• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

dtRT.exe Runs High CPU on Startup

I have NIS Version 22.17.2.46 installed on a Win7 32-bit PC. Often on startup dtRT.exe runs with almost 100% CPU for about 1-2 minutes and disappears from Task Manager Processes. It just ran after startup when I connected to WIFI Internet at the Library. The Task Manager Description of dtRT.exe will flash "Symantec Shared Component" off and on about every 2 seconds while dtRT.exe is running. When I search the c: drive for dtRT.exe it can't be found. The following discussion thread indicates "It may be the “Sality.AT” virus".

https://discuss.howtogeek.com/t/cant-find-dtrt-exe/80865/5

See excerpt below from above link.

wilsontp

It may be the “Sality.AT” virus.

This is the only reference I can find to it (aside from some 3D rendering stuff that is not likely this):
https://totalhash.cymru.com/analysis/?3d9466bf3a9cff0d031db60a8ab1cec0decd6596 6

That suggests it is the Win32/Sality malware.

en.wikipedia.org 2

Sality

Sality is the classification for a family of malicious software (malware), which infects files on Microsoft Windows systems. Sality was first discovered in 2003 and has advanced over the years to become a dynamic, enduring and full-featured form of malicious code. Systems infected with Sality may communicate over a peer-to-peer (P2P) network to form a botnet for the purpose of relaying spam, proxying of communications, exfiltrating sensitive data, compromising web servers and/or coordinating dist...

Then farther down the thread...

wilsontp

If I’m reading things correctly, the program changes its name as it executes. So dtRT.exe doesn’t actually exist. Instead, the malicious program creates the dtRT.exe, runs that, then deletes it when it has completed its task.

The come and go behavior described directly above and at the totalhash link matches what I see. What about the come and go "Symantec Shared Component" description in Task Manager while dtRT.exe is running? Any suggestions?

OUgrad

Replies

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Hi @OUgrad

Please update Community. 
Please post progress.  

Thanks

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Hi bjm_:

I don't think OUgrad should be expected to provide a progress report.  They've been waiting for over a week and no one from Norton (or anyone else, for that matter) has provided assistance.

Hi Ougrad:

Does this dtRT.exe only appear in Task Manager when you use the WiFi hotspot at your library?

Just a FYI that I couldn't find any useful information about dtRT.exe in a Google search - I came across the same How-To Geek thread about Sality malware as you but don't know if it's relevant.  I also couldn't find a file called dtRT.exe on my Vista SP2 computer but that might be because I use Norton Security Deluxe v22.15.2.22 (the legacy version for XP and Vista).

If a Norton Full System Scan doesn't find any threats on your computer you might want to try a second opinion scan with Malwarebytes Free. If you aren't familiar with this scanner I've posted some hints in BevStra's thread MyWay Search.

If the problems persists when you boot-up at home and your Norton and Malwarebytes scans all come up clean you might want to post in Malwarebytes' free Windows Malware Removal Help & Support board and ask a trained malware removal specialist to check your system for a hidden infection.  See the thread I'm Infected - What Do I Do Now? pinned at the top of that board for instructions on how to collect and attach diagnostic logs in your first post.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * MB v3.5.1-1.0.365

Kudos0

Re: dtRT.exe Runs High CPU on Startup

lmacri:

Hi bjm_:  I don't think OUgrad should be expected to provide a progress report.  

Okay.   

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Thanks for responding bjm and imacri. I've had no Internet access since June 8. Back on dialup Internet today. The file runs with WIFI at Library and with my home NetZero dialup - sometimes shortly after startup, sometimes a little later and on rare occasions, never. I need to track if it only runs while connected to the Internet.

It would be very helpful if someone from Norton or Symantec could confirm or deny dtRT.exe is part of my NIS Version above OR possibly Norton Ghost 14 that I also have installed and forgot to mention )-: Ghost 14 works well with my Win7 32-bit, but will not restore Images with Win7 64-bit, FYI. I will disable Ghost in msconfig Services and Startup and report back.

I do have Malwarebytes Free and the Free ESET Virus Scanner installed (selected all Advanced options). Ran both after noticing this but no help. Ran NIS Full Scan while online. Was not aware of the Malwarebytes free Support Board - thanks and will consider if needed.

I've been playing cat and mouse several times running search in Windows Explorer on c: drive for dtRT.exe, but the file closes in Task Manager before the search can complete - hoping to quickly copy/paste to Desktop. Today, after being off line so long, dtRT.exe was running in Task Manager about two minutes, much longer than before, but vanished again shortly before the search completed. When the search completes, nothing is found in line with the possible Sality malware described above.

The come and go "Symantec Shared Component" in Task Manager Description makes me suspicious - never seen before with other Descriptions there. Thanks again, OUgrad

Kudos0

Re: dtRT.exe Runs High CPU on Startup

dtRT.exe runs with Ghost disabled, so it must be a file in NIS if the on/off "Symantec Shared Component" Description is legit in Task Manager. Will a Norton/Symantec Software Engineer PLEASE respond.

OUgrad

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

Hi OUgrad:

While you're waiting for someone from Norton to respond, try running the free Process Explorer utility from Microsoft Sysinternals and see if you can catch this dtRT.exe file while it's loaded in memory.  Process Explorer is similar to Windows Task Manager and there's no installation required - just unzip the ProcessExplorer.zip file and double-click to run appropriate the 32-bit or 64-bit executable. Go to Options | VirusTotal.com and ensure Check VirusTotal.com is enabled (if there is no check mark click this option to toggle it on) and the dtRT.exe file will be automatically analyzed by a several popular antivirus scan engines (e.g., AVG, Bitdefender, Kaspersky, Symantec, etc) when it loads into memory.  A VirusTotal detection rate of 3/62, for example, would mean that 3 of 62 AV scan engines rate your file as suspicious / malicious.

The sample image below shows that a file named nvxdsync.exe is part of my NVIDIA graphics software and is named the NVIDIA User Experience Driver Component.  Process Explorer shows it's located at C:\Program Files\NVIDIA Corporation\Display\ (so I don't have to waste time searching my hard drive for this file when it loads into memory) and that 0 of 70 antivirus scan engines rate this file as suspicious / malicious.  If I right-click on nvxdsync.exe and choose Properties I can see a detailed summary on the Image tab, and the Threads tab list other files (e.g. nvapi.dll, etc) associated with this process.

If you click once or twice on the Process column this will list the loaded processes alphabetically and you should be able to find the entry for dtRT.exe fairly easily once it loads into memory.

-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Explorer v16.25

Kudos2 Stats

Re: dtRT.exe Runs High CPU on Startup

Hi,

I've been chasing this little guy down too. The program comes up and runs for approx 2 minutes at about 50%+ CPU. I though it was dtRT.exe too. I finally was able to catch this guy with a screen capture. The program is "cltRT.exe"  and it's path is "C:\Program Files\Norton Security\Engine\22.17.2.46\cltRT.exe" on a x64 bit computer. Scanned it with various malware/antivirus, etc and it comes clean.

Now that it is properly identified, can Norton please tell me what it is, why it shows nothing in process description, and why it's running a lot of my CPU? And if it's truely clean. I will submit it if you want.

Thanks.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

H00D00: The program is "cltRT.exe"  and it's path is "C:\Program Files\Norton Security\Engine\22.17.2.46\cltRT.exe" on a x64 bit computer.

by my read

Topic opening post is about dtRT.exe ( d t RT) and your message is about cltRT.exe (c l t RT)
Um, is @H00D00 pointing to:

Filename: cltRT.exe ( c l t RT)
Full Path: C:\Program Files\Norton Security\Engine\22.17.2.47\cltRT.exe (c l t RT)

VirusTotal cltRT Details
https://www.virustotal.com/gui/file/0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b/details

File Attachment: 
Kudos0

Re: dtRT.exe Runs High CPU on Startup

OUgrad:

I have NIS Version 22.17.2.46 installed on a Win7 32-bit PC. Often on startup dtRT.exe runs with almost 100% CPU for about 1-2 minutes and disappears from Task Manager Processes....

 Hi OUgrad / H00D00:

Have you both received the latest v22.17.2.47 update (check at Help | About) just released on 11-Jun-2019?  According to the product update announcement <here> the v22.17.2.46 update (rel. 28-May-2019) had a few bugs that should be fixed in v22.17.2.47.

H00D00:
I've been chasing this little guy down too. The program comes up and runs for approx 2 minutes at about 50%+ CPU. I though it was dtRT.exe too. I finally was able to catch this guy with a screen capture. The program is "cltRT.exe"  and it's path is "C:\Program Files\Norton Security\Engine\22.17.2.46\cltRT.exe" on a x64 bit computer.

Hi OUgrad:

Is it possible your problem file is actually called cltrt.exe and not drt.exe?  It would be easy to make that mistake if the process only runs for a few minutes at boot-up and then disappears.  I experienced system freezes at boot-up a few years ago because of one of these CLT (Consumer Licensing Technologies) shared components, although in my case it was the Symantec Shared Component cltlmh.exe file - see my comments in bcbrown's thread Norton Causing Explorer.exe to Freeze in Win XP from 09-Apr-2017 onward.  A clean reinstall of my Norton product (which includes a more thorough wipe of old Norton files than the "regular" refresh with the Norton Remove and Reinstall tool) eventually solved the problem. Here's a Process Explorer image I captured back in April 2017:

Hi H00D00:

I don't know why your cltrt.exe executable is consuming so much CPU at boot-up (hopefully someone from Norton will jump into this thread and explain its function), but if you have a Win 8.x or Win 10 OS and haven't already done so, I'd suggest that you disable the Windows Fast Startup power option described in peterweb's thread Windows 8/8.1 or 10 and Fast Start Feature and then re-boot your system a few times after this setting is disabled to see if that reduces the CPU consumption at boot-up.  This Fast Startup feature (also called hybrid boot-up / hybrid shutdown) can interfere with product updates and loading of Norton services at boot-up and result in all sorts of odd glitches and unexpected behaviour on Win 8.x and Win 10 computers.  If you've disabled this power option in the past just confirm that it's still turned off, since Fast Startup can sometimes re-enable itself after a major Windows update like a change from Win 10 Version 1803 to 1809.

-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Explorer v16.25

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Hi Imacri.

Yes, cltRT.exe is a possibility because it looks a lot like dtRT.exe. The next time I see it in Task Manager, I'll take a screenshot and upload for second opinions.  H00D00 may have saved lots of time on this critter and also thought it looked like dtRT.exe initially as I did. My NIS Version is 22.17.2.47, Engine updated 6/15/19, one hour 10 minutes after my Ghost Post above. Perhaps that will solve the problem. If I don't see it again, will assume so I guess and advise. My AMD single core processor runs at 100% CPU when this happens.

That free Process Explorer sounds like a neat diagnostic tool - will try. I've used VirusTotal.com often to check links before opening and even uploaded a few suspicious files.

Thanks,

OUgrad

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

Hello fellow dtRT seekers,

It is cltRT.exe, not dtRT. No wonder no one can find it.

I’m the one who started the thread at How to Geek. I wasn’t ready for their solution yet: Do a clean reinstall of Windows. A Google search found this thread, which I have been following.

I was traveling and without internet for several days, so I can confirm that cltRT.exe runs without an internet connection. Mine doesn’t run at startup. It seems random when it starts, usually in the evening. I know it’s running because the little wheel starts turning. I open Task Manager and see it. The highest cpu use I’ve seen is 25, so it’s nowhere near 100% of cpus.

“Symantec Shared Component” has only flashed up 3 times since I have been looking at this process. I have tried R-clicking to open file location. It goes nowhere. I’ve tried to end the process but the computer won’t let me. I have a screen capture from June 14 asking me if I want to end cltRT.exe.

This was when I tried to end "dtRT.exe".  But I still didn't get it.  It's really cltRT.exe.

From the VirusTotal site, cltRT.exe was created 5-14-19. That’s about when it started running on my computer. I’m not sure of the exact date.

I did Norton chat when I first saw “Symantec Shared”, asking if this was a Norton process. The tech said no, ran the Power Eraser and found nothing. Then Norton called me from India (I think), and another technician tried to help me. She did remote access to my computer, looked at the registry and ran all sorts of scans. The “problems” she found were things like Glary Utilities, Malwarebytes and Glary’s Malware Hunter. These are programs I use, not PUPs. But she couldn’t find dtRT.exe.

I’ve done countless scans, Malwarebytes Rootkit etc, and all come up clean. I now assume it’s safe, and really is a Symantec Shared Component. I’d still like to know what it’s doing.

I downloaded Process Explorer and captured a screen shot of cltRT running there. It really didn’t help much, although there is a process id.

I just ran Live Update and now have Norton version 22.17.2.47. I had 46 before. CltRT.exe is still in the Engine file, so I assume I will probably see it continue to run. At least I’m a lot less worried about it. Thank you for the help I found here.

Windows 7 Professional 64 bit

Kudos0

Re: dtRT.exe Runs High CPU on Startup

K.C.:
...Mine doesn’t run at startup. It seems random when it starts, usually in the evening. I know it’s running because the little wheel starts turning. I open Task Manager and see it....

Hi K.C.:

Thanks for your input.  I'm afraid I might not be of much help troubleshooting this problem, though.  I use Norton v22.15.2.22 (the legacy version for Win XP and Vista) and my Symantec Shared Component cltrt.exe v15.15.1.8 at C:\Program Files\Norton Security\Engine\22.15.2.22\ hasn't been modified since 27-Mar-2019.  I set Process Explorer to automatically launch after I log in to Windows (Options | Run at Logon) and still haven't been able to catch cltrt.exe running so it either loads very early in the boot process on my computer or just loads and unloads so quickly that I can't see it running in real-time in Process Explorer.  I might need to try something more sophisticated (perhaps Microsoft Sysinternal's Process Monitor or the free version of bitsum's Process Lasso that Krusty13 posts about <here>) that will actually log cltrt.exe activity over time.

One observation about your Process Explorer screenshot though. The user name associated with this process is for your Windows logon account (Pete\Karyn) and not SYSTEM.  There should be two instances of nortonsecurity.exe loaded into memory (in Windows Task Manager, you must enable "Show Processes From All Users" to see both instances) - see my image below.  I believe the instance owned by SYSTEM manages your Norton real-time protection and the instance owned by the user manages less critical tasks like rendering of the Norton interface and background tasks like Automatic LiveUpdates - that way your real-time protection won't be disabled if your Norton interface crashes or there's a problem with a background task running to completion.  Just speculation on my part, but I wonder if cltrt.exe, which is owned by your Windows user account, is hanging on your system because Norton is having problems connecting to the Norton backend servers at random times throughout the day while it tries to complete some low-priority task?

...It really didn’t help much, although there is a process id.... The highest cpu use I’ve seen is 25, so it’s nowhere near 100% of cpus.

 The PID of any particular process won't tell us much since they change after every boot up.  One thing you can see in my image, however, is that the main nortonsecurity.exe process owned by SYSTEM that manages real-time protection has a lower PID (PID 1188, started 3:12:56 PM) because it loads into memory sooner that the low-priority nortonsecurity.exe process (PID 3912, started 3:13:47 PM) that runs under it.

If you have a quad core CPU, that might indicate that the thread for cltrt.exe is saturating an entire core and peaks out at 25% CPU consumption.

...I’m the one who started the thread at How to Geek. I wasn’t ready for their solution yet: Do a clean reinstall of Windows.....

That sounds a bit extreme for an initial troubleshooting step.  If the problem persists after your Norton v22.17.2.47 update post back and let me know the name of your Norton product [e.g., Norton Internet Security (NIS), Norton Security Standard / Deluxe / Premium, etc.] and I can post instructions for a clean re-install of your Norton product.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Explorer v16.25

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Thank you for the suggestions. I do have two Norton Security.exe entries in Task Manager, one System and one in my user profile.

I have Norton Security Standard installed 2-22-19.

This installation went very differently than previous years. Usually, there is a progress bar, and you see extraction of old files and installation of new. If I remember correctly, it took maybe 30 minutes to get a new Norton program. This year, it took about 2 hours. There was no progress bar, so I couldn’t see the extraction of old programming or installation of new. At the end, a window popped up and said it’s done.

My Norton Security program is 808 MB. That seems bigger than it should be. A lot of the folders were created 4-15-17. But the files have been updated. The Engine file was created 4-15-17, but the subfolder 22.17.2.47 was created 6-17-19. The subfolders were created 6-17-19, but modified today 6-18-19. Norton updated again today.

I looked at the size of the different folders in Norton Security. The Engine folder is 170 MB. Then there is Engine 32 created 4-15-17 at 240 MB. MUI has 25 MB. Norton Data is 366 MB. The subfolder 22.12.0.104 was created 2-23-18. Subfolders like Definitions were also created 2-23-18, but modified today except for the folder Virus Defs. It was modified 6-4-19 and is empty.  (Wonder why.)

This is odd: Norton Data was 506 MB this morning when I was looking at it, and now it’s down to 366 MB. Norton is modifying my files right now. But the whole NS folder is still 808 MB.

CltRT ran last night at 8:20 PM, after the Live Update to version 22.17.2.47. I was right, it’s going to continue to run. I took another Process Explorer screen shot, that’s probably not worth posting. It was using 31 cpus, the highest I’ve seen. The Virus Total column has no info because my internet was turned off.

Do you really think I should do a clean reinstall of Norton? If this is part of the program, it probably won’t change anything. It’s not like it’s crashing my computer or anything. My obsession was finding what it was. I think we’ve got that figured out.

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

K.C.:

CltRT ran last night at 8:20 PM, after the Live Update to version 22.17.2.47. I was right, it’s going to continue to run. I took another Process Explorer screen shot, that’s probably not worth posting. It was using 31 cpus, the highest I’ve seen...

Hi K.C.:

I saw one of these CLTxx.exe shared components appear in Process Explorer about 5 min after my system was powered on this morning but I couldn't see if was cltrt.exe or cltlmh.exe - it was only loaded in memory for a few seconds and disappeared.  I launched Process Monitor (not Process Explorer) and created a filter so it would only log activity related to cltrt.exe but after a few hours I didn't see any new activity logged for this executable and the cooling fan on my poor old Vista machine was running pretty hard so I stopped the logging.

...My Norton Security program is 808 MB. That seems bigger than it should be... I looked at the size of the different folders in Norton Security. The Engine folder is 170 MB...Subfolders like Definitions were also created 2-23-18, but modified today except for the folder Virus Defs. It was modified 6-4-19 and is empty.  (Wonder why.)

I can't tell you what disk space Norton Security should normally occupy on your 64-bit system since I use a legacy (XP/Vista) version of Norton on an old 32-bit machine, but if you're curious I've attached a PDF showing my folder sizes for C:\Program Files\Norton Security (~400 MB) and C:\ProgramData\Norton (~220 MB) that were captured with the portable version of TreeSize Free.  I don't think your folder sizes shouldn't be an immediate concern if the program seems to be functioning correctly.

It's normal for the C:\Program Files\Norton Security\NortonData\<22.x.x.x>\Definitions\VirusDefs folder to be empty for Norton v22.x installations.  The virus definitions are now called SDS Definitions in newer versions of Norton [see the June 2016 announcement Introducing Symantec Data Scanner (SDS) Technology] and your latest virus definitions are stored in the \SDSDefs subfolder.

Do you really think I should do a clean reinstall of Norton? If this is part of the program, it probably won’t change anything. It’s not like it’s crashing my computer or anything. My obsession was finding what it was. I think we’ve got that figured out.

You'll have to judge for yourself if the cltrt.exe file in v22.17.2.47 is still affecting system performance badly enough to go to the effort of trying a re-install.  If you wish, you can try a simple refresh of your Norton installation using the Norton Remove and Reinstall tool in "normal" mode as instructed at https://www.norton.com/nrnr.  A refresh will automatically reinstall your Norton product and is relatively quick - all you have to do is run a few cycles of manual LiveUpdates and re-boots after the tool runs to ensure you're fully patched back to the latest v22.17.2.47.  A clean reinstall is more labour-intensive (older instructions for Norton Security Deluxe are posted <here>) and it will erase all your custom configuration settings but a clean reinstall does a better job of wiping traces of older Norton installations.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Monitor v3.52

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

K.C.:

My Norton Security program is 808 MB. That seems bigger than it should be.

 

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

Kudos0

Re: dtRT.exe Runs High CPU on Startup

K.C.:
...My Norton Security program is 808 MB. That seems bigger than it should be...

Hi K.C:

Since bjm_ has confirmed that the large 808 MB size of your C:\Program Files\NortonSecurity installation folder in v22.17.2.47 is normal, so here's a few thoughts:

  • Norton v22.12.0 (released January 2018) introduced a feature called Single Layout - see the product update announcement <here>.  That means that once the Norton installer runs to completion it syncs with your Norton Account and activates / deactivates the appropriate features like the Norton Smart Firewall, Norton Backup, etc. based on the product license you paid for.
  • The installer for the beta versions of Norton v22.17.2.x included a feature called Norton Data Protector (see the announcement 'Norton Data Protector' is a Part of Norton 22.17.2! in the EAP beta testing forum) that was not activated when the stable versions of Norton v22.17.2.46/47 went into wide release and started rolling out on 28-May-2019.
  • The "new" Norton 360 Standard / Deluxe / with LifeLock Select products that just came out of beta are only available for purchase in the U.S. for now and have additional features like Norton SafeCam, Norton Secure VPN, etc. (see the product comparison chart for the "new" N360 products <here>)

More speculation on my part, but I'm guessing your C:\Program Files\NortonSecurity folder is more than double the size of my old legacy (XP/Vista) version because it includes files for additional features like Norton Data Protector, Norton SafeCam, Norton Secure VPN, etc, that may or may not be activated in your user interface by Single Layout, based on the license you purchased.

I have no idea, however, if Single Layout is connected in any way with CLT (Consumer Licensing Technologies) files like cltrt.exe.  We really need someone from Norton to jump in here and explain what cltrt.exe is doing throughout the day when it executes and starts consuming high amounts of CPU in Norton v22.17.2.x.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Explorer v16.25

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

Imacri: I have no idea, however, if Single Layout is connected in any way with CLT (Consumer Licensing Technologies) files like cltrt.exe.  We really need someone from Norton to jump in here and explain what cltrt.exe is doing throughout the day when it executes and starts consuming high amounts of CPU in Norton v22.17.2.x.

@Sunil_GA

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Thanks for all the valuable help. You guys are great.

My Norton program is working fine. I don’t think doing a Remove and Reinstall will make much difference, because this process is part of the programming. It will still be there in the new installation.

I’m not ready to try a beta program. I like what I have: it runs in the background and doesn’t bother you until it’s needed.

CltRt.exe is not really a big deal. It runs daily, and uses a lot of cpus for a minute or two. I’m glad to learn it’s a legit Norton process. I too wish I knew what it was doing.

We’ve determined that the update to v. 22.17.2.47 didn’t end this process. I got a lot more updates yesterday, and was hoping maybe those might stop cltRT.exe from running. It didn’t run last night, so fingers crossed, but as soon as I turned on the computer this AM, it ran. So it’s going to keep running. As long as I know what it is, I don’t care.

This forum saved me $$ and a trip to the local tech for scanning. Thanks again.

I think I’ll go back to Norton chat and tell them my case has been resolved. If I’d had the name right, the solution would have been a lot faster. Old eyes. I’ll give them a link to this thread. Maybe someone will take the time to post here the purpose of this process and why it uses so much power.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Um, can you confirm that your cltRT.exe is the same as > 

VirusTotal cltRT Details
https://www.virustotal.com/gui/file/0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b/details

Kudos0

Re: dtRT.exe Runs High CPU on Startup

K.C.:

...My Norton Security program is 808 MB. That seems bigger than it should be....

Hi K.C.:

One further observation about that large folder size.  I re-checked the size of my C:\Program Files\Norton Security\ folder today with TreeSize Free and it temporarily jumped from 396.6 MB yesterday (shown <above> in my PDF attachment) to 513.1 MB today - all apparently due to the fact that I had two recent virus definitions sets (v20190619.002 and v20190619.008 of ~115 MB each) stored in my C:\Program Files\Norton Security\NortonData\22.x.x.x\Definitions\SDSDefs folder.

Five minutes later a maintenance task ran that purged the older v20190619.002 definition set and my C:\Program Files\Norton Security\ folder dropped back to its "normal" 397.7 MB.

That means that you could see your C:\Program Files\Norton Security\ folder size fluctuate widely on a daily basis, depending on the number of new virus definition sets delivered throughout the day and the time of day the maintenance task runs to purge older definition sets.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * TreeSize Free v4.3.1

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Norton Security EAP 22.17.2.47

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Yes, I’m sure Virus Total is referring to the same file that’s on my computer.

The Digital signature says sha256, created 5-14-19.

The virus Total page has SHA-256 down the page on the right under ‘Contained Resources’. The Virus Total cltRT.exe was also created 5-14-19.

So they’re definitely the same file.

There is also a cltRT.exe in the Engine 32 file.

Path is C:\Program Files\Norton Security\Engine32\22.17.2.47\cltRT.exe

The digital signature looks identical to the one in the Engine file.

I ran Norton File Insight on the first one.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Okay... I was referring to cltRT.exe checksum.   
Copy to Clipboard >

File Thumbprint - SHA:
0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b
File Thumbprint - MD5:
f9f2da5620bb3647c94c7d06c616d884

Thanks

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Hi bjm

I've never heard of a checksum before, and am afraid to check that on my computer.  Just not sure if I might mess something up.  So I don't know if they match.

I did contact Norton chat to say my old case was resolved, but I still wanted to know what this Norton process is for.  At first the agent tried to  tell me it was not a Norton process, but I insisted it was in the Engine file.  Another agent came on and wanted to send me to the techs to scan for a virus.  I said no, not necessary.

I told them it was not an urgent problem, but I wanted more information about cltRT.exe.  I'm waiting for a call back.  So we might get more info on what this is doing.

It's still running daily, but in the AM now shortly after I open my computer.  Today it ran for less than 30 seconds.  No big deal, I guess.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

A checksum is a sequence of numbers and letters used to check data for errors. If you know the checksum of an original file, you can use a checksum utility to confirm your copy is identical.

https://www.howtogeek.com/363735/what-is-a-checksum-and-why-should-you-care/

Just for fun....if you want....click Copy to Clipboard and Paste to Notepad....you'll see cltRT.exe checksum.   

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Thanks bjm_

I even learned something new.  They do match:

SHA-256 Checksum from Virus Total:

0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b

Mine:

0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b

That page from How to Geek was what I read about checksum, but I didn't want to try using Power Shell to get this info.  It was easy using Norton File Insight.  That's a good skill to have if you ever need it.  Cool.

I also want to thank Imacri for explaining the fluctuating size of the Norton Definitions folder.  It makes sense now.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

~ I've used MD5 Checksum Tool long time: https://www.novirusthanks.org/products/md5-checksum-tool/

for example from context menu MD5 Checksum Tool
and Clipboard > paste renders

File: cltRT.exe
File size: 142 KB (144,920 bytes)
MD5 checksum: F9F2DA5620BB3647C94C7D06C616D884
SHA1 checksum: 630524501371EA3A7923B4E116A66B39CE9595F0
SHA256 checksum: 0D48870E420EF2F65FC5632A5924F47AE0DD368D3CA8663897E226E1BBF0A87B
Kudos0

Re: dtRT.exe Runs High CPU on Startup

K.C.:

I've never heard of a checksum before...

Hi K.C.:

One other hint - you can also use VirusTotal to find the SHA256 hash (which bjm_ calls a checksum).  If you know the location of the file on your hard drive just browse to https://www.virustotal.com/, select the File tab, click Choose File, and upload the file for analysis.

If I upload my cltrt.exe file at C:\Program Files\Norton Security\Engine\22.15.2.22\ for analysis the Virus Total scan results at https://www.virustotal.com/gui/file/345cb8b367eb648e238d25e33dfd2e78f66550ae094efa7ec7e6a7f32d873fc6/detection show that 0 / 70 antivirus scan engines (Bitdefender, Kaspersky, McAfee, Symantec, etc.) detected this file as suspicious / malicious.

Note that the SHA256 hash that VirusTotal calculates for my cltrt.exe v15.15.1.8  (345cb8b367eb648e238d25e33dfd2e78f66550ae094efa7ec7e6a7f32d873fc6) is different than yours because my legacy version of Norton has an older version of this file.  If I use Norton's File Insight to analyze my cltrt.exe file and use Copy to Clipboard to paste the detailed results into a text editor it shows the identical SHA256 hash.

....I told them it was not an urgent problem, but I wanted more information about cltRT.exe.  I'm waiting for a call back.  So we might get more info on what this is doing...

I hope someone from Norton will respond and explain the function of this file.  Regardless of whether cltrt.exe is "safe" or not, there is still a problem if OUgrad, H00D00 and others are seeing excessive CPU consumption by this executable for ~ 2 minutes on their systems.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton v22.15.2.22 * Process Monitor v3.52

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

I have two of cltRT.exe:

"C:\Program Files\Norton Security\Engine\22.17.2.46\cltRT.exe"
file version 15.17.2.7
141KB
SHA-256: 0d48870e420ef2f65fc5632a5924f47ae0dd368d3ca8663897e226e1bbf0a87b

"C:\Program Files\Norton Security\Engine32\22.17.2.46\cltRT.exe"
file version 15.17.2.7
123KB
SHA-256: fcdbb43a5d3bb14357fef7b99c6b9708b4cb5ae2ba36a695917add86b511091f

In Windows 7 x64Task Manager there is no File Description just to add to the mystery.

Seems like the mystery is solved, just needs to be addressed by Norton to add the File Description.

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

On June 16 above, Imacri replied:

"Hi OUgrad / H00D00: Have you both received the latest v22.17.2.47 update (check at Help | About) just released on 11-Jun-2019? According to the product update announcement the v22.17.2.46 update (rel. 28-May-2019) had a few bugs that should be fixed in v22.17.2.47."

Neither dtRT.exe nor cltRT.exe have appeared in Task Manager since my June 15 upgrade to NIS v22.17.2.47. It previously appeared at least once daily and sometimes more than once. I am therefore going to mark Imacri's June 16 post above as the solution, at least for me. OUgrad

Kudos0

Re: dtRT.exe Runs High CPU on Startup

@OUgrad

I have the v22.17.2.47. Had to manually update it.

Thanks.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

I had to manually update to v22.17.2.47 as well.  CltRT.exe still runs daily on my computer, but differently since the update.  It runs a few minutes after I open the computer now (used to run in the evening), and it's using about half the cpus it used to use.  Yesterday I saw ~14 cpus in Process Monitor, and today just 11 cpus in Task Manager.

I still know it's running because the little wheel starts turning.  It runs for a shorter time now, less than 30 seconds, and uses about half the cpus it was using before.  Maybe it'll be less of a problem for those who saw 50% or 100% of cpus when it ran.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

@K.C.

Yeah, same here.

It would be nice if Norton would add a File Description for it in Task Manager so it wouldn't freak their customers out.

Kudos0

Re: dtRT.exe Runs High CPU on Startup

Well, the cltRT.exe high CPU is BACK thanks to NIS Engine Update v22.17.3.50.

If Norton/Symantec is monitoring this Discussion Thread, v22.17.2.47 fixed the problem as noted here previously, so it should be easy to undo what was done to reintroduce this BUG. Just retrace your steps from v22.17.2.46 where the BUG manifested, to v22.17.2.47 where it was fixed, to v22.17.3.50 where the BUG returned.

So, Imacri, should I temporarily "clear solution" above to hopefully get a Norton/Symantec software engineer's attention? Do you agree or do you have another way to get their attention?

At least I know the file is legit (my biggest concern) at this path.

c:\Program Files\Norton Internet Security\Engine\22.17.3.50

It is cltRT.exe if I Iook closely in Task Manager with "Symantec Shared Component" description.

I can live with transient 100% CPU, but had NO high CPU anytime with v22.17.2.47. OUgrad

Kudos0

Re: dtRT.exe Runs High CPU on Startup

OUgrad:

Well, the cltRT.exe high CPU is BACK thanks to NIS Engine Update v22.17.3.50.....

So, Imacri, should I temporarily "clear solution" above to hopefully get a Norton/Symantec software engineer's attention? Do you agree or do you have another way to get their attention?...

Hi OUgrad:

Yes, I'd recommend unmarking this thread as Solved.

Perhaps bjm_ or one of the other Gurus monitoring this thread could alert one of the Norton employees.  The Gurus have a private board in the forum where they can contact Norton employees and can @mention people to ensure they receive an automatic email alert.  Unfortunately, that doesn't guarantee Norton employees will bother to respond.  Several Win XP / Vista users (including myself) have been trying to report a bug in the latest Norton Safe Web for Firefox v3.8.0.6 in imbart's thread <here> for over a month now and none of the Norton employees has responded in that thread to two of Guru Krusty13's requests for assistance.

If all else fails you could try contacting Norton Customer Support via Live Chat at https://www.norton.com/chat but they'll likely ask if they can start a remote access session and reinstall Norton for you to see if that solves the problem (I always decline this request and handle all reinstalls myself).  K.C. didn't have much luck going that route but at the time K.C. thought we were looking for dtRT.exe, not the Symantec Shared Component cltRT.exe.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Deluxe v22.15.2.22

Kudos0

Re: dtRT.exe Runs High CPU on Startup

adding that this Process Monitor event (Posted: 18-Jun-2019 | 8:09PM • Permalink) was a one-off.  I have not been able to reproduce.

I opened Process Monitor and then opened Process Tree under Tools and there was cltRT.exe

I have not been able to reproduce.  I tried to add Process Monitor cltRT.exe Filter.   Filter has yet to render cltRT.exe. 

IDK

Kudos0

Re: dtRT.exe Runs High CPU on Startup

OUgrad:

Well, the cltRT.exe high CPU is BACK thanks to NIS Engine Update v22.17.3.50.

If Norton/Symantec is monitoring this Discussion Thread, v22.17.2.47 fixed the problem as noted here previously, so it should be easy to undo what was done to reintroduce this BUG. Just retrace your steps from v22.17.2.46 where the BUG manifested, to v22.17.2.47 where it was fixed, to v22.17.3.50 where the BUG returned....

... and more speculation on my part, but this high CPU consumption by cltRT.exe that usually occurs at boot-up sounds like it started with Norton v22.17.2.46, which is about the same time users started reporting problems with the Norton icon in their system tray where there can be a noticeable delay at boot-up before the status indicator changes from grey to green - see SendOfJive's comment in the thread Tick Icon Changed Colour.  Perhaps cltRT.exe is involved somehow and running for extended periods on some machines while Norton tries to run / report a health check of your realtime (RT) protection.
-------------------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Norton Security Deluxe v22.15.2.22

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

lmacri:   [..] about the same time users started reporting problems with the Norton icon in their system tray where there can be noticeable a delay before the status indicator changes from grey to green
Perhaps cltRT.exe is involved somehow and running for extended periods on some machines [..]

FWIW - my Norton tray Icon does grey to green in a few seconds.  I'm not aware of high CPU on my setup.  Just me.  

Kudos1 Stats

Re: dtRT.exe Runs High CPU on Startup

Perhaps high CPU is more of a problem with my 32-bit OS than 64-bit installations and/or my single core AMD Processor?

Perhaps my total absence of high CPU (more like 20-30% max at all times) with v22.17.2.47 was due to that 32-bit NIS Engine?

OUgrad