Security → Re: Did they screw up LiveUpdate?

I've been reading this thread for a couple days now, I have NIS 2002 on Windows XP, and I am having the same problem as everyone else. I have slow internet browsing, through IE and Mozilla, but have no problems with other internet programs like MSN, or KaZaA. I have finally decided to join the 'fun' and along with it I'm posting the info on my NIS files and drivers.

I checked my Devise Manager as Morac suggested and I have SYMIDS.sys in it, and like sonofjay it has that lovely yellow circle and ‘!’ over it's icon. I also have that 'Firewall configuration updated: # rules' thing too, every few seconds. Also when I disable my Privacy Control it does speed up again, however fast I do believe that there is still the slightest pause before a page starts to load, a pause that is not there when my Firewall is completely disabled.

As chuck1959 pointed out, yes when you reformat a computer and install the Nortons stuff you do get a brand new one year subscription, at least in 2002. About a year or two ago I had a problem where when I tried to download the Antivirus Definitions through the LiveUpdate it would stop half way though. I could download every other update, but the Definitions would not work. So to keep up to date I used their Intelligent Updater. I had to download a larger file each time, but it was the only way I could update them.

I hate to throw another file into this mess, but when I first tried checking my Windows Task Manager I got, like everybody else, symproxysvc.exe taking up over 90% of my CPU. However, for short spurts it would go down to 40 something as another file took it's place, nisserv.exe, also taking up 40 something. My symprxysvc.exe is 'Version: 4.0.3.104' and 'Size: 54,952' and nisserv.exe is 'Version: 4.0.3.10' and 'Size: 63,144.' Now I'm not sure what nisserv.exe does, but it is mentioned, along side symprxysvc.exe in a Symantec Support article Changing when NIS or NPF loads during Windows startup.

said by Symantec Support:

---

Change the startup sequence for SymProxySvc.exe and Nisserv.exe

Perform the following steps only if the previous steps did not resolve the problem or if there is a decrease in browsing speed. This procedure is applicable only to NIS 2002, NPF 2002 and Norton Internet Security 2002 Professional Edition.

---

I haven't actually tried this, but this indicates that the files have a similar purpose to do with NIS. I believe this article was presented to jvmorris either on this thread, or the Computer Cops one, and he discounted to not likely being related, I will however try it if anyone thinks it might actually work.

Now for some info that I believe has not been presented to date. An error is present once every time I boot up my computer, recorded in the Event Viewer. The same error was mentioned by another poster. The following is the first instance of the error; it is repeated multiple times with different dates and times.

Date: 20/05/2004 Source: Service Control Manager
Time: 7:32:56 PM Category: None
Type: Error Event ID: 7009
User: N/A
Description: Timeout (30000 milliseconds) waiting for the Norton Internet Security Service service to connect.

Then 5 days later this appeared immediately before the instance of the above error.

Date: 25/05/2004 Source: DCOM
Time: 7:59:37 PM Category: None
Type: Error Event ID: 10005
User:
Description: DCOM got error "The service did not respond to the start or control request in a timely fashion. " attempting to start the service NISSERV with arguments "-service" in order to run the server:
{275B620B-C78D-4031-8988-0C645D8C8DCF}

Following this was the Timeout Error, this time it occurred every 30 seconds (or
30000 milliseconds) until I shutdown, then went back to the once per boot error.
Later on 29/05/2004 at 4:32:31 PM I got the 'DCOM' error again, followed by the Timeout error every 30 seconds until I got this.

Date: 29/05/2004 Source: Service Control Manager
Time: 7:36:11 PM Category: None
Type: Error Event ID: 7034
User: N/A
Description: The Norton Internet Security Proxy Service service terminated unexpectedly. It has done this 1 time(s).

Then I got this after disabling NIS every so often, ranging anywhere from every 30 seconds to 6 minutes until I shutdown.

Date: 29/05/2004 Source: DCOM
Time: 7:51:28 PM Category: None
Type: Error Event ID: 10003
User: N/A
Description: Access denied attempting to launch a DCOM Server using DefaultLaunchPermssion. The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.

Now this last error started only after I tried disabling NIS (I never tried this before because I didn't want to surf without my Firewall). This is also when I stumbled upon this thread, anyways now when I boot my computer, since disabling NIS, it does not enable its self sometimes, I have to do it manually, and it then of course slows down.

Just a thought, Gwellin , but you can always enable the Windows ICF while you are experimenting with turning NIS on and off -- the ICF seems to happily coexist with other 3rd-party software firewalls {NIS, ZAP, Sygate, etc.}

EUREKA IT WORKS!

**okay I have to let everyone one know that what worked in my situation my not necessarily work for everyone and that making changes to driver files on your PC should only be done as a last resort and even then only if you are willing to live with the consequences of any crashes or loss of use of your PC. Also, this is only to be used by people with a crippled copy of NIS/NPF 2002 currently installed on their WinXP machine only. People who have done a roll-back to pre-May 12 will not profit by this, nor will anyone suffering some other problem with NIS/NPF 2003/2004/**

Having said that, using the fix that worked for me, you DO NOT have to replace any additional files. You need simply to put a file that does not already exist in a location on your PC. Period! You are not removing or replacing any file! Additionally I should add that only the posters here in this thread intimately involved with this should try this until we have a better understanding of what if any problems may arise.

Again a word of caution. The steps outline below are simple by can potentially have adverse affects on your system.

Steps to take

download, save and unzip file symids.zip

scan it with whatever anti-virus software you use

copy the file to your the following location: C:\WINDOWS\system32\drivers\ (*you should NOT be prompted to replace any file when you do this. If you are stop immediately and hit the cancel button*)

reboot your PC

test your browsing speed by going to a site that was slow in the past

report your results here so that others can benefit and help you if needed.

symids.zip
21014 bytes

So, . . . It Worked!!!

Fancy that!

You left out a caveat: This is only to be used by people with a crippled copy of NIS/NPF 2002 currently installed on their machine. People who have done a roll-back to pre-May 12 will not profit by this, nor will anyone suffering some other problem with NIS/NPF 2003/2004.

Thanks for pointing that out JVM. I've updated the caution at the top the my original post.

Doncha sorta wonder how Symantec managed to put out a LiveUpdate for this that got installed on some people's machines, but not on others?

I'm still puzzled by that one.

would using system restore repair any damage done to my system by this method?(I don't want to risk my computer)

said by blacksteel:

---

would using system restore repair any damage done to my system by this method?(I don't want to risk my computer)

---

At this point, based on far too many recent experiences, I think it would always be a good point to set a System Restore benchmark before running a LiveUpdate.

said by blacksteel:

---

would using system restore repair any damage done to my system by this method?(I don't want to risk my computer)

---

Assuming it was monitoring your C Drive then yes. Here is a Microsoft Article that covers what file extensions are monitored: Monitored File Extensions

However I'll repeat what I said above, you do not have to replace any files to incorporate this fix. Your simply returning a file that LU removed.

Having said all that, you are right exercise caution and I would do the following:

•before doing the fix above, manually create a system restore point and give it a name that you will easily recognize
•carefully follow the "fix" steps above
•after you reboot check to see if all is well. If not use system restore to revert back to your manually restore point.
•be sure to report your findings back here

said by Gwellin:

---

I hate to throw another file into this mess,...

---

Never fear throwing another file in. I am saving every single one of them, (and this thread) as this is how problems are solved.
Every little bit helps put the pieces of the puzzle together for our super-sleuths here.

said by sonofjay:

---

EUREKA IT WORKS!

**okay I have to let everyone one know that what worked in my situation my not necessarily work for everyone and that making changes to driver files on your PC should only be done as a last resort and even then only if you are willing to live with the consequences of any crashes or loss of use of your PC. Also, this is only to be used by people with a crippled copy of NIS/NPF 2002 currently installed on their machine. People who have done a roll-back to pre-May 12 will not profit by this, nor will anyone suffering some other problem with NIS/NPF 2003/2004/**

---

Absolutely fantastic, sonofjay !

I have chalked my slowdowns up to MS XP SP2 RC1 and some minor conflicts that I am hoping will be ironed out with the SP2 RC2.

Kudos to all of you who came together and worked so hard on this thread.

said by joelbav0:

---

Hey, Reese, RU still there? I would like to say, "Thank You" for your time and willingness to enter "the lion's den" on this subject (I hope this is a forum on which you were heard, otherwise people are gonna think I'm talkin' to the voices in my head again...!:o) No voices - he was here, and a pleasant surprise as well.

---

said by jvmorris:

---

I believe we are likely to hear from Reese again, but probably not before Tuesday. If you go through what these guys go through all the time, you value little things like a three-day weekend (when you have the opportunity) and I'm not going to begrudge him that. At the moment, I would guess that Reese is as far away from his PC as he can get!

---

Can you imagine going through this every day, eight hours a day, during a 40 hour (+/-) week?

said by jvmorris:

---

Doncha sorta wonder how Symantec managed to put out a LiveUpdate for this that got installed on some people's machines, but not on others?

I'm still puzzled by that one.

---

Yup...

Incidentally, I've already put up notices at Computer Cops, Gladiator, and Wilders referencing your post.

And I would encourage anyone who visits the other HTML-based security forums to feel free to do the same. There are quite likely NIS/NPF 2002 users scattered all over the place, about whom I've never heard who would probably appreciate a heads-up.

I'm going to hold off on the NNTP newsgroups, however, until billz comes down off the mountain and validates it, however!

said by jvmorris:

---

Incidentally, I've already put up notices at Computer Cops, Gladiator, and Wilders referencing your post.

---

JVM I cannot say enough!

I was anxiously waiting for a second person to come along and confirm what I had seen. And now that Gwellin has I think we are all on the right path.

So , I'd like to thank EVERYONE for all the effort that was put trying to find resolution to this very limiting and annoying bug. The list of names is too long to list but hopefully you know who you all are . However, I would be remiss if I did not specifically point out JVM's contributions especially knowing that he does not even use NIS/NPF 2002 and was not personally experiencing any problems. Amazing! And definitely worth a big KUDOS in my opinion!

Thank you so very much JVM.
And thanks to everyone who contributed to this!

Add me to the fixed list. Copying symids.sys to C:\WINDOWS\system32\drivers\ seems to have solved the problem. I'll try it on a second machine shortly. Thanks for the diligence!

Wow! I've been having these exact problems with my computer for the last few weeks. I found this forum today and have been reading through the posts and WOW! My computer is one happy camper now! Disabling security control in NIS and downloading the symids.zip file to my computer has done the trick! Thank you thank you thank you thank you thank you!!!!!!!!!!!!!!!!!

Good for you OnlyRowan, could you please identify which version of Windows you have, especially if it is something other than XP. Also by “security control” I assume you mean Privacy Control, if so you can re-enable it now, the replaced file does the trick.

I have Windows XP and yes I meant Privacy Control. *sorry* I re-enabled it and everything is still working fine! I appreciate the help from the forum!

Thank you sonofjay !!!!!!!!!!!!!!!:D:D:D

I am running XP with NIS 2002 & have been pulling my hair out for a couple of weeks with an unusable broadband connection. The replacement symids file did the trick. I can't thank everyone enough who has put in so much work to sort this one out. Respect !

For some reason I couldn't find a System Restore point BEFORE the liveupdate, so I couldn't fix it that way. I'm still not convinced that my system hasn't been damaged, particularly as my WiFI card driver doesn't seem to want to scan for my access point automatically anymore tried un-install/reinstall & no joy.

My Norton sub is up in August & not too keen to fill the Symantec coffers at the moment !

said by Ronsk:

---

Thank you sonofjay !!!!!!!!!!!!!!!:D:D:D

---

Just for the record one final time , I want to reiterate that it was not me that came of with this fix it was a looong list of posters here and in other forums as well as the lurkers that live among us. Please see this post where jvmorris tries to point out all the folks that helped. He does not specifically mention himself by jvmorris was the glue that held this entire search/hunt together and should be the one who is receiving the kudos!

sonofjay

How right you are to say that jvmorris is the glue that has held this entire business together for the past three weeks or so. I have followed this thread avidly (and in a very small way participated in it over at Wilders), but I tell you this straight.. I could not have even begun to do what Joseph has done. He must have eaten, drunk and slept this business for all this time. He's right in what he says, in that a lot of people all over the world have contributed, but without doubt Joseph is the rock on which all this has been founded.

We all of us owe him an enormous debt of gratitude for his selfless attitude, dedication and sheer bloody hard work.

Thank heavens for people like him!!

Thank you jvm

Oremina, well your name is about to come up again!

Just need to sort through some notes. May be hours from now before I get that all posted, however.

Sorry, Joseph, really didn't mean to cause you any embarrassment, but it had to be said.. I now have an image of you doing what I imagine you do over your side of the pond, shrugging and saying "Aw shucks". (Blame Hollywood).

Regards

EDIT:

Update SymEvent Driver 06/02 - fix NIS2002??

Decided it might be better to start a new thread on this as it could be lengthy and/or cause other as of yet unseen problems. See the following new thread

»Update SymEvent Driver 06/02 - fix NIS2002??

Hi,

I just want to thank you for the symids.zip solution! I was since two weeks desperetaly searching why my CPU was working on so high speed and all the other mentioned troubles since LU of 29/04/2004 from Symantec. I just have one question: this symids file is version 5.3.1.54 while all the other updated sym* files on my system are version 5.3.1.53. Can this cause any problem? Thanks again!!!

Best regard from Brussels (Belgium, Europe)

:D:D:D:D:D:D:D:D:D:D:D:D:D:D:D:D:D:D

What version of NIS/NPF are you running?

To the best of my knowledge, only NIS/NPF 2003/2004 users should be seeing build 5.3.1.53 of the sym*.* files. However, if you are running a language-specific implementation, that may come into play here.

said by JMJMF:

---

I just have one question: this symids file is version 5.3.1.54 while all the other updated sym* files on my system are version 5.3.1.53. Can this cause any problem?

---

I'm not the expert {jv is} but .. my guess is, most times it's safe to replace a program component {.DLL,.SYS,.VXD) with a newer version since that version usually includes all the functionality of previous versions. It is usually when you are going the other way around {replacing a program component with an older version} that you invite problems .. JMHO, hope that helps.

Randy, but theskulptor indicated 5.3.1.53 files as being present on NIS 2002 at one point, also. That's why I'm curious here.

I'm just a semi-tech literate librarian...after three weeks of head-scratching (and wondering if I needed to buy a new computer) I googled you, and if you are in LA you are all owed a cocktail by me.
J Rane

Thank you ! Thank you ! Thank you!
I had this problem for a couple days. I searched symantec which just said to do an update which I do quite frequently already. Your solution fixed my problem perfectly.

Mike A.

Had the symptoms of PC browser running slow, virus check, spy check all ok. Found symproxy.exe taking up 100% CPU.Googled you and found best info anywhere in the known google world, ran zip file browser now all ok, thanks a million.
I think I'll ditch NIS 2002, 2004 looks bad, suggest and good firewalls (zonealarms etc) and virus checkers (AVT anygood ?)

Thanks again Sonofjay you are a star

this worked for me. i didn't have the symids file in my drivers folder, and once i copied it there, browsing speeds were back to normal. thanks.