Norton Antivirus

NTDEV
1

Hello,

Now I am developing TDI filter driver and have a problem with Norton
AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software is
installed to target PC, then… I found that Kernel debugger is not
compatible with that software in Symantic HP, but I do not found how to go
with such problem.

Is there any workaround for this problem? Or is there any good way to debug
my problem?

Please give me your advice.

Thank you,
Hideyuki Inamasu.

2

Can you explain exactly what your setup is, and what the problem is. We
don’t use NAV, but I’m pretty sure that it would work with WinDBG…

–
Mats

xxxxx@lists.osr.com wrote on 01/11/2005 01:28:40 PM:

Hello,

Now I am developing TDI filter driver and have a problem with Norton
AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software
is
installed to target PC, then… I found that Kernel debugger is not
compatible with that software in Symantic HP, but I do not found how to
go
with such problem.

Is there any workaround for this problem? Or is there any good way to
debug
my problem?

Please give me your advice.

Thank you,
Hideyuki Inamasu.

Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@3dlabs.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

ForwardSourceID:NT0000AA12

3

Thank you Mats for your advice.

Anyway, NAV is not compatible with WinDBG and it is described on Symantec
HP. And I would like to know why you are pretty sure it works with WinDBG?

In addition, I setup NAV with default configuration which NAV setup
recommend.

I really appreciate your advice.

Thank you,
Hideyuki Inamasu.

“Mats PETERSSON” wrote in message
news:xxxxx@ntdev…
>
>
>
>
>
> Can you explain exactly what your setup is, and what the problem is. We
> don’t use NAV, but I’m pretty sure that it would work with WinDBG…
>
> –
> Mats
>
> xxxxx@lists.osr.com wrote on 01/11/2005 01:28:40 PM:
>
>> Hello,
>>
>> Now I am developing TDI filter driver and have a problem with Norton
>> AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software
> is
>> installed to target PC, then… I found that Kernel debugger is not
>> compatible with that software in Symantic HP, but I do not found how to
> go
>> with such problem.
>>
>> Is there any workaround for this problem? Or is there any good way to
> debug
>> my problem?
>>
>> Please give me your advice.
>>
>> Thank you,
>> Hideyuki Inamasu.
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at http://www.
>> osronline.com/article.cfm?id=256
>>
>> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>> ForwardSourceID:NT0000AA12
>
>

4

Ok, I’ve read the Symantec web-site, which seems to indicate that there’s
no (simple) solution to this problem.

But I would like to hear what your exact problems are, rather than discuss
the Symantec web-site. Are you seeing a blue-screen, the system stops, or
what happens?

I suspect the problem with WinDBG is that Symantec are “hooking” something
in their product, which makes them incompatible with debuggers of this
type. Perhaps SoftICE works better, but that is also a kernel debugger
(technically), but it may use different techniques to access it.

Another way to solve the problem is of course to not use a kernel debugger,
but rather use other debug methods, typically dumping data from the code
without the use of a debugger. You can either open a debug output file and
use a combination of sprintf and WriteFile to write the data, or use the
serial port directly from your driver [using a simple busy-wait loop] to
indicate what’s going on inside your driver. This method works fine until
you need to debug other parts of the system than those that you’ve written.
It can of course be done, but it does beomce much more difficult.

A third way would be to find out what Symantec are hooking that causes
problems with these types of debuggers, and patch that bit of hooking out
of their executable, so that it’s not being done…

I’m unsure of which is the best solution. Fortunately, when writing display
drivers, we don’t see these type of interaction problems very often.

–
Mats

-------- Notice --------
The information in this message is confidential and may be legally
privileged. It is intended solely for the addressee. Access to this
message by anyone else is unauthorized. If you are not the intended
recipient, any disclosure, copying or distribution of the message, or any
action taken by you in reliance on it, is prohibited and may be unlawful.
If you have received this message in error, please delete it and contact
the sender immediately. Thank you.

xxxxx@lists.osr.com wrote on 01/11/2005 01:55:52 PM:

Thank you Mats for your advice.

Anyway, NAV is not compatible with WinDBG and it is described on Symantec

HP. And I would like to know why you are pretty sure it works with
WinDBG?

In addition, I setup NAV with default configuration which NAV setup
recommend.

I really appreciate your advice.

Thank you,
Hideyuki Inamasu.

“Mats PETERSSON” wrote in message
> news:xxxxx@ntdev…
> >
> >
> >
> >
> >
> > Can you explain exactly what your setup is, and what the problem is. We
> > don’t use NAV, but I’m pretty sure that it would work with WinDBG…
> >
> > –
> > Mats
> >
> > xxxxx@lists.osr.com wrote on 01/11/2005 01:28:40 PM:
> >
> >> Hello,
> >>
> >> Now I am developing TDI filter driver and have a problem with Norton
> >> AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus
software
> > is
> >> installed to target PC, then… I found that Kernel debugger is not
> >> compatible with that software in Symantic HP, but I do not found how
to
> > go
> >> with such problem.
> >>
> >> Is there any workaround for this problem? Or is there any good way to
> > debug
> >> my problem?
> >>
> >> Please give me your advice.
> >>
> >> Thank you,
> >> Hideyuki Inamasu.
> >>
> >>
> >> —
> >> Questions? First check the Kernel Driver FAQ at http://www.
> >> osronline.com/article.cfm?id=256
> >>
> >> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> >> To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >> ForwardSourceID:NT0000AA12
> >
> >
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.
> osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

> ForwardSourceID:NT0000AA1E

5

Did you try to debug computer with debugport (com1 for example) ?

Maxim

----- Original Message -----
From: “Hideyuki Inamasu”
Newsgroups: ntdev
To: “Windows System Software Devs Interest List”
Sent: Tuesday, January 11, 2005 3:55 PM
Subject: Re:[ntdev] Norton Antivirus

> Thank you Mats for your advice.
>
> Anyway, NAV is not compatible with WinDBG and it is described on Symantec
> HP. And I would like to know why you are pretty sure it works with WinDBG?
>
> In addition, I setup NAV with default configuration which NAV setup
> recommend.
>
> I really appreciate your advice.
>
> Thank you,
> Hideyuki Inamasu.
>
> “Mats PETERSSON” wrote in message
> news:xxxxx@ntdev…
>>
>>
>>
>>
>>
>> Can you explain exactly what your setup is, and what the problem is. We
>> don’t use NAV, but I’m pretty sure that it would work with WinDBG…
>>
>> –
>> Mats
>>
>> xxxxx@lists.osr.com wrote on 01/11/2005 01:28:40 PM:
>>
>>> Hello,
>>>
>>> Now I am developing TDI filter driver and have a problem with Norton
>>> AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software
>> is
>>> installed to target PC, then… I found that Kernel debugger is not
>>> compatible with that software in Symantic HP, but I do not found how to
>> go
>>> with such problem.
>>>
>>> Is there any workaround for this problem? Or is there any good way to
>> debug
>>> my problem?
>>>
>>> Please give me your advice.
>>>
>>> Thank you,
>>> Hideyuki Inamasu.
>>>
>>>
>>> —
>>> Questions? First check the Kernel Driver FAQ at http://www.
>>> osronline.com/article.cfm?id=256
>>>
>>> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>> ForwardSourceID:NT0000AA12
>>
>>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@secureol.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Im interesting as well into a complete description of the problem. Who
knows
maybe in future Ill run into problems with NAV. I agree with Mat, if Windbg
do not works with Windbg, its because they do a lot of dirty ugly things,
which makes me wonder … about a lot of in NAV.

Thanks, Dan

----- Original Message -----
From: “Maxim”
To: “Windows System Software Devs Interest List”
Sent: Tuesday, January 11, 2005 4:29 PM
Subject: Re: Re:[ntdev] Norton Antivirus

> Did you try to debug computer with debugport (com1 for example) ?
>
> Maxim
>
>
> ----- Original Message -----
> From: “Hideyuki Inamasu”
> Newsgroups: ntdev
> To: “Windows System Software Devs Interest List”
> Sent: Tuesday, January 11, 2005 3:55 PM
> Subject: Re:[ntdev] Norton Antivirus
>
>
>> Thank you Mats for your advice.
>>
>> Anyway, NAV is not compatible with WinDBG and it is described on Symantec
>> HP. And I would like to know why you are pretty sure it works with
>> WinDBG?
>>
>> In addition, I setup NAV with default configuration which NAV setup
>> recommend.
>>
>> I really appreciate your advice.
>>
>> Thank you,
>> Hideyuki Inamasu.
>>
>> “Mats PETERSSON” wrote in message
>> news:xxxxx@ntdev…
>>>
>>>
>>>
>>>
>>>
>>> Can you explain exactly what your setup is, and what the problem is. We
>>> don’t use NAV, but I’m pretty sure that it would work with WinDBG…
>>>
>>> –
>>> Mats
>>>
>>> xxxxx@lists.osr.com wrote on 01/11/2005 01:28:40 PM:
>>>
>>>> Hello,
>>>>
>>>> Now I am developing TDI filter driver and have a problem with Norton
>>>> AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus
>>>> software
>>> is
>>>> installed to target PC, then… I found that Kernel debugger is not
>>>> compatible with that software in Symantic HP, but I do not found how to
>>> go
>>>> with such problem.
>>>>
>>>> Is there any workaround for this problem? Or is there any good way to
>>> debug
>>>> my problem?
>>>>
>>>> Please give me your advice.
>>>>
>>>> Thank you,
>>>> Hideyuki Inamasu.
>>>>
>>>>
>>>> —
>>>> Questions? First check the Kernel Driver FAQ at http://www.
>>>> osronline.com/article.cfm?id=256
>>>>
>>>> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
>>>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>>
>>>> ForwardSourceID:NT0000AA12
>>>
>>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> You are currently subscribed to ntdev as: xxxxx@secureol.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Can you please better explain what exactly the symptom is?

-------Original Message-------

From: Hideyuki Inamasu

Date: 01/11/05 15:30:06

To: Windows System Software Devs Interest List

Subject: [ntdev] Norton Antivirus

Hello,

Now I am developing TDI filter driver and have a problem with Norton

AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software is

installed to target PC, then… I found that Kernel debugger is not

compatible with that software in Symantic HP, but I do not found how to go

with such problem.

Is there any workaround for this problem? Or is there any good way to debug

my problem?

Please give me your advice.

Thank you,

Hideyuki Inamasu.

Questions? First check the Kernel Driver FAQ at http://www.osronline
com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@gmail.com

To unsubscribe send a blank email to xxxxx@lists.osr.com

8

I met a similar problem before (but not this one), since it’s not
your problem, My choice is just uninstall the Norton, after fully
tested my driver in verifier, reinstall the Norton and test it again
without WinDbg.

“Hideyuki Inamasu” wrote in message
news:xxxxx@ntdev…
> Hello,
>
> Now I am developing TDI filter driver and have a problem with Norton
> AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software
is
> installed to target PC, then… I found that Kernel debugger is not
> compatible with that software in Symantic HP, but I do not found how to go
> with such problem.
>
> Is there any workaround for this problem? Or is there any good way to
debug
> my problem?
>
> Please give me your advice.
>
> Thank you,
> Hideyuki Inamasu.
>
>

9

The latest version of NAV checks to see if a debugger is attached and if it
is, NAV will fail to load.

I would guess this is a ‘protection’ algorithm to ensure that no one can
step through their drivers, though is raises HUGE problems when trying to
debug interop issues.

Look through the history of the IFS list, a month or two back, and you will
find a thread on this exact topic.

Pete

Peter Scott
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-198083-
xxxxx@lists.osr.com] On Behalf Of AFei
Sent: Tuesday, January 11, 2005 10:51 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Norton Antivirus

I met a similar problem before (but not this one), since it’s not
your problem, My choice is just uninstall the Norton, after fully
tested my driver in verifier, reinstall the Norton and test it again
without WinDbg.

“Hideyuki Inamasu” wrote in message
> news:xxxxx@ntdev…
> > Hello,
> >
> > Now I am developing TDI filter driver and have a problem with Norton
> > AntiVirus 2004/2005. I tried to run WinDbg and Norton AntiVirus software
> is
> > installed to target PC, then… I found that Kernel debugger is not
> > compatible with that software in Symantic HP, but I do not found how to
> go
> > with such problem.
> >
> > Is there any workaround for this problem? Or is there any good way to
> debug
> > my problem?
> >
> > Please give me your advice.
> >
> > Thank you,
> > Hideyuki Inamasu.
> >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com