Norton Internet Security / Norton AntiVirus

[itlearner]

Greetings!

ccsvchst.exe has started to run at about 50% utilization again this afternoon. High utilization by Norton started yesterday afternoon. It seemed to have been real bad overnight as the laptop shutdown due to heat. This is what I see in NIS2012:

Full Path: \\?\c:\program files\norton internet security\engine\19.2.0.10\ccsvchst.exe
Developers Symantec Corporation
Version 11.1.0.16

Has there been an update or something that is causing Norton to go boinkers??? Any help will be appreciated. I started using Norton again starting with NIS2011 and up until yesterday things were good so I hope this is something of an anomaly :-)

Thank you!

Rob

[itlearner]

Forgot to mention: Vista Business 32bit on Dell Vostro 1400 laptop.

[itlearner]

Hi!

The ccsvchst.exe is now at 19.5.0.145 (per ProcessExplorer from Sysinternals) *but* it continues to hover at around 50%. I *thought* it settled down this morning for 15 mins or so but it shot backup to the 50% level. What is wrong??? This laptop is not new (Dell Vostro 1400 with dual core CPU @ 1.6Ghz) but this constant util by NIS is slowing things down. Is it compatibility with OS (Vista Biz 32bit) after a certain revision of ccsvchst.exe?

The I updated a month ago from NIS2011 to NIS2012 as my subscription hadn't expired. It was working fine under NIS2012 until this past weekend/Monday morning so I don't think it is necessarily NIS2011 vs NIS2012 (can I even go back to NIS2011 with no changes to subscription anyways)?

Oh so many questioI need to find out why ccsvchst.exe is doing this. Any help will be appreciated! On my newer laptop I use for work it's been running NIS2012 (I upgraded from NIS2011 around the same time) and it's running like a champ ... although the OS is .Win 7 Pro 64bit ... HELP PLEASE!

Thank you!

Rob

[Tim_Lopez Administrator]

Hello Rob,

Sorry for the trouble!

When you check the Norton Tasks section (click on Performance on the Main UI), does it show anything running? Have you allowed a Full Scan to run lately? Does this only happen when your computer is idle? When you come back, does the CPU usage get back to a reasonable level? 

[itlearner]

Hi Tim,

I think you're onto something & since pictures are worth 1000 words, here's a screen capture. I don't recall if I've tried running a FULL scan but there is an entry & the word under the Status column says "Stopping": Hmmm. Also, as to your other question - it does not go down to normal util levels after the computer comes back. Thanks for your help!

Rob

[Tim_Lopez Administrator]

Hello itlearner,

Try running a Manual Full Scan and let the scan complete. You may need to reboot first so that the state changes from Stopping back to it's idle state (whichever it is). Let us know if the scan hangs on a particular file.  

[itlearner]

Tim,

It wouldn't even let me. As soon as I go to full system scan it says " X Error during scan" with no files scanned!

Rob

[Tim_Lopez Administrator]

Hi itlearner,

Now we're getting somewhere. Was this after a reboot? Can you attach a screenshot of the error you receive? 

How To Post Images

[itlearner]

Hi Tim,

I just rebooted & the system let me start a full system scan.

Tonight or tomorrow morning I'll report back the results: whether it gets stuck or completes the full scan, what it says in the Norton Tasks afterwards and the CPU util by ccsvchst.exe with screen shots.

Thank you for the continued dialog!

Rob

[itlearner · Accepted solution]

Greetings! ccsvchst seems to be back to normal CPU til levels!!!

The root cause of all this was NIS2012's scanning engine getting stuck on file(s) in the Internet Explorer cache directory.

Here are details of troubleshooting steps in case they help others:

1. Tried to do manual full system scan per Tim Lopez from Symantec;
2. Each time, whether 30 min or 2.5 hrs into a full system scan, it seemed to hang: symptom being the full system scan window will show the same file name for the longest time AND there is no disk activity other than an occassional LED blink;
3. One of the file it *supposedly* got stuck was in the aforementioned Internet Explorer cache directory so I ran several tools against the files and the various subdirectories in C:\Users\xyz\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5
• Above directory structure was for IE8 on Vista Biz 32bit (it may be different, or not, for any other versions of IE or operating system)
• "xyz" in the above direcotry structure is the logged in user name
• You most probably will have to go into folder's "View" tab in Windows Explorer (open Windows Explorer -> select "Organize" drop down menu -> select "Folder and Search" options -> select "View" tab -> uncheck "Hide protected operating system" and also might have to select "Shjow hidden files and folders")
• there should be bunch of subfolders with random alphanumeric names like "345JDO2X" under "Content.IE5" folder
4.  Before I blew away the subdirectories under "Content.IE5" I ran these tools against the directories and individual files to get the warm & fuzzy that I didn't have anything else going on (like an infection):

• NIS2012 custom scan
• NIS2012 full system scan under Windows' safe mode
• Malwarebytes Anti-Malware full scan
• Symantec's Power Eraser beta tool (says it does look for rootkits)
• Vipre Rescue scan
1. After the tools not turning up anything I blew away the directories under "Content.IE5", rebooted & ran NIS2012 full system scan again
2. The scan choked again but this time it was while scanning the recycle bin ... oops, I forgot to empty the recycle bin after deleting the subdirecotries under "Content.IE5" so --- don't forget to empty the recycle bin
3. After another reboot the NIS2012 full system scan completed successfully. Also I've been running process explorer from sysinternals for the last several days & the ccsvchst.exe's cpu utilization, is normal

Thank you Tim Lopez for asking the 'right' question that lead me down the above troubleshooting steps: in my case having a "Full System Scan" line item that says "Running" in Norton tasks even though I’m not running any was the red herring.

Rob