Symdaemon running over 100%, fan on constantly

Are you really from Norton support, monitoring relevant issues on Apple forums?

I am running the latest NS 6.4 Build 36, just purchased a few months ago.

It is hard to believe that your test teams have not observed this kind of runaway all-CPU consuming behavior in your test labs.

For example, now, 10-15 min after I disabled Safe Web and three scan types under Protect My Mac (mainly Automatic Scans was a suspect), the activity has dropped, SymDaemon is down to 1% CPU, and fans are not making any noise. I am gradually enabling everything, and we shall see whether it's going to wake up the animal again.

By the way, there is nothing (AFAIK) in the Activity log that indicates this kind of vigorous activity. There is only one record of canceled Idle scan, however the computer was not idle, and I did not initiate any scans.

Is it possible that Norton overreacted to me opening upgraded Notes app, which is now cloud based? If this will happen every time I open Notes, or in fact other apps that are now cloud based, I guess I would have to uninstall the software and say goodbye to you guys.

Please feel free to comment here.

Easiest way to solve those problems is uninstall Norton. It is crap. It services no useful purpose on a Mac. The only thing is does is to use computer resources to cause problems.

I to have this same issue, however unfortunately I am unable to remove it. The company I work for has sadly adopted Symantec for their AV and Endpoint protection.

However I am not sure it this is the place for this or if this is even appropriate, but I wanted to share a recent event that took place on my Mac. To say that Mac's cannot contract a virus is erroneous. It happened to me last week. A trojan that goes by the name of AppSC was consuming every bit of ram and cpu time on my machine. This is over and above what SymDaemon was taking. You would think that Symantec AV/Endpoint protection would have caught this before it became a problem. However in my vast experience with Symantec products as usual it missed it, well sort of. This is the funny part. It caught it when I went to delete it. Way to go Symantec.

A Trojan is not a virus. Symantec will not catch it for you since it is not a virus.

Sorry to hear that your company is stupid enough to force you to install crap such as that.

I am not sure how you define virus, but for me anything that consumes memory and cpu resources in an attempt to take over or gather information unknowingly, by my definition is a virus. If it looks like a duck, walks like a duck..... etc.

If you would like to learn the correct definition for a computer virus, please read https://en.wikipedia.org/wiki/Computer_virus

You will notice that a virus is capable of self-replication. So far noting has been able to self-replicate on the Mac hence the reason I said their are no virus on the Mac.

It doesn't say anything about ducks.

most if not all the AV I've tested for Mac in a corporate envorionment has turned out to be far more of a problem than a prevention. If the developers are porting the code over from their windows counterparts they are doing a highly incompetent job as these AVs seriously tax the system and take away process time from applications that need them. Window AV and Mac AV can not be compared, except for the name of the product the stability and safety they offer on one side of the OS spectrum is not the same quality on the other side. Many posts in these forums unanimously point to Mac AV as a culprit in system instability and the overwhelming threat to macs is bogus websites that tell you you're infected and you call a "hotline" to get scammed. Mac AV does not prevent this, or alert you, common sense does. At this time there are no known Mac virus (defined as code that can replicate) in the wild, while they have been created in labs by professionals looking to prove exploits they have not made their way into public systems and Apple often patches OS X without telling you what security flaws were addressed.

So using Mac AV is your choice and you're entitled to it, but system destabilized by poorly written code under the guise of "if you don't use it you're crazy" may be the result so don't be surprised.

Be careful what antivirus software you choose, some get into your browser and no longer enable the Extended Validation (EV) certificates on sites like this thread, grc.com, paypal, etc. as documented here: https://www.grc.com/fingerprints.htm. Right now, I am running norton and chrome, and as far as I can tell, the EV certificates work fine. I get a green lock, with Apple Inc [US] and the lock in a green rectangle. I believe only some browsers support EV certificates, as documented on grc.com (If you don't want to click on the link, it's at least Firefox and Chrome, but not Internet Explorer). The website owner is Steve Gibson, host of Security Now). Here is more on EV https://www.grc.com/ssl/ev.htm

Norton is probably one of the worst AV software packages available for the Mac. I strongly recommend you uninstall Norton before it corrupts your disk drive for you.

Thanks for this advise. Running El Cap on a 2010 MBP I was seeing 100% combined CPU usage with Kernel_task and SymDaemon. Uninstalled Norton and system idling at 3%. Excellent tip! Norton free from Comcast, hmmmmmm.

It was worth exactly what you paid for it, wasn't it?

Did this - no help. Same symptoms.

Question to group and to Norton:

What Kernel _Task and SymDaemon CPU % usage would be considered "normal"? 20%?,50%? 70%? more?

I'm running Norton Security (v6.4, build 36), not Endpoint Protection, so not sure if the config changes below will all apply within EP.

I disabled all scans (Automatic, Scheduled and Idle), Safe Web and File Guard. With all those disabled, SymDaemon CPU utilization drops to near zero, UNLESS you open the Norton Security menu/interface, then it shoots back up again.

I agree the product *****, but with this config you can still utilize Application Blocking, Connection Blocking, Vulnerability Protection and DeepSight (I don't use Location Awareness on my home machine).

what application blocking are you protecting yourself from? OS X has this built in to Security & Privacy in the control panels:

You can prevent anything (signed by apple, not signed by Apple, etc.) to execute from the gatekeeper service, you don't need 3rd party tools to manage it and any app that does launch initially that does meet this criteria will require a pw challenge for the first instance.

What connections are you blocking? Are you on a wireless network in a public area? Do you expect a breach from a remote user? If so without sitting down at your computer and knowing your admin password there is nothing they can accomplish without your assistance.

what vulnerability are you protecting yourself from? A mac virus? There are none.

Mac AV has zero credibility on Mac OS at this time, however there is ample evidence as it being a complete cluster for your OS.

I traced this to my latest upgrade of Symantec's Norton AntiVirus 7.0.1.

Fixed it by going into Norton AntiVirus program, opening up "Advanced" and disabling "Idle Scan" feature.

I still have "Automatic Scans" turned on for protection.