The Norton 1003,11 Mystery

by Bob Seidel

Back in my old days at IBM, everything about our products was well documented, and our service was outstanding. Nowadays, well…

I was at a client's office last Thursday, when an error message began to appear. It was from Norton Anti-Virus, had the cryptic code 1003,11, and basically said that an email could not be sent because it was rejected by the outgoing mail server (SMTP server). I looked into it and based on the error code description at the Symantec website I turned off the outgoing anti-virus scan on email. The problem went away; it looked like a timing issue - perhaps that the anti-virus scanning was taking too much time and the connection to the SMTP server was timing out. Since I had other clients that day, I put the problem on the back-burner for later thought.

But that wasn't the end. I began to receive numerous phone calls and emails from other clients with exactly the same problem. Worse, it was happening to me personally! So further investigation was in order, and fast! The two facts I had to go on were that the error message came from Norton only, and only from Road Runner users.

My first step was to call Symantec. The original client who saw the problem had a corporate account, and so I had access to better (supposedly) corporate level service. After waiting the usual wait, I got a tech that was quite arrogant and unresponsive. He told me to turn off outgoing anti-virus scanning (which I already had) and only after prodding did he admit that this was a known problem, and that you didn't need the outgoing anti-virus anyhow as it was redundant. Well, if it was redundant, why was it still in the product? I finished with him and hung up.

But if this was a known problem, why was it happening en masse right here in river city, and why did it start so suddenly?

My second step was to call Road Runner. The first level tech that I spoke to said there was no known problem on their end, but that he in fact had received numerous calls about the problem that day also! I eventually got to an email specialist at the national service center. She was quite nice on the phone, but again insisted that no change had occurred in their email servers.

At this point I was getting really frustrated. I pulled out all the stops (somebody email me and tell me what the origin of this phrase is - is it related to music organs, or to engines?) and called a high-level contact at the local Road Runner office. He, as usual, was more than willing to help, and started an investigation. Unfortunately, he was never able to report anything substantive - but yet the problem disappeared as quickly as it started, and has been gone for a week now.

So, what happened? I think this was a problem at one of the local Road Runner email servers. I don't think it was a Norton problem, as they would have had to distribute a fix or update causing the problem almost simultaneously to many customers. Norton Anti-Virus does have this capability, but I wouldn't expect the rollout of such a fix to occur quite that fast. Also, the Norton versions failing were quite dissimilar, and used a different code base - thus make the idea of a single bad update fairly remote.

The problem was also not a national Road Runner problem (i.e. one affecting more than one SMTP server) as it seemed to be confined to the local area. So it all ended with no resolution. The problem disappeared as quickly as it came, and I guess that is good news. But I had spent quite a bit of time on it, and I still wonder what actually happened.

On a separate note, Sony has released one or more music CDs with some very bad stuff on it. I don't have all the details right now, but if you play the CD on your PC it will install hidden code called a "rootkit" on your PC that will attempt to prevent you from duplicating the CD, and perhaps other CDs. It also allegedly attempts to contract a Sony server whenever you play the CD. I indicated in a recent column that the "labels" were out to limit our rights to purchased music, and this is the boldest step yet. Stay tuned…

(Bob Seidel is a local computer consultant in the Southport - Oak Island area. You can visit his Website at www.bobseidel.com or e-mail questions or column ideas to him at bsc@bobseidel.com. For specific inquiries, please call Bob Seidel Consulting, LLC at 278-1007.)