Not what you were looking for? Ask our experts!
Reply
Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009
Accepted Solution

ccsvchst Silent Mode & Smart Definitions?

Because ccsvhst.exe can sometimes cause so much memory usage when it is running (80% to 100% cpu) I find that turning on Silent Mode can provide positive help while browsing the internet and using internal programs. I do not use my computer for gaming purposes or in full screen mode rarely at all and I understand that this was the main reason for introducing it.

 

I have de-activated Pulse Updates & Automatic LiveUpdate as I now prefer to control when these updates are downloaded so as not to incur further load on my resources from LiveUpdate or ccsvchst.exe and this seems to work better than when I had it all Automatic.

 

I did come across the following articles which do help to some extent but they do not give me a complete understanding of how to use Silent Mode when I already have LiveUpdate turned off. Basically I just want to prevent ccsvchst.exe kicking in at unspecified intervals and stop it hogging resources when I am in the middle of something. At the moment turning on Silent Mode has become somewhat of a lets guess how long I want it on for rather than something more scientific. I usually end up turning it off for between 4 hours and day. From my point of view it would be better that updates, scans ccsvhst.exe and all other background processes run when I am away from the computer so that I can just get on with what I need to do when I return.

 

Finally, if I have elected to manually download LiveUpdate at times when my computer is not in use would I then be better to turn off Smart Definitions?

According to Symantec ‘Norton Internet Security provides the Smart Definitions option to choose between the Core Set virus definitions and Complete Set virus definitions for LiveUpdate sessions...... Turning on the Smart Definitions option minimizes download time, installation time, and system start time. Therefore, the Core Set results in faster performance of your computer. When the Smart Definitions option is turned off, Norton Internet Security activates the Complete Set virus definitions which contain all the virus definitions for each threat that is known to Symantec’

 

Silent ModeSay goodbye to interruptive alerts while playing games

 

‘Only the activities that require constant on-demand protection from viruses and other threats keep on running, resulting in minimal impact to the system’

 

The Norton Pulse Updates Feature



‘Both Pulse Updates and full Automatic LiveUpdate respect the new Silent Mode option and turn off completely when Silent Mode is turned on. If the system goes into “automatic” Silent Mode because a full screen application is running, Pulse Updates will not run and the full Automatic LiveUpdate will wait a full six hours before running’

 

Silent Mode

 

Norton Internet Security provides many solutions and features to handle viruses and other security threats. Norton Internet Security also informs you, through alerts and notifications, how viruses and other security threats are detected and resolved. When you perform important tasks on your computer, you likely would prefer not to receive any alert messages. Silent Mode suppresses alerts and notifications and temporarily suspends most of the background activities. If Norton Internet Security detects a security threat when Silent Mode is enabled, it does not display the alert but takes appropriate action to protect your computer. You can either turn on the silent mode manually or otherwise enable the full screen detection which will enable the silnt mode whenever any application opens in the fullscreen mode. You can view the summary of the Silent Mode sessions under the Full History category in the Security History window. This summary includes the type of Silent Mode, the time when Silent Mode is turned on and turned off, and the security activities that occurred during Silent Mode. I think, Pulse updates, Automatic LiveUpdate, System Activity Monitoring by SONAR and Norton Insight/Community watch will be suspended for time being and will resume once you exit from Full screen mode or disable the Silent Mode accordingly.



ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.
Super Spam Squasher
Bombastus
Posts: 1,795
Registered: ‎11-16-2009

Re: ccsvchst Silent Mode & Smart Definitions?

[ Edited ]

If your Norton processes are using 100% CPU, something is seriously wrong and you'd be better off trying to identify and rectify the cause instead of hiding the symptoms.

 


Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009

Re: ccsvchst Silent Mode & Smart Definitions?

Norton is not using 100% CPU all the time only sometimes and that can be when I want maximum resources to be available.

ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.
Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009

Re: ccsvchst Silent Mode & Smart Definitions?

[ Edited ]

Bombastus wrote:

If your Norton processes are using 100% CPU, something is seriously wrong and you'd be better off trying to identify and rectify the cause instead of hiding the symptoms.

 


I have done what I can to try an identify the problem, but switching on Silent Mode is not hiding the symptoms it is merely giving me respite to carry on and use my computer until this situation can be resolved.

 

I do not have the technical knowledge or the amount of time that is required to research this complex problem without the necessary input from Norton but meantime I have run Procmon and identified that ccSvcHst.exe is duplicating the reading of various files much as was found by martin4584 when reporting Dreaded high CPU usage here

 

I was quite astounded by the results produced by Procmon and this was just a sample taken over a period of just an hour or so ........

 

ncwmrc.db

Reading the same path 449 times in just 8 minutes between 11:29pm & 11:37pm 18-Sep-11

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwmrc.db

 

ncwperfmon.db

Reading the same path 22,434 times in just 20 minutes between 10:21pm & 10:41pm 18-Sep-11

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwperfmon.db

 

If Norton Staff could help me understand what exactly is supposed to run under ccSvcHst.exe when Silent Mode is activated then perhaps we might be able to identify why so much memory is being consumed and why there are over 1,250,000 events recorded in just 30 minutes.

 

I have also checked the Norton Full History and it doesn't have anything untoward to report.

 

For the moment I shall run Norton 2012 in Silent Mode while I am working at the computer and run LiveUpdateat at periods of inactivity throughout the day until this unsatisfactory situation can be resolved.

 

PS: Due to the size of the files you will understand that I am unable to copy any of the entries from Procmon.

ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.
Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009

Re: ccsvchst Silent Mode & Smart Definitions?

Norton Staff - Can you help me please.

 

I have added these to to be excluded from Scans , Auto Protect, Sonar & Download Intelligence Detection .......

 

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}

\NIS_19.1.0.28\NCW\ncwmrc.db

 

C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\NCW\ncwperfmon.db



Running Procmon again shows that ccSvcHst.exe is still reading ncwmrc.db & ncwperfmon.db 1000's of times in spite of these exclusions. In fact Microsoft has had to increase my Windows XP Pagefile size because it had run out of Virtual Memory due to the number of records being read.

 

If adding them to exclusions will not work how else can I stop Norton using up my computer resources with unnecessary duplicated file reads?

ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.
lmacri
Posts: 1,642
Kudos: 707
Registered: ‎05-05-2009

Re: ccsvchst Silent Mode & Smart Definitions?

[ Edited ]

Hi crisoco8722:

 

Regarding Norton background idle tasks, you might find Jerry20's thread Disabling All Idletime Activity here helpful.  The information there refers to NIS 2011, not NIS 2012, but you may still find some useful information there.

 

As for Smart Definitions, check out Tywin7's thread Smart Definitions vs. Normal Definitions hereEnabling Smart Definitions is only useful if you have just installed NIS and have not run an initial LiveUpdate to bring your virus definitions up-to-date.  When you install NIS, your first LiveUpdate will install the full set of virus definitions (approx. 64 MB ).  If you enable Smart Definitions after that initial LiveUpdate, you will then download the core set of virus definitions (approx. 47 MB), saving you a grand total of about 17 MB of disk space.  Regardless of whether you have the full or core set of virus definitions, you will receive the exact same set of virus definitions each each day via LiveUpdate.

 

Smart Definitions will only save you download time once, and once only, if you install NIS and immediately enable Smart Definitions before running your first LiveUpdate.  That way, the initial LiveUpdate will download the 47 MB core definitions instead of the 64 MB full definitions.  I have a slow dial-up connection and went back to using the full set of definitions once I figured all this out since I have lots of free space on my 250 GB hard drive and saving 17 MB of drive space was insignificant.

 

This is a complete guess on my part, but the "ncw" in ncwperfmon.db and ncwmrc.db probably refer to Norton Community Watch (NCW).  If you disable NCW in your settings (in NIS 2011, it's Settings | Miscellaneous Settings | Norton Community Watch | OFF) this may stop all this excessive actvity on your computer.  NCW is just a reporting feature included in NIS for the benefit of Symantec (more info is available if you search for "Norton Community Watch" in your NIS Help files) and disabling it will have no effect on the security of your PC.

 

Turning on SIlent Mode will temporarily disable the automated Norton Tasks that run when your computer is plugged in and in idle mode.  To see a list of these tasks, open the Norton Tasks window (in NIS 2011, it's Performance | Norton Tasks).  If Silent Mode is off (which it is by default) and you start working on your computer and take your system out of idle, any background idle task that is partially complete will be suspended until the next time your system goes into idle mode again.

 

Norton Tasks.jpg

----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

lmacri
Posts: 1,642
Kudos: 707
Registered: ‎05-05-2009

Re: ccsvchst Silent Mode & Smart Definitions?

[ Edited ]

crisoco8722:

 

I should clarify one comment in my previous post about Automatic LiveUpdates and idle mode.  If Silent Mode is off (the default) and you are working on your computer or browsing the Internet, pusle updates will still run (i.e., pulse updates will not wait for your system to go into idle mode) because they use very few system resources.  As far as I know, the more resource-intensive full Automatic LiveUpdate (which behaves similarly to a manual LiveUpdate) will only run when your system is in idle mode when Silent Mode is off.

 

I hope someone will correct me if this is wrong.

 

And be sure to read michaell's response here in Jerry20's thread about the new Metered Bandwidth feature in NIS 2012.  You may find this to be a useful feature for controlling how background tasks run in NIS 2012.

----------

Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

 

 

Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009

Re: ccsvchst Silent Mode & Smart Definitions?

Thank you very much lmacri. I really do appreciate the time you have taken to answer my questions and in more detail than I would have expected. I have read all the links but have to admit at this stage that I have not had the time to fully get to grips with the new Metered Bandwidth feature in NIS 2012.

 

While you were preparing your dissertation I was in the process of throughly removing 2012 with the idea of going back to version 2011 but when I re-installed 2011 I could not get on with it having used 2012 plus problems with the toolbar in Firefox 6 so I am back with 2012 again.

 

I have had a quick look at turning off NCW but it seems to have had little or no effect because ccSvcHst.exe is still producing 100's of events for ncwmrc.db but I could not find the other one ncwperfmon.db which is my Performance Monitor. The overall total events with Procmon seem to be less as well. Problem is I cannot run Procmon too long as it uses up so much memory.

I think your are right that NCW is Norton Community Watch.

 

I completely understand your explanation of Smart Definitions. Tywin7's thread was also very helpful.

Your picture of the Norton Tasks helped me understand where to check the Task that have run / not run but I think it is strange that Norton doesn't actually show here what tasks have been switched off. The only tasks I have enabled are Quick Scan & Full Scan but the rest do not show as disabled in the status column.

 

As I have elected to download LiveUpdate (not Automatic) at times when my computer is inactive that doesn't seem to interfere with having Silent Mode switched on. Thank you for pointing out the thread relating to 2012 Metered Bandwidth. I will look into changing some of my options when I fully understant what it is all about.

 

Thanks again for all your help with this.

ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.
lmacri
Posts: 1,642
Kudos: 707
Registered: ‎05-05-2009

Re: ccsvchst Silent Mode & Smart Definitions?

Hi crisoco8722:

Glad to help.  I have a 56 Kbps dial-up modem so the whole issue of Norton background tasks and what tasks run or don't run during Silent Mode and system idles is of special interest to me, and frankly a bit confusing - I'm not sure I completely understand it myself.

I wouldn't worry too much about the actual counts of ncwmrc.db events.  The important issue is how often the Symantec Service Framework (ccSvcHst.exe) is hitting close to 100% of your CPU and available RAM, especially if it happens for a sustained period of time.  If you look in the top graph of the Norton Tasks window (Performance | Norton Tasks), you can zoom anywhere from 10 min to 1 month in the past and see just how often ccSvcHst.exe (the yellow peaks on the graph) has been hitting close to 100% of your total CPU or memory.

 

Norton Tasks Window.jpg

 

I use a small program called Process Explorer v. 15.04 from Microsoft SysInternals instead of the Windows Performance Monitor  that you may want to try.  It's similar to the Performance Monitor and shows the realtime % of your CPU being used by each process that's loaded into memory, and it also shows detailed information about CPU usage, hard drive read/writes, etc. when you double-click on the graphs at the top of the main window.  If you want to try it just download the ProcessExplorer.zip file from here and unzip it anywhere on your hard drive - there's no installation process and double-clicking on the unzipped procexp.exe file launches the program.

 

Process Explorer.jpg

 

----------
Windows Vista Home Premium 32-bit SP2 * NIS 2011 v. 18.6.0.29 * IE 9.0 * Firefox 6.0.0.0
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400 GS

Super Spyware Scolder
crisoco8722
Posts: 202
Registered: ‎05-14-2009

Re: ccsvchst Silent Mode & Smart Definitions?

Thanks lmacri for the further information.

 

Norton Tasks

The tasks section provides a very useful record of cpu peaks and is one that I will keep my eye on in future.

 

Silent Mode

I propose to use this every day now and set it to 1 day. Then just run LiveUpdate Manually which will run without disturbing the setting. I will also run the scans manually as and when. I am not sure if Quick Scan will still run automatically in the background with Silent Mode on though.

I see that there is a facility to add programs to a list that will automatically turn on Silent Mode when the program/s are run. When I can decide what programs to add to the list I will change to that approach.

 

Changes to Default Settings

Insight OFF

Sonar OFF

Identity Safe OFF

Safe Surfing OFF

Automatic LiveUpdate / Pulse Updates OFF

Download New Version OFF

Boot Time Protection (normal) ON

 

Cloud Based Help Files 2012

I really hate this change as every individual help file has to be loaded up in the browser and lacks the speed that 2011 had when all help files were locally installed.

 

Procmon

I will not run this very useful program again unless I see any serious continuous peaks in CPU. Your pointers were very helpful.

 

Process Explorer

Thank you for the detail about Process Explorer. I already have this useful tool but have to admit that I have not used it much. When something unusual is happening on my computer I want an immediate visual of what is going on.

However, your explanation of Norton Tasks I found to be very useful and will help me look at it more constructively the next time I open it to look at past events. SysInternals turn out some great little tools.

 

My CPU Memory Visuals


TinyResMeter I find absolutely invaluable as it is always there in the top bar of every program running on the computer. It will continually change to show the top cpu or whatever setting you want. It is brilliant.

 

TinyResMeter

 

System Monitor is a little known experimental Firefox Add-on and sits in the bottom add-on bar, shown here purple & black. It is a real time monitor and the purple bar constanly changes as system memory demands increase or decrease. Furthermore the hover tooltip quickly provides even further information. See the second screen shot.

In the Windows Notication Area I always have Performance Monitor showing (below the McAfee shield).

This is a miniature graph showing cpu usage.

 

Firefox Addon - System Monitor

 

Screen Shot - Firefox System Monitor Tooltip.jpg

 

Upgrading Norton 2011 to 2012

I had an unfortunate experience when completely uninstalling Norton 2012 with the Norton Removal Tool to re-install Norton 2011. All seemed to have gone well until I upgraded to 2012 again. The problem only came to light when I clicked my special shortcut that opens LiveUpdate. Windows could't find the file and neither could I when I investigated the Norton Internet Security file in Windows Explorer. One folder set listed it and the other didn't.

To cut a long story short it seems that in the downgrade / upgrade Norton had installed a duplicate set of Norton Internet Security files .....

 

Screen Shot - Norton Duplicate Files.jpg

 

I had to run the Norton Removal Tool yet again and even then I was still left with one set of files. Only running the tool a second time did I finally get rid of all traces of the second Norton Internet Security folder so that I could then re-install NIS 2012.

This is something to note for any other user wanting to try out NIS 2012 and then downgrade and later upgrade. It may also have been a contributory factor towards the extra memory that was being used running the program.

 

Kind regards.

 

ASRock Z77 Extreme4 • Windows 7 Home x32 • Norton Internet Security 2012 • Firefox 22 • NoScript • Opera 12 • Site Advisor • Minimem • Sandboxie • Malwarebytes Free • CCleaner • WinPatrol • TuneUp Utilities 2012 • UltraFileSearch.