which process is responsible for this "hidden" activity on your own machine (for example, System or even NS.exe), right click on that process name in the main Process Explorer window, choose Properties, and monitor that Properties window in real-time until the high activity returns again.  Note the name of the thread (the Start Address in Process Explorer lingo) that is consuming most or all of the CPU and try to grab a quick screenshot before the process stops.  In my case, a thread for SRTSP.SYS (Symantec Real-time AutoProtect) that runs under the Windows System process accounts for all my "hidden" activity but it might be completely different on your computer.

Just FYI, both elsewhere and I have observed that once this "No Activity" starts on our systems, it will pause when we bring our system out of idle but will usually restart again during every subsequent system idle.  This will continue until we reboot, and then we have to wait for the first post-reboot Virus Definitions update and subsequent idletime Quick Scan to see this SRTSP.SYS "No Activity" re-appear again.  This high CPU activity labeled as "No Activity" in Norton's Performance graph doesn't appear on my system as consistently as it used to, but it does pop-up every few days - I heard my fan going into overdrive today during a system idle and checked to see if my monthly full system scan was running, and there was that same "No Activity" by SRTSP.SYS thrashing my hard drive and chewing up my CPU following my first Quick Scan of the day.
-------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 32.0.3 * IE 9.0 * NIS 2013 v. 20.5.0.28
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Danksagungen0

Re: Symantec, what is ...this???

Lori,

I forgot to mention that if it turns out to be the SRTSP issue revisited, this will make me very furious because it would indicate that Symantec team, even if people are coming and go there, should have a "previously fixes" guide pinned on a wall so old issues do not come back after every release but that would not be the case,... unacceptable...

But it's too soon now to jump to results.

Thank you for your time, appreciated.

Salutations distinguees,

Danksagungen0

Re: Symantec, what is ...this???

Hello Apostolos,

Could you clarify what you mean by "HDD Thrashing". Do you mean that the HDD light is on ? If so I am not seeing anything out of the ordinary for the situation you've pointed out. When definitions are downloaded, it triggered the start of a background scan of certain files/processes, relinquishing control if it senses that the machine is being used for something else. So depending on many factors related to what else is running on your machine, this scan could take a while. Also, NS adds cloud scanning of files, hence your observation of network traffic.

Is the above behavior affecting your usage of the machine in any negative way ?

Also, XP doesn't have some of the more sophisticated APIs that are available on Windows 7 and above that have to do with idle time, optimized I/O etc. These are likely playing a part in the behavior you are seeing on XP. 

Best Regards,

Shane

Danksagungen0

Re: Symantec, what is ...this???

"

Is the above behavior affecting your usage of the machine in any negative way ?

Also, XP doesn't have some of the more sophisticated APIs that are available on Windows 7 and above that have to do with idle time, optimized I/O etc. These are likely playing a part in the behavior you are seeing on XP. "

Hello again shane_pereira,

If I understand you correctly, this behavior might be by design because XP doesn't have some advanced API's.

FYI, it does not affect at all my work, as long as you confirm that it will not damage my pc and one question, if I may, it should not happening with Windows 7 & above OS's, am I correct??

Please, take also some time to see mine & other users reports about LONG shutdown & restart timings across all OS's because it is also very serious, to the point that I won't install NS on both my W7 x64 machines until it is fixed...

Thank you for you time in answering my questions/concerns.

Best regards,

Danksagungen0

Re: Symantec, what is ...this???

shane_pereira,

Yes, by HDD thrashing I mean the HDD led constantly blinking and as you described "Also, NS adds cloud scanning of files, hence your observation of network traffic." might cause this, BUT, this is happening AFTER COMPLETION of the idle quick scan, followed by some minutes of idle inactivity, usually 3-5 mins, after what  the "issue" is trigerred.

I cannot explain it better, if other users could assist it would be great.

The described issue does not affect my work and if I understand correctly lack of advanced API's on XP could be the cause??

As long as you confirm that it is by design and that won't harm in long term my pc, I should be OK, BUT why all NIS versions including v.21 did not have that problem???

Other users also, including myself, have noticed LONG shutdown & reboot timings across all OS's and I won't install NS on both my W7 x64 machines until it is fixed for good.

Thank you in advance in answering to my questions/concerns.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Hello Shane_pereira,

I will try to explain again, although I think I already did.

The idle backround activity occurs after the idle quick scan has finished scanning. Here how's it's happening:

I'm running a manual LU and a new set of Virus defs is downloaded/installed. The NS idle timer is set to 2 minutes. After 2 mins idle quick scans runs for about 2-3 minutes and completes.

Now after completion I continue to leave the pc idle, iow I'm doing nothing, then after a few minutes there is an idle background activity related to NS.exe and System & System Idle process and from time to time a network exhange.

Keep in mind that IT HAS NOTHING to do with other idle NS background tasks like Product maintenance, Licencing maintenance etc.

Also, everything related to NS Auto LU, Optimizer, File CleanUP, and whatever task NS might want to perform is manually disabled by me.

Let me know if you need more info..

Thank you.

Danksagungen0

Re: Symantec, what is ...this???

Shane,

Regarding this statement: "Also, NS adds cloud scanning of files, hence your observation of network traffic."

Could you please explain exactly what "cloud scanning of files" means?

Are files being transferred from a customer's computer, through the cloud (internet), to a Symantec server, where the files are then being scanned?

Danksagungen0

Re: Symantec, what is ...this???

" Are files being transferred from a customer's computer, through the cloud (internet), to a Symantec server, where the files are then being scanned?"

Hi geek47,

Unless only some files are being tranferred, most likely hashes, I do not think that it's possible to upload all your files to a Symantec server,in a few minutes, unless you have a Gigabit upload connection.

I believe that the Pulse defs database is in the cloud and local files are also scanned by using that database too when required, in addition to the local NS Virus db.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Shane,

I tried searching on the term "cloud scanning" and found this thread:

https<colon><slash><slash>community<dot>norton<dot>com<slash>forums<slash>sonar-7

Could you also address the issues that were brought up in that thread regarding the effectiveness/safety of Norton Security if the end user does not have an active internet connection?

Some quotes from the referenced thread (I am not saying these quotes are true; I am asking for your comments on the thread and these quotes):

"Norton Security’s SONAR feature fails to protect users big-time if an internet connection is not present at the time when the user runs the program in question."

The Norton Security products cannot be deployed while this issue remains unresolved. If SONAR needs an internet connection in order to work effectively, then SONAR needs to check for an active internet connection upon file execution. If an active internet connection can’t be found, then SONAR needs to follow Norton Download Insight’s lead above and prompt the user with a recommendation to “not use this file unless you know that it is safe”

I hope Symantec will seriously consider restoring local SONAR scanning before the official launch of  Norton Security v. 22.x., or at the very least make it more difficult for the user to execute a file with an unknown reputation when SONAR is not available.

Now Symantec has decided to move SONAR's real-time heuristic scanning off the local hard drive and into the cloud in v. 22.x, compromising system security if the user is not connected to the Internet (or presumably, if connections to the backend Symantec servers are temporarily unavailable).  Having SONAR residing in the cloud might simplify updates to the behaviour-based protection, but at what cost to the user?

Download Insight gives unknown files a Good trust rating (one step below Norton Trusted) and most users would assume that a Good trust rating means the file is safe to use.  PRIOR demonstrated how easy it is to run these files in his videos.  Up to now, Norton's premise has always been that SONAR's real-time heuristic detection will intervene and remove the unknown file if it behaves maliciously during execution.  Now that SONAR has moved to the cloud in v. 22.x we have lost that secondary check for malicious behaviour if the user is disconnected from the Internet.

AVG, AntiVir, ESET, Panda and several other popular free and subscrition-based antivirus programs flagged this installer as suspicious/malicious (it was bundled with PUPs and trojans) while Norton's Download Insight gave this unknown file a Good trust rating.

Danksagungen0

Re: Symantec, what is ...this???

I've also noticed a new behavior in NS idle background tasks.

With all the previous versions of Norton I can remember, the Norton Insight idle backround task was trigerred every 24 hours at minimum, not before.

With NS, if I leave my pc idle, especially today, this idle task ran 3 times each one with status of "completed", so I guess it's a new implemented behavior..

Regards,

Danksagungen0

Re: Symantec, what is ...this???

@Geek47,

No disrespect from my part, but you should create another thread for this.

This thread is about NS idle background activity, now if we add Sonar and Toolbar and other, this thread will become... hope you see what I mean.

Thank you.

Best regards,

Danksagungen0

Re: Symantec, what is ...this???

Thanks Lori for your assistance, really helpful.

By the way, did you see my previous post about Norton Insight Idle backrground task?? Seems like totally new behavior...

Regards,

Danksagungen0

Re: Symantec, what is ...this???

shane_pereira wrote:

Could you clarify what you mean by "HDD Thrashing". Do you mean that the HDD light is on ? If so I am not seeing anything out of the ordinary for the situation you've pointed out. When definitions are downloaded, it triggered the start of a background scan of certain files/processes, relinquishing control if it senses that the machine is being used for something else

Hi shane_pereria:

If you unzip the the first screenshot NS.jpg that Apostolos attached here, you will notice two things that indicate that this disk thrashing and high CPU activity is not a typical Norton idletime task:

  • The performance graph labels the process as "No Activity" (not NS.exe) if no other software is consuming CPU (i.e.., when browsers, the Norton GUI, Process Explorer, etc. are all closed)
  • The activity is shown as blue peaks, not the normal yellow peaks associated with CPU activity by a Norton process

At this point I am unclear if this is the same bug discussed here for NIS v. 20.x and NIS v. 21.x where Process Explorer showed that this high activity is caused by SRTSP.SYS (Symantec Real-time AutoProtect), but here's a screenshot from my own 32-bit Vista machine running NIS v. 20.5.0.28 that's very similar to what Apostolos is observing in NS v. 22.0.0.100:

EDIT:

I'm guessing that the "cloud scanning" that shane_pereria referred to means scanning using the latest definitions that reside in the cloud on the Symantec servers, in much the same way that traditional idletime Quick Scans use virus definitions from the local hard drive and add an additional Insight Network cloud scan if Insight Protection (Settings | General | Other Settings | Insight Protection) is enabled in NAV/NIS/N360.
-------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 32.0.3 * IE 9.0 * NIS 2013 v. 20.5.0.28
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Danksagungen0

Re: Symantec, what is ...this???

Apostolos,

>No disrespect from my part, but you should create another thread for this.

Done ... thanks for the suggestion.

Danksagungen0

Re: Symantec, what is ...this???

Hi Apostolos:

I just read a post here in the Tech Outpost board by Krusty13 about CCleaner v. 4.18.x and NS that piqued my interest.  If you have CCleaner installed on your system, are you running the latest v. 4.18.4844 released 26-Sep-2014 (v. 4.18.4842 released 25-Sep-2014 was quickly pulled because of a bug in the new Active Monitoring feature)?  If you suspect that CCleaner might be involved, try uninstalling it and see if the CPU activity shown as "No Activity" in your performance graph disappears.
-------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 32.0.3 * IE 9.0 * NIS 2013 v. 20.5.0.28 * CCleaner v. 4.17.4808
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Danksagungen0

Re: Symantec, what is ...this???

" I just read a post here in the Tech Outpost board by Krusty13 about CCleaner v. 4.18.x and NS that piqued my interest.  If you have CCleaner installed on your system, are you running the latest v. 4.18.4844 released 26-Sep-2014 (v. 4.18.4842 released 25-Sep-2014 was quickly pulled because of a bug in the new Active Monitoring feature)?  If you suspect that CCleaner might be involved, try uninstalling it and see if the CPU activity shown as "No Activity" in your performance graph disappears."

Hi Lori,

Thank you for the info but never had installed CCleaner on any of my systems, in my case CCleaner is "Apostolos"

Cheers,

Danksagungen0

Re: Symantec, what is ...this???

@ Lori,

No CCleaner here...

Regards,
 

Danksagungen0

Re: Symantec, what is ...this???

Ok, screenshots taken while the background activity occured AFTER completion of idle quick scan and pc left idle for a few more minutes.

Feel free to comment...

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Hello all,

Quick update: It seems now, after 2 virus defs updates, followed by idle quick scans that the background activity is merged with idle quick scans, it is trigerred only a few seconds after the idle scan had finished and duration of this extra activity is between 8-10 minutes.

However, I also consider the fact that maybe the idle quick scan function was completely redesigned with NS but I do not understand why in Security History log states that idle quick scan ran for only 1min & 51 seconds.

Please see attached screenshots.

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Ok, after a new set of virus defs, idle quick scan completed etc... the background activity started again BUT this time I was able to track it better.

As you can see in the attached screenshots it's THE SRTSP ISSUE AGAIN!!!!

It uses a maximum of 35% of CPU, in the screenshot I was able to capture it while using 15%.

SYMANTEC, I thought this issue was already resolved in NIS 2014, now how this will be??

Do you intend, each time a new version of Norton is released to bring it back???

I hope that someone from Symantec will jump in ASAP, because if it's present on XP, it must be also present on other OS platforms.

Thank you.

Danksagungen1 Stats

Re: Symantec, what is ...this???

Apostolos wrote:

As you can see in the attached screenshots it's THE SRTSP ISSUE AGAIN!!!!...

SYMANTEC, I thought this issue was already resolved in NIS 2014, now how this will be??

Hi Apostolos:

The SRTSP.SYS (Symantec Real-time AutoProtect) bug observed on some 32-bit machines in the thread NIS 20.x SRTSP.SYS (Real-time AutoProtect) High CPU and I/O Reads During Idle has not been fixed in NIS 20.x (2013) or NIS 21.x (2014) - see elsewhere's comments here about his 32-bit Win 7 / NIS v. 21.x system.  Tony Weiss posted here on 17-Feb-2014 that Symantec was working to resolve the problem but that was the last update he ever posted.  As OP of that thread I can assure you that I would have upgraded to NIS 21.x and marked the thread as solved if a working patch had been released.

The Norton Security 2015 beta site at http://us.norton.com/ns-beta states that Norton products are "Performance tuned for the latest Windows 8.x updates: All Norton products are tested thoroughly with Microsoft’s ADK performance assessment user scenarios on the latest Windows 8 platforms." If the disk thrashing and high CPU activity you're seeing is related to the older Windows API on your 32-bit Win XP SP3 system as Symantec employee shane_pereira alluded to here, it might be time for Symantec to either fix this SRTSY.SYS problem and/or add an asterisk next to all the 32-bit Windows operating systems listed in the System Requirements clearly stating that Norton products are only tested for optimal performance for Win 8.x.
-------------
MS Windows 32-bit Vista Home Premium SP2 * Firefox 32.0.3 * IE 9.0 * NIS 2013 v. 20.5.0.28
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS

Danksagungen0

Re: Symantec, what is ...this???

Hello Lori,

Thank you for your comments, I agree, maybe the issue was fixed for 64-bit systems only.

I'm still not seeing any reply from Symantec.... why???

Regards,

Danksagungen0

Re: Symantec, what is ...this???

Hello Imacri & Apostolos
Geez, that's interesting

The Norton Security 2015 beta site at http://us.norton.com/ns-beta states that Norton products are "Performance tuned for the latest Windows 8.x updates: All Norton products are tested thoroughly with Microsoft’s ADK performance assessment user scenarios on the latest Windows 8 platforms."
add an asterisk next to all the 32-bit Windows operating systems listed in the System Requirements clearly stating that Norton products are only tested for optimal performance for Win 8.x.

 Surely, that's just marketing.  Symantec must have tuned and tested for other platforms. 
 

Danksagungen0

Re: Symantec, what is ...this???

All it means is Windows 8 was the lead and main platform for development. As it should have been since it is the latest and current OS. 7, Vista and XP was a lower priority. But, well tested still I imagine.
 

Danksagungen1 Stats

Re: Symantec, what is ...this???

Hello,

One more screenshot, this time with a 30 mins view, that should be enough... I hope.

(Also attached as .zip)

It depicts an idle quick scan followed but unwanted SRTSP.sys activity.

Notice that the whole activity takes 15+ minutes which is a "bit" long for an idle quick scan don't you think??

The blue part of the graph, (inside idle), is the SRTSP.sys activity, labeled by NS as "No Activity". (About 9 mins or so).

Dateianhang: 
Danksagungen3 Stats

Re: Symantec, what is ...this???

All it means is Windows 8 was the lead and main platform for development. As it should have been since it is the latest and current OS. 7, Vista and XP was a lower priority. But, well tested still I imagine.
 

Windows 8.1 may be the latest OS, but according an August 2014 chart on the netmarketshare web-site, here is the distribution of market share among all Windows versions (I am only showing the data for Windows versions .... so the total will not be 100%):

Windows 7:   51.21%
Windows XP:  23.89%
Windows 8.1:  7.09%
Windows 8:    6.28%
Windows Vista: 3.02%

So if Symantec wants to satisfy the majority of their customers, they need to insure that the new products perform properly when running on Windows 7. As you said, lets hope that all Windows versions have been properly tested.

Akzeptierte Lösung
Danksagungen0

Re: Symantec, what is ...this???

Problem solved since last week.

(Requires advanced troubleshooting and actions from user).

Of course, nobody from Symantec did not bother to help me... nevermind.

This thread is closed from further comment. Please visit the forum to start a new thread.