• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs

Not what you are looking for? Ask the experts!

Kudos0

ccsvchst.exe cpu usage Issue

Yes the infamous ccsvchst.exe  cpu usage issue.  I am running into a situation where on my Windows XP Pro laptop it will occasionally run at about 50% cpu until I  1.  leave system on for days or 2. run a full system scan.

I believe the issue stems from removable drives both real and ghost.  I have tried unchecking the scan removable setting but that setting always comes back checked when I reboot.  This is a clean install of Win XP Pro on a system that had a previous install. 

At first thought issue was because some files had unknown SIDs, I fixed all of that and even when it was not fixed the cpu issue would go away and come back.  I also notice that on occasion it will happen coming out of Hibernate.

Since this is a laptop this is a serious issue as it causes my system to run slow, hot and kills the battery.  I am getting pretty frustrated and firmly believe there is a flaw with ccsvchst as this type of problem does not occur with AVG or Zone Alarm.  Oh I am running NIS 2008. Also I have uninstalled and used the Norton Removal Tool  both twice and still get the same thing.

Lastly the service that has issues is the version of ccsvshst.exe running under SYSTEM user. Logs do not show anything unusual.

Thanks

Replies

Kudos0

Re: ccsvchst.exe cpu usage Issue

Yes the infamous ccsvchst.exe  cpu usage issue.  I am running into a situation where on my Windows XP Pro laptop it will occasionally run at about 50% cpu until I  1.  leave system on for days or 2. run a full system scan.

I believe the issue stems from removable drives both real and ghost.  I have tried unchecking the scan removable setting but that setting always comes back checked when I reboot.  This is a clean install of Win XP Pro on a system that had a previous install. 

At first thought issue was because some files had unknown SIDs, I fixed all of that and even when it was not fixed the cpu issue would go away and come back.  I also notice that on occasion it will happen coming out of Hibernate.

Since this is a laptop this is a serious issue as it causes my system to run slow, hot and kills the battery.  I am getting pretty frustrated and firmly believe there is a flaw with ccsvchst as this type of problem does not occur with AVG or Zone Alarm.  Oh I am running NIS 2008. Also I have uninstalled and used the Norton Removal Tool  both twice and still get the same thing.

Lastly the service that has issues is the version of ccsvshst.exe running under SYSTEM user. Logs do not show anything unusual.

Thanks

Kudos0

Re: ccsvchst.exe cpu usage Issue

To confirm that this is not a virus issue try disabling Norton nad check CPU usage.If this does not work try uninstalling and reinstalling Norton.
Kudos0

Re: ccsvchst.exe cpu usage Issue

I doubt its a virus. As just 20 minutes ago I finished a Full Scan and it dropped to 0% cpu shortly thereafter.

 

Then I closed the lid and my laptop went into hibernation. Once shutdown, I unplugged my External usb HD, USB flash drive. USB Data card, and USB phone cable.

 

20 minutes later opened up and restored out of hibernation. cpu usage jump to 50% area and has stayed there (no periphals plugged in , except USB Data Card)  Ran a quick scan and that did nothing.

Kudos0

Re: ccsvchst.exe cpu usage Issue

What I came to know of your problem is, your Norton may have some problems.Completely remove Norton by running the removal tool from www.symantec.com/symnrt. Reinstall Norton.Your problem should be solved.

Keep your fingers crossed......

Message Edited by Tony_Weiss on 08-01-2008 01:06 PM
Kudos0

Re: ccsvchst.exe cpu usage Issue

Hello sonicdivx,

When you do the reinstall, make sure you have install the latest version. There were a number of under-the-hood fixes related to hibernation. You can get it here.

Thanks,

Matt 

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

How do I check what version I am running now?  Doing install in just a few.

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivx,

You can confirm the version by clicking on the Help & Support link in the main product UI. In the One Click Support dialog that emerges, click About, then click the Norton Internet Security tab. You can download the latest version (15.5.0.23) here.

Thanks,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

I just installed the latest version this morning. I previously did an uninstall then used the Norton Removal tool.

Right now as I type the SYSTEM process is show 45-50% CPU and 100MB usage.

Now I just made 3 changes to settings.

Uncheck Scan removable drives when connected (on a laptop and usually plug/unplug 2-3 devices throughout the day)

Uncheck Scan inside compressed files

Check Scan Microsoft documents

Exclude VM files (run VMware and ShadowProtect)

My current system is a clean install of Win XP Pro but not a format of drive. That means that I had files which have / had orphaned SIDs.  I had thought I had changed them all, but found some more this morning.  Does this impact scanning?

Lastly, for me If I had some idea of how it deals with scanning I might be able to narrow down the issue.  I am not a typical user, as I do a lot of development and consulting work , so often have a wide swath of applications installed/uninstalled. I also run things like Windowblinds, VM, Altiris SVS, etc...

Thanks

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivx,

I've sent you a forum email with additional instructions.

Thanks,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Shortly after receiving the email, I tried things mentioned even though not running 360. No luck.

Well its saturday and just let the laptop sit overnight with just my external Hard drive plugged in and all is fine now. That said problem is probably still there as this is typical behaviour. Come monday I'll post if anything changes.

Kevin

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt, update yeah still have the issue. If I leave the computer connected for several hours it generally goes away. If I then go into Hibernate  and thus unplug external hard drives, then later continue there is a high probability ccsvchst will have high cpu usage.

To me it seem related to removable / network drives maybe.  I know I have scan removable unchecked, but that is one of the few constant changes that occur.  Also the fact this is a clean install too.  Now maybe it is Altiris SVS too since I have about 15 apps setup with it.

Is there anyway to monitor ccsvchst and see what files it is trying to process?  I know if I saw that I could probably rule out a few things and have a better idea of what is going on.

Thanks

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivx,

I sent you a forum email - did you receive it? There were some instructions there for the next steps.

Thanks,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

I had received the posts and even though most do not apply to me (I am running Internet Security 2008, Windows XP Pro SP3) I reviewed them.  

Several important points.

1 I have easily identifiable errors messages that point to ccsvchst. No Windows or Norton error messages (including event viewer)

2 If I leave my machine on and leave my removable HD plugged in eventually cpu usage goes away (i.e. normal behaviour)

3 Regardless of mode (cold boot, warm boot, Hibernate) cpu usage could spike.

4 I have tried disabling via Internet Security options, AV, Firewall, Monitoring  and this makes no difference even after 15 minutes.

5 this is a new install of Windows XP, but the underlying HD has not been formatted so there are probably some files with addtional unknown SIDs

 6 this is a notebook computer ACER 8204 2GB RAM 160GB HD ATI 1600 

Now without bluescreening the computer can I use something like Sysinternals Process Explorer to look at what ccsvshst is accessing.  I really need a way to check that. If I see what it is trying to process, I may be able to fix

Thanks

Kevin

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Not sure why didn't check this but did the following and the high cpu usage stopped.

Services

Turned off  "Symantec Settings Manager"

This obviously stopped "Symantec Event Manager" tooo

Once done the system instance of ccsvchst stopped using CPU. Of course now I can open Protection Center :)

So if that help in diagnosing.

Kudos0

Re: ccsvchst.exe cpu usage Issue

Did you stop this via task manager?  Does the problem return on restart?  If so, try the following:

Options -> Norton Internet Security

Real-Time Protection

See if "Load Auto-Protect during system startup" is checked or not.  If checked, uncheck it. 

Also under Real-Time Protection: General Settings" see if "Turn on Advanced Mode" is checked as well.  Uncheck if it is.

Reboot

Let us know what happens.  Thanks.

Kudos0

Re: ccsvchst.exe cpu usage Issue

I stop the services via the services panel. If I restart the problem it does return. Also if I reboot, after having stopped services, the problem will return. 

I did notice that when I stopped those 2 services that my email client, Thunderbird, would not send/receive email and would generate an error. Where as my web browser would continue to function. Not sure if that means anything.

Currently "Load Auto-Protect  during system startup" is checked.

"Turn on Advanced Mode" is unchecked.

I'll try turning off the system startup setting. 

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivx,

I'd like to have you check something. The next time it happens, check to see if you just pulled down new defs. On XP, you can find those in C:\Program Files\Common Files\Symantec Shared\VirusDefs - look for the folder with the latest date (note the time as well). If there is some kind of virus def corruption problem, it's possible that using Intelligent Updater could correct it.

Thanks,


Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

I will keep an eye on that too. Hopefully problem will occur within next day so I can get a response back to you guys.

Kevin

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi Kevin,

Any signs yet?

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Of course the problem since the last messages has not reared its head, not that I'm complaining, so when it does I'll be trying things.

Kevin

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

If finally happened again.  As far as I can tell things were fine until the following. 

I was in firefox went to a site and attempted to watch a live video stream. The site said I needed Flash 9 (was already installed , but hey whatever). So attempt to download. At first fails due to a bad FF3 exit. Second time success. That is when I noticed it.  Also I had been download a file over the internet, but discount that as 2 hours earlier download a video from same place no problem.

So too me the Flash 9 update seems to have caused the issue.

Oh tried intellegent updater no go. Also had uncheck those other setting and no change

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivc,

Okay, so if we can reproduce this at will using the same steps, let's get the debug logging in place and get some logs. Remember to set all three advanced options for the Norton Reporting Assistant (debug on, noupload and performance monitoring).

This also reminds me of a problem we had initially with the 2007 release where CPU spiked as the result of a bad interaction with an .flv player. What kind of flash player(s) do you have installed?

Thanks,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Yeah I think I remember that issue too. I  currently have version   WIN 9,0,124,0  of the all plugin/activeX installed.  No I have one little issue

I had to uninstall NIS. Mainly because it was causing my laptop to hit about 74-79 C  and slowing my work down.  So, I will unistall tonight or tomorrow the other security suite and reinstall NIS.   In the past uninstall /reinstall of NIS did not change the behavior and I expect as much. Once I reinstall as soon as I see something I make sure debug/logging is on and capture.

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi again,

It would also be good to know if the same site, same video has a problem through IE. Firefox does have some known issues around flash CPU spikes, but I'm not sure that was your only use case.

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Yeah I have seen the FF Flash cpu spike before, but I know that issue and the ccsvchst issue are not related as the ccsvchst issue has occurred even when no browsers are open (say a reboot).

Kudos0

Re: ccsvchst.exe cpu usage Issue

Hi sonicdivx,

Yeah, I thought of that after posting my response. I'm hoping that the debug logs will shed light on this one, particularly the performance monitoring.

Thanks again,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

umm Matt where do I turn on those settings?  I don't seem to have a Reporting Assistant, am I missing something?

Thanks

Kudos0

Re: ccsvchst.exe cpu usage Issue

Sorry about that - I thought I had sent those along previously. Here's a doc with the instructions:

Title: 'Sending log file information to Symantec Technical Support'
Document ID: 2006071711255039
> Web URL: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2006071711255039?Open&src=w
 

The options are in the setup dialog under "Advanced".

Thanks again,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt capturing right now.  Also the problem came back as soon as i reinstalled NIS (Removal Tool NOT used).  So even though I uninstalled then installed a different package then unistalled that package then reinstalled NIS problem still exists.

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt ,

Have the file its 23 MB  where you want me to FTP it too?

Kudos1

Re: ccsvchst.exe cpu usage Issue

Hi -  I sent you a forum email with the details.

Thanks,

Matt

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt, unfortunately didnt catch it , but the high cpu stopped again a couple of hours ago (had been going since yesterday even after some reboots).

Also the info you sent didnt work. Ill try later

Kudos0

Re: ccsvchst.exe cpu usage Issue

Matt,

Something to add. I turned on LiveUpdate notificaton to do and when it runs it gets a failure updating

Intrusion Prevention Signatures/Defintions LU8125 error

I tried the PIUpdate tool no go. Is there a way to manually clear that file (without doing a removal). Maybe that is partly the issue

From log:

Query liveupdatedir location.
6/20/2008, 16:47:50 GMT -> Storing liveupdatedir into standard variable map with value: C:\Program Files\Symantec\LiveUpdate.
6/20/2008, 16:47:50 GMT -> Progress Update: PATCH_START: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis"
6/20/2008, 16:47:50 GMT -> Progress Update: SECURITY_PACKAGE_TRUSTED: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip"
6/20/2008, 16:47:50 GMT -> Signer: cn=Symantec Corporation,ou=Usage - SigningProd02Token,ou=Locality - Arizona,ou=Product Group - LiveUpdate,ou=SymSignature,o=Symantec Corporation
6/20/2008, 16:47:50 GMT -> Progress Update: UNZIP_FILE_START: Zip File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Dest Folder: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263"
6/20/2008, 16:47:50 GMT -> 1213749515jtun_nis8enidcurd25.x86.full.zip is in RAR format.
6/20/2008, 16:47:51 GMT -> Progress Update: UNZIP_FILE_FINISH: Zip File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Dest Folder: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263", HR: 0x0
6/20/2008, 16:47:51 GMT -> LiveUpdate couldn't expand replacement path [IPSDefsInstallDir].
6/20/2008, 16:47:51 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis", HR: 0x802A0006
6/20/2008, 16:47:51 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR
6/20/2008, 16:47:51 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for Symantec Intrusion Prevention Signatures - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 80613001 to 80617001. Server name - liveupdate.symantecliveupdate.com, Update file - 1213749515jtun_nis8enidcurd25.x86, Signer - cn=Symantec Corporation,ou=Usage - SigningProd02Token,ou=Locality - Arizona,ou=Product Group - LiveUpdate,ou=SymSignature,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1825, => The install script for this product had a syntax error, so LiveUpdate could not install it.
6/20/2008, 16:47:51 GMT -> CSendHttpRequest::SendRequest() successfully impersonated the COM client (revert on destroy).
6/20/2008, 16:47:51 GMT -> CSendHttpRequest::SendRequest() successfully impersonated the COM client (revert on destroy).
6/20/2008, 16:47:51 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis", HR: 0x802A0006
6/20/2008, 16:47:51 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR



[edit: reformated log for readability.]
Message Edited by Allen_K on 06-20-2008 05:11 PM

Replies are locked for this thread.