multiple instances of ccSvchst.exe

[jbm417]

1 of my 4 machines has 2 copies of ccSvchst.exe running -- 1 copy with a user name SYSTEM & the other copy with my user name. All are running Norton Antivirus 2009 and the idle time scan is Off.

I have chatted with 2 different Symantec tech support staff & both say 2 copies are 'normal'. Somehow this does not seem correct to me when my other machines only have 1 copy running.

Can anyone shed more light on this?

These 2 processes are using a significant amount of cpu time and also creating far more page faults than any other process.

TIA --- Joe

 

[MichaelYork]

Hi Joe,

This is Mike from the Norton Authorized Support Team.

The issue with multiple instances of the "ccSvchst.exe" can occur if your machine has a dual-core processor or if you have multiple processors. Another reason for the multiple instances is if you are possibly infected or if there is a problem with your installation of Norton AntiVirus.

Please let me know the following information about the computer experiencing this issue:

• What processor does it have?Is it a Dual-Core?
• How much Total RAM does it have?
• When you launch Norton AntiVirus, look at the “CPU Usage” and then launch “Task Manager” and let me know the following:

1. Does the “System” CPU usage match on both?
2. What is the % of memory that Norton is using according to the Norton CPU Usage meter?

Please let me know the answers to the above questions so that I can assist you further.

If you have not already done so, manually run LiveUpdate to make sure that you get the latest program and definition updates. After you run LiveUpdate click on the "Help & Support" link and then choose "About." It should say version 16.5.X.

Next, restart in Windows Safe Mode and complete a “Full System Scan” to make sure that there are no infections.

Thank you,
Mike




Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

Thanks for the reply. Sorry I did not respond sooner, but I have been away for a number of days.

Anyway, here is the info you requested:

cpu Intel family 15 model 2 stepping 9 2.4 GHZ -- Not dual core

memory 512M

Version of NortonAV is 16.5.0.134

When I run NAV the system & NAV cpu usage varies: ranges from 9% & 5% all the way to 100% and 94% respectively.

If I look with Task Manager I see an accumulation of cpu time for 1 instance (System) 16:54 min and 6:14 min for the other instance. Memory usage is 7M & 2.9M respectively. The number of page faults is 450K & 820K respectively.

I did start the machine in safe mode & ran a scan. The only issue detected was a tracking cookie which I fixed. Rebooted and 2 instances of ccSvchst.exe started up again.

This machine did have NAV2007 installed & then it was automatically upgraded to NAV2009. Could there be something left from 2007 that is causing the 2nd instance?

Thanks, Joe

 

[MichaelYork]

Hi Joe,

I wanted to let you know that what you were told by Norton Support is true, and that Norton AntiVirus should have two "ccSvchst.exe" processes running. The reason why it may only be showing 1 process on your other machine is due to an issue with Task Manager not reporting the other process, which occurs on a sporadic basis. Our engineers are working on a fix for this issue.

However, neither of these process should take up a lot of CPU time except when it is scanning, if there is a problem with the installation, or an infection, which you have already ruled out.

Since you mention that you did an in-place update, there is the possibility that something did not go right when you upgraded. Please follow the steps below to do a clean uninstall and reinstall and let's see if that helps. Make note of your Activation Key first.

1. Click on the following link to download the Norton Removal Tool:

Norton Removal Tool and Instructions

2. After you run the tool, please restart your computer. Then log in to Windows again and run the removal tool again. Restart your computer after it is finished running the second time as well.

3. Re-download the latest installer for Norton AntiVirus 2009:

Re-download Norton AntiVirus installer

4. Towards the end of the installation you will be asked for your Activation Key.

5. When the installation is complete, launch Norton AntiVirus 2009 and manually run LiveUpdate. This will not only download and install the latest product and definition updates, but will also invoke the new "Pulse Updates" feature.

Please try this process and let me know if it resolves the issue.

Thank you,
Mike




Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

I tried to download the removal tool, but after clicking the download button in Step 3, I get an error msg saying IE cannot display the web page.

I did chat with Dipu D. at Symantec Tech Support & he concluded that the web site is not working.

I understand there is a manual way to remove. Can you give me a url to the instructions? I am pretty competent with a computer so even if it involves regedit, I can do it.

TIA, Joe

 

[MichaelYork]

Hi Joe,

Both of the links that I posted are working correctly in IE and Firefox for me and my coworkers. Please try to access the links using another browser, such as Firefox or Safari.

The manual removal process is very tedious and would take a lot of time.

Please try the following alternative process to remove Norton AntiVirus.

1. Open the Add/Remove Control Panel and choose Norton AntiVirus 2009 from the list. When that step is complete, restart your computer.

2. Click on the link below, which is a direct download to the Norton Removal Tool. Choose "Save File" and then run the tool to clean up anything that was left behind.

Norton Removal Tool direct download

3. After you run the tool, please restart your computer. Then log in to Windows again and run the removal tool again. Restart your computer after it is finished running the second time as well.

4. Click on the following direct download link to download the latest installer for Norton AntiVirus 2009.

Norton AntiVirus 2009 installer direct download


If you are still unable to download these files using a browser other than IE, then that's an indication that there may be an infection on your system, or there is a problem with your OS. Please try this process and let me know if you are successful.

Thanks,
Mike






Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

I tried downloading NRT using IE from all 4 of my machines but none would do it.

I don't really want to download/install/deinstall another browser just to get NRT. So at this point I'm not sure what else to do. Is there anything else you can recommend?

TIA, Joe

 

[MichaelYork]

Hi Joe,

The direct download links I posted go to the Symantec FTP server. I did check these links on IE and Firefox and they are working correctly. If you were unable to download the file on 4 different machines, then I suspect that there is a problem with your internet connection.

What type of internet connection are you using? Is is dial-up? Is it DSL or Cable? You may want to have your connection checked by your ISP to see if there is a problem that is preventing you from downloading files.

You can also try resetting the security in IE back to it's Default setting to see if that helps.

I would still strongly suggest that you have another browser to use for general web surfing, as IE has many issues and security holes that you can get around by using a different browser.

If you are still unwilling to download another browser, is it possible for you to use a different internet connection to download the Norton Removal Tool? The file itself is only 2.9 MB's and you can then use a USB stick or drive and then connect it to your computer to run the tool. The Norton Removal Tool is the most efficient way to properly remove all Norton components so that you can do a clean installation of Norton AntiVirus which will hopefully resolve the issue you are having.

Thanks,
Mike





Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

My internet connection uses dsl. I just this moment downloaded 10M of updates for Adobe to validate that the isp service is working. Also, I downloaded 1.5M of Microsoft updates without trouble.

So, if there is something wrong with the internet connection or with IE, it seems to be uniquely sensitive to symantec downloads.

What looks different to me is that the symantec download is using ftp while Adobe/MS are probably not. Here is where I think the problem may be. However, I checked my router & ftp on port 21 is enabled ... so ??

As for another browser, I like IE and will stay with it.

TIA, Joe

 

[MichaelYork]

Hi Joe,

Yes, the second set of instructions are an FTP download. I provided this link to you because you were having problems trying to download the file using HTTP which were the first set of links and instructions.

Please try resetting Internet Explorer 7 to it's Default settings and also use the "Clear Private Data" function. It could be that you have corrupted internet temporary files or there is a problem with the cookie from Syamntec.com, so please try this step first.

One more factor that you may be contributing to the problem is that you may be being prompted to install an Active X control when trying to download the NRT and you may not have noticed it. What you need to do is right-click on the beige bar that drops down and choose "Allow Active X Control."

If you still can not download the file and the installer, then please try to download it from another computer and then run it on your computer.

Let me know if you are successful.

Thanks,
Mike



Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

I cleared all the private data -- cookies, temp files, history, etc. in IE, turned off the phishing filter, turned off pop-up blocker and set security to the lowest level but still get the message "IE cannot display the web page"

I did double check for an Active-X control request, but there was none.

However, the common thread for download is still ftp. All the links ultimately lead to:

ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

The first link takes me to a web page where I choose the 2009 product which then goes to a page with 3 steps. The download button is a link to ftp -- see above.

The last link ...../nrt/ ends up going to the same ftp site.

As for using another computer, I have tried all 4 of my machines, but each ends up with the same response. Just FYI --- 2 of the machines are running XP Pro, 1 is running Server 2003 Enterprise, and 1 is running Vista Home. The machine with the 2 instances of ccSvchst.exe is running XP Pro.

Thanks, Joe

 

[jbm417]

Hi Mike,

I decided to manually ftp NRT by opening a cmd window & running ftp using it's commands. This worked fine.

After using XP Add/Remove programs to remove NAV2009 I ran NRT, rebooted and ran NRT again. After this I checked Task Mgr & there were 0 instances of ccSvchst.exe.

I then reinstalled NAV2009 without any problems & ran liveupdate.

However, the 2 instances of ccSvchst.exe reappeared just as before. Perhaps I am destined to have 2.

Regards, Joe

 

[MichaelYork]

Hi Joe,

Thanks for the update and I'm happy to hear that you were able to follow the process and do a clean installation

As I had said in an earlier post, it is normal to have 2 instances of the "ccSvchst.exe" process running with NAV 2009.

The clean installation and update that you performed will have resolved any possible issues with these processes spiking, and consuming too many resources.

I would suggest that you schedule a "Full System Scans" on at least a weekly basis, at a time when you are not using your computer so that it does not interfere with the general use of your computer.

Thanks,
Mike



Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority

 

[jbm417]

Hi Mike,

Thanks for all your help.

I have already set up a schedule for a full system scan.

Joe

 

[J40]

Michael

I have exactly the same problem, and if you do a quick search a lot of people have this issue with Norton. I believe you guys are very aware of it and you are being disingenuous querying settings and fuctions on people's computers. It is obviously a massive structural design flaw of your program. The general consensus is that Norton reduces the performance of your pc back to the stoneage. I doubt if I will ever look at Norton products again.

J40

 

[imstunned]

Mike,

I hope you're still monitoring this thread. I bought NAV earlier this year as part of a larger package (forget the exact package name). Oddly, when I look at the NAV 'about' the copyright is 1997-2008. Odd, but that's not the reason I'm posting here. The version is: 16.5.0.134.

The reason I'm posting here is that I have (actually had, more info below) 3 instances of ccSvcHst.exe running. That happened today.

Normally (before today, that is), I had two instances as described above. I believe that was normal.

This morning when I came to my already running PC, NAV indicated that it had detected and removed threats and that I needed to reboot.

Additionally, WinPatrol had popped up and was asking me to approve/deny a new service:

ccSvcHst /h ccCommon

and it was labeled the Symantec Eraser Service

I tried googling, binging, and asking about what this service is (because I found it odd that this would be wishing to startup months after my initial purchase). There was very, very little information that seemed reliable to me about what this service is, whether its legitimate, etc. In fact, I found this site in the process of bing'ing for such information.

Against my better judgement, I allowed WinPatrol to let the service be allowed and I proceeded with the reboot.

During the reboot process (but before Windows started up), I saw a notice that Symantec was cleaning up threats and would restart Windows when it was done.

This played out, and eventually the system came back up.

Now, however, I had three instances of ccSvcHst.exe (the two originals plus the new Symantec Eraser Service instance.

This doesn't jibe with your earlier comments and really bothers me. In that light, I ran services.msc and stopped the Symantec Erase Service.

At this point I'm really confused about the state of my machine and whether or not this Symantec Erase Service was legitimate or not.

Any information you can provide would be greatly appreciated.

Thanks.

 

[MichaelYork]

Hi imstunned,

The problem you are having here is related to having WinPatrol running at the same time as Norton, which is causing a software conflict and therefore not allowing the real-time protection in Norton from operating correctly. Win Patrol is also a real-time scanner and you never want to have more than one real-time security scanner running at the same time to avoid conflicts.

I would advise you to remove Win patrol and also check to make sure there are no other third-party security software installed.

After you remove WinPatrol, restart your computer, launch Norton and manually run LiveUpdate. If any updates are installed, restart your computer, but boot into Windows Safe Mode. Next, launch Norton and then perform a "Full System Scan" to make sure there are no more threats on your system.

Thanks,
Mike


Michael York
Norton Authorized Support Team
Symantec Corporation

http://service.symantec.com/priority