A few days ago I installed Norton Internet Security 2007 on my Windows XP Professional PC. I checked that it was working on both administrator and user accounts. Within 24 hours it was no longer working on the user accounts. Instead of the yellow Norton button appearing on the taskbar immediately after logon, the following three error messages were being displayed:
ccApp.exe Application Error
The application failed to initialize properly (0xc0000022). Click OK to terminate the application.
osCheck.exe Application Error
The application failed to initialize properly (0xc0000022). Click OK to terminate the application.
PIFSvc.exe Application Error
The application failed to initialize properly (0xc0000022). Click OK to terminate the application.
I tried uninstalling and reinstalling the Norton suite. The problem was still there.
I emailed Symantec support who got back to me within a few minutes with instructions for how to do a more thorough uninstall using the Norton Removal Tool and a clean reboot of Windows. I followed these instructions. Again the problem was still there.
By then it was after midnight so I went to bed feeling rather frustrated.
The following morning I searched the web and came across some reports which suggested it might be a DLL problem. I downloaded and installed a copy of Dependency Walker, a tool that can be used to troubleshoot DLL problems. This showed that all three of the above-named files had unresolved links to DWMAPI.DLL and osCheck.exe also had an unresolved link to CCL60U.DLL. I downloaded a copy of DWMAPI.DLL from DLL-files.com and copied it into the c:\windows\system directory, but this did not fix the problem. (Two copies of CCL60U.DLL file were already present in the Symantec directories, so I don't know why that was not being resolved.)
Some of the reports on the web suggested that the problem might be associated with the recent upgrade to Internet Explorer 7. I uninstalled IE7. The problem was still present. However, Dependency Walker showed the were now showing unresolved links to MSJAVA.DLL and CCL60U.DLL instead of DWMAPI.DLL and CCL60U.DLL. I reinstalled IE7 (from the Microsoft web-site). The problem was still there.
I tried to do a Windows XP system restore back to a date before I installed Norton, but System Restore refused to do it saying that no changes had been made.
I was making no headway with the DLL line of attack. I sat down and had a think. Maybe it could be a file permissions problem? In Windows XP the file permissions are hidden by default, you have to explicitly enable the Security Tab of the Windows Explorer Properties window if you want to see them. To do this you go into Tools -> Folder Options... -> View and untick the 'Use simple file sharing (recommended)' box. I did this and looked at the DWMAPI.DLL permissions; they seemed to be OK: both read&execute and read were enabled for Users.
I needed to be able to see what exactly was failing when the above error messages were being generated. I downloaded and installed a copy of Process Monitor from the Microsoft web-site. Process Monitor provides a trace of registry accesses, file accesses and process events in real-time. However, it won't run in user accounts so I tried to run it in an administrator account. But the problem does not occur in administrator accounts! Simple: instead of double-clicking on the EXE file icon to run it, right-click, chose Run As..., and enter a user account name and password. I disabled all the Norton Internet Security features I could, started Process Monitor, and then ran osCheck.exe in user mode. The osCheck.exe error message was displayed. I stopped Process Monitor, re-enabled all the Norton features and then looked through the Process Monitor trace. There were several entries mentioning osCheck.exe, one of which was a file ACCESS DENIED fault when attempting to read MSVCP71.DLL. There were no other ACCESS DENIED faults in the trace.
I looked at the Security tab for MSVCP71.DLL: it had entries for Administrators, Power Users and System, but not Users. I checked the Security tabs for MSVCP60.DLL and MSVCP50.DLL (presumably earlier versions of the same file): these both had entries for Users (as well as the others). I added an entry for Users to the tab for MSVCP71.DLL (the required permissions were set up by default), logged out of the administrator account and logged in as a user. Norton came up correctly, with no errors. Problem fixed!
The problem was the security permissions of MSVCP71.DLL. The DWMAPI.DLL problem signalled by Dependency Walker was just a red-herring. I still do not understand how the MSVCP71.DLL permissions could have got into the state they did.
By now it was just before midnight. I emailed Symantec support to say I had fixed the problem and then went to bed feeling rather pleased with myself.
Tue 2007-08-14 
