« Pluvialis on Sparrowhawks | Main | Aquarium »
Saturday
Jun022007

A Norton Problem and its Solution

A few days ago I installed Norton Internet Security 2007 on my Windows XP Professional PC.  I checked that it was working on both administrator and user accounts.  Within 24 hours it was no longer working on the user accounts.  Instead of the yellow Norton button appearing on the taskbar immediately after logon, the following three error messages were being displayed:

ccApp.exe  Application Error
The application failed to initialize properly (0xc0000022).  Click OK to terminate the application.

osCheck.exe  Application Error
The application failed to initialize properly (0xc0000022).  Click OK to terminate the application.

PIFSvc.exe  Application Error
The application failed to initialize properly (0xc0000022).  Click OK to terminate the application.

I tried uninstalling and reinstalling the Norton suite.  The problem was still there.

I emailed Symantec support who got back to me within a few minutes with instructions for how to do a more thorough uninstall using the Norton Removal Tool and a clean reboot of Windows.  I followed these instructions.  Again the problem was still there.

By then it was after midnight so I went to bed feeling rather frustrated. 

The following morning I searched the web and came across some reports which suggested it might be a DLL problem.  I downloaded and installed a copy of Dependency Walker, a tool that can be used to troubleshoot DLL problems.  This showed that all three of the above-named files had unresolved links to DWMAPI.DLL and osCheck.exe also had an unresolved link to CCL60U.DLL.  I downloaded a copy of DWMAPI.DLL from DLL-files.com and copied it into the c:\windows\system directory, but this did not fix the problem.  (Two copies of CCL60U.DLL file were already present in the Symantec directories, so I don't know why that was not being resolved.)

Some of the reports on the web suggested that the problem might be associated with the recent upgrade to Internet Explorer 7.  I uninstalled IE7.  The problem was still present.  However, Dependency Walker showed the were now showing unresolved links to MSJAVA.DLL and CCL60U.DLL instead of DWMAPI.DLL and CCL60U.DLL.  I reinstalled IE7 (from the Microsoft web-site).  The problem was still there.

I tried to do a Windows XP system restore  back to a date before I installed Norton, but System Restore refused to do it saying that no changes had been made.

I was making no headway with the DLL line of attack.  I sat down and had a think.  Maybe it could be a file permissions problem?  In Windows XP the file permissions are hidden by default, you have to explicitly enable the Security Tab of the Windows Explorer Properties window if you want to see them.  To do this you go into Tools -> Folder Options... -> View and untick the 'Use simple file sharing (recommended)' box.  I did this and looked at the DWMAPI.DLL permissions; they seemed to be OK: both read&execute and read were enabled for Users.

I needed to be able to see what exactly was failing when the above error messages were being generated.  I downloaded and installed a copy of Process Monitor from the Microsoft web-site.  Process Monitor provides a trace of registry accesses, file accesses and process events in real-time.  However, it won't run in user accounts so I tried to run it in an administrator account.  But the problem does not occur in administrator accounts!  Simple: instead of double-clicking on the EXE file icon to run it, right-click, chose Run As..., and enter a user account name and password.  I disabled all the Norton Internet Security features I could, started Process Monitor, and then ran osCheck.exe in user mode.  The osCheck.exe error message was displayed.  I stopped Process Monitor, re-enabled all the Norton features and then looked through the Process Monitor trace.  There were several entries mentioning osCheck.exe, one of which was a file ACCESS DENIED fault when attempting to read MSVCP71.DLL.  There were no other ACCESS DENIED faults in the trace.

I looked at the Security tab for MSVCP71.DLL: it had entries for Administrators, Power Users and System, but not Users.  I checked the Security tabs for MSVCP60.DLL and MSVCP50.DLL (presumably earlier versions of the same file): these both had entries for Users (as well as the others).  I added an entry for Users to the tab for MSVCP71.DLL (the required permissions were set up by default), logged out of the administrator account and logged in as a user.  Norton came up correctly, with no errors.  Problem fixed!

The problem was the security permissions of MSVCP71.DLL.  The DWMAPI.DLL problem signalled by Dependency Walker was just a red-herring.   I still do not understand how the MSVCP71.DLL permissions could have got into the state they did.

By now it was just before midnight.  I emailed Symantec support to say I had fixed the problem and then went to bed feeling rather pleased with myself.

Reader Comments (6)

Thanks, Tristram. I had the same problem since a LiveUpdate on 5/30/07. Symantec gave me the same upgrade and reinstall advice but still hasn't gotten me a solution. You hit it dead on. I had to update permissions for both MSVCP71.DLL and MSVCR71.DLL, but once that was done, the errors no longer appeared.
Worked for me too. Thanks!
August 22 | Unregistered CommenterChief Minnechuk
interesting article & fascinating to read how you isolated the error: shows real skill (I'd have junked the box in despair). dwmapi seems to be a real rogue according to all the google entries.

I used to religiously install norton on all my machines, but had some nasty experiences with their subscription service and really messed up 2 boxes as a result. Nowadays, I just heavily firewall and viruscheck on a linux gateway server and use clamav (which is free) on all the clients. Coupled with regular and routine updates and service pack installs, I don't seem to be hitting problems too frequently: the point being, symantec user support is less-than-perfect, I think their products sometimes cause more problems than they solve, ergo save your money and your time by avoiding them. Try something like clamav (which does daily virus signature updates anyway) and maybe consider donating the cash you save to the developers instead.
March 19 | Unregistered Commenter27sclash
I'm using Clamav on Ubuntu on my laptop and it is a lot less instrusive than Norton or McAfee.
March 19 | Unregistered CommenterTristram
i had an norton internet security installed in my laptop one day when i started my pc the norton icon on the task bar dint came and when i opened it from the start menu it showed me the error of ccApp.exe missing. i copied that file in the folder in which it was missing but then it was jst not getting started so i uninstalled it and but it took more than 2 hours than i closed it, it was not yet finished. then i manually reomved the symantec files from the c drive and also from registry. but some files in registry is not getting deleted and ccLu60.dll in c drive is not getting deleted. Because of this i cannot re install the norton internet security.
some one can pls help me to know that how to delete this dll file.
February 10 | Unregistered Commentermustufa
mustafa, it might be that the permissions on the ccLu60.dll file have become corrupted. Occasionally, even System (the account under which installations are run) gets removed from the list of users allowed to delete a file. If that happens then you have to go in a manually add System back before you try to reinstall (or uninstall).
February 10 | Unregistered CommenterTristram

PostPost a New Comment

Enter your information below to add a new comment.
Author Email (optional):
Author URL (optional):
Post:
 
All HTML will be escaped. Hyperlinks will be created for URLs automatically.