ccSrvHst.exe running but with a Blank User Name... Why?

Norton Security | Norton Internet Security
1

I have NIS 2010 (v17.1.0.19) running on Vista Home Premium and recently experienced a system crash w/ a BSOD after trying to run an application that was having device driver problems.  After restarting my system, I noticed the NIS Security Status Indicator was missing from the taskbar and sidebar gadget areas.  Was unable to start the NIS panel from the desktop icon nor Start Menu.  After looking at the processes running via Task Manager, I noticed the two ccSrvHst.exe processes were running but with a Blank User Name associated with these processes (see image below).  I noticed in this forum that other NIS users have two ccSrvHst.exe processes running but with User Names.  So, time to call Norton Technical Support, waited 1hr 40mins before speaking with a tech.

 

I was able to get the NIS Security Status Indicator back in the taskbar and sidebar after removing NIS and re-installing NIS per Norton Tech Support person.  Ran a Full System Scan with no reported issues (other than some usual tracking cookies). However, these processes are still running without an associated User Name.

 

My questions are:

1) Is this normal?

2) Why/how did this happen?

3) How do I fix this?

 

 

NoUserName.jpg

 

Thanks all in advance for you feedback and guidance.

 Michael

2

I have NIS 2010 (v17.1.0.19) running on Vista Home Premium and recently experienced a system crash w/ a BSOD after trying to run an application that was having device driver problems.  After restarting my system, I noticed the NIS Security Status Indicator was missing from the taskbar and sidebar gadget areas.  Was unable to start the NIS panel from the desktop icon nor Start Menu.  After looking at the processes running via Task Manager, I noticed the two ccSrvHst.exe processes were running but with a Blank User Name associated with these processes (see image below).  I noticed in this forum that other NIS users have two ccSrvHst.exe processes running but with User Names.  So, time to call Norton Technical Support, waited 1hr 40mins before speaking with a tech.

 

I was able to get the NIS Security Status Indicator back in the taskbar and sidebar after removing NIS and re-installing NIS per Norton Tech Support person.  Ran a Full System Scan with no reported issues (other than some usual tracking cookies). However, these processes are still running without an associated User Name.

 

My questions are:

1) Is this normal?

2) Why/how did this happen?

3) How do I fix this?

 

 

NoUserName.jpg

 

Thanks all in advance for you feedback and guidance.

 Michael

3

It can be a System Process which is running there as CcSvcHst.exe won’t be having any user name associated with in Vista/Windows 7. I think, it is designed like that and there is nothing to worry about. Anyway, let us know the results after running a scan using Malwarebytes as suggested above.

4

Im using windows 7 and both mine show my user name.

5

Hi

 

I have xp pro and one has my name and the other says system. Does your computer have administrator with a name associated with it? Did tech support run the program as administrator?

6

Hi floplot:

 

FYI - My Windows XP, SP3 box also shows the same, which is normal behavior.

 

The user has Administrator privileges.

 

 

Message Edited by Plankton on 01-06-2010 09:22 PM
7

Hi

 

I know what I have is normal. I was referring to when tech support reinstalled the program, if it was done as admin since with Vista you have to run programs after clicking to run as admin.

8

Hi floplot:

 

That is correct - don't you love UAC? :smileywink:

9

Hi Plankton - I was one step ahead of you and ran MBAM just before I reinstalled NIS 2010 (see attached log). FYI, when I reinstalled NIS, I was logged in as the administrator and when I did the screen capture in my original post above as well.

 

Some other background information that may be of interest... I originally had NIS 2007 running fine before upgrading to NIS 2010 on 12/15/09.  NIS 2010 was running fine until 1/5.  However, I can't say with 100% certainty when ccSrvHst.exe started to run with a blank User Name, just something I noticed when NIS went south after the BSOD on 1/5.

 

Thanks for your assistance.

Michael

10

Hi BoneHeadGolf:

 

Thanks for your response. The MBAM log is clean.

 

What is your current situation?

 

Also, how did you uninstall/reinstall NIS 2010?

11
floplot wrote:

Hi

 

I know what I have is normal. I was referring to when tech support reinstalled the program, if it was done as admin since with Vista you have to run programs after clicking to run as admin.

 

Hi floplot - I didn't grant tech support access to remote into my system, he talked me through the steps he wanted to accomplish.  Although I was logged in as the administrator when I did the reinstall, I asked the tech support person specifically if I should right click on the NIS image (NIS-UPGRADE-ESD-17-1-0-19UPEN.exe) to "Run as administrator", he said I didn't need to do that.  Although common sense was telling me I should, I didn't want to "swim upstream" with this guy at this point.

 

Any other thoughts?

 

Thanks,

Michael

12

Hi BoneHeadGolf:

 

I'm awaiting your response regarding my last post.

 

Thanks.

13

Hi Plankton - Current situation seems fine, system responsive and no issues, that I know of.  Just not comfortable knowing that processes are not running with appropriate ownership.  I know that a typical attack vector would be to disable AV/MW detection components change ownership, etc...

 

As for the uninstall/reinstall of NIS 2010... I uninstalled through Control Panel / Uninstall a program, rebooted system, logged in as administrator, double-click NIS-UPGRADE-ESD-17-1-0-19UPEN.exe, ran LiveUpdate, restarted system and NIS seemed fine.  As I mentioned in another post, I didn't run right-click the NIS image to "Run as administrator" (against my better judgment) because the Norton tech support person said it wasn't necessary.

 

Thanks,

Michael

14

Hi BoneHeadGolf:

 

I understand.

 

Could you please follow this procedure, before we run another type of scanner?

 

Please Login to the Admin Account where NIS 2010 was originally installed.

 

Let's try reinstalling NIS 2010 from scratch and see if it corrects the problem in question.

  

Kindly use the NRT (Norton Removal Tool) found here. Read the entire document before using!

 

After downloading the NRT to your desktop, physically disconnect from the Internet.

 

Then reboot as directed, run the NRT once more and reboot again.

 

Reconnect to the Internet.

 

Now install NIS 2010 from this link and reboot as required.

 

Run LiveUpdate until all are exausted.

 

Check on the functionality (i.e. Process) and kindly advise.

 

Thanks.

Message Edited by Plankton on 01-06-2010 10:19 PM
15

Hi Plankton - I guess I forgot to mention that I wanted to run the NRT before reinstalling NIS 2010 and again against my better judgment I listened to the Norton tech support person who said it wasn't needed.  I wanted to be a thorough as possible especially after reading many other posts that suggested the same thing you did.

 

Not sure if I'll have time to do this tonight but will advise when done.  Thanks again for your prompt responses and guidance.

 

Regards,

BoneHeadGolf

16

boneheadgolf,

in your message you say you are running 2 instances of ccSrvhst.exe but in the screen image it shows ccSvchst.exe so i am alittle confused about which process you are asking . anyhow

 

I am running Windows Vista Home Premium Service Pack 2

NIS 2010 ver 17.1.0.19

and Norton add-on pack 4.1.0.10 with parental controls

 

When I bring up my task manager under my standard account there is one instance of ccSvcHst.exe running with no user name and when I click on show processes from all users and type in my admin account password the task manager then shows 2 instances of ccSvcHst.exe running with no user name and also 1 instance of ccProxy.exe with no user name.

 

I don't know if that is the way it should be, but that is the way it has always showed up for me.

 

 

17

Hi TooStrong - My bad:smileysurprised:, ccSrvHst.exe is a typo and should read ccSvcHst.exe.

 

"Show processes from all users" was selected, just can't see it in the image of my initial post.  I think one ccSvcHst.exe process belongs to the SYSTEM account and the other belongs to the logged in user account.  In fact, I now have three instances with a blank Username and can only assume that's because another person is also logged at the same time as well (i.e. System + two users logged in).

 

Thanks for confirming what you see in your task manager.  Now I'm interested to understand why/when some NIS inplementations have Usernames and others have blank Usernames.

 

Appologies to all,

BoneHeadGolf

18

Hi BoneHeadGolf:

 

Did you try the procedure I described above just to see if it corrects the problem?

 

I'm a bit curious, too!

19

Hi Plankton and others - Sorry I couldn't get back to you sooner.

 

Long story short, I did what you suggested and the User Name didn't change back to SYSTEM, it remained blank for the ccSvcHst.exe Processes in Task Manager.  In short, this is what I did... uninstalled NIS 2010 (via Control Panel uninstall a program), ran NRT twice, reinstalled NIS 2010 as administrator, ran LiveUpdate and restarting my system several times.  Dooooh! :smileymad: 

 

BTW, when reinstalling NIS 2010, I did NOT have to enter my Product Key, it was found from a prior installation (probably from the registery).  I thought NRT would have removed all traces of Norton/Symantec products, I guess not. :smileysurprised:

 

I suspect the blank User Name on the ccSvcHst.exe process has something to do with who owns the ccSvcHst.exe file.  On my system, "Administrators" is the Owner of this file, I suspect "SYSTEM" is the Owner on other NIS 2010 implementations.  I also suspect this may have changed when I upgraded from a prior version of NIS (i.e. 2007) to 2010 but can't be 100% sure.  Really would be nice if a NIS engineer or architect could confirm this behavior.

 

Here's an easy way to find out who's the Owner of the ccSvcHst.exe file....

  • Open Windows Task Manager (right-click on the task bar, select Task Manager)
  • click Processes tab
  • scroll to and right-click on the ccSvcHst.exe process in the Image Name column and select Properties
  • click the Security tab
  • click the Advanced tab
  • click the Owner tab and note the value under the Current owner: field

 

If others are interested in letting me know who's the Owner of their ccSvcHst.exe file, NIS version and OS (e.g. Owner=SYSTEM  Ver=NIS 2010  OS=Vista) I would greatly appreciate that.  I think a list of 10-15 participants would be sufficient.  Thanks in advance for your input.

 

Regards,

BoneHeadGolf

Message Edited by BoneHeadGolf on 01-10-2010 12:56 AM
Message Edited by BoneHeadGolf on 01-10-2010 12:59 AM
20

In task manager on my Vista Ultimate 32 bit, both my ccSvcHst files in Task manager have blank user names and the owners are adminstators.

 

Note my NIS 2010 latest version (17.1.0.19) runs properly and normally and does everthing it is supposed to do, updates, scans, protects, warns, etc.

 

I am not concerned about the blank names and assume this is "normall" for my system.  Note: I have done system restores to fix some problems NOT related to NIS more than once, and this may account for the blank names.

 

Anyway I am NOT concerned about the blank names. PS, the only user on my system is the administrator that is shown as owner

 

 

Message Edited by Hawkeyelom on 01-10-2010 12:16 AM