Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.
I doubt its a virus. As just 20 minutes ago I finished a Full Scan and it dropped to 0% cpu shortly thereafter.
Then I closed the lid and my laptop went into hibernation. Once shutdown, I unplugged my External usb HD, USB flash drive. USB Data card, and USB phone cable.
20 minutes later opened up and restored out of hibernation. cpu usage jump to 50% area and has stayed there (no periphals plugged in , except USB Data Card) Ran a quick scan and that did nothing.
Yes the infamous ccsvchst.exe cpu usage issue. I am running into a situation where on my Windows XP Pro laptop it will occasionally run at about 50% cpu until I 1. leave system on for days or 2. run a full system scan.
I believe the issue stems from removable drives both real and ghost. I have tried unchecking the scan removable setting but that setting always comes back checked when I reboot. This is a clean install of Win XP Pro on a system that had a previous install.
At first thought issue was because some files had unknown SIDs, I fixed all of that and even when it was not fixed the cpu issue would go away and come back. I also notice that on occasion it will happen coming out of Hibernate.
Since this is a laptop this is a serious issue as it causes my system to run slow, hot and kills the battery. I am getting pretty frustrated and firmly believe there is a flaw with ccsvchst as this type of problem does not occur with AVG or Zone Alarm. Oh I am running NIS 2008. Also I have uninstalled and used the Norton Removal Tool both twice and still get the same thing.
Lastly the service that has issues is the version of ccsvshst.exe running under SYSTEM user. Logs do not show anything unusual.
Thanks
What I came to know of your problem is, your Norton may have some problems.Completely remove Norton by running the removal tool from www.symantec.com/symnrt. Reinstall Norton.Your problem should be solved.
Keep your fingers crossed......
Hello sonicdivx,
When you do the reinstall, make sure you have install the latest version. There were a number of under-the-hood fixes related to hibernation. You can get it here.
Thanks,
Matt
Matt,
How do I check what version I am running now? Doing install in just a few.
Hi sonicdivx,
You can confirm the version by clicking on the Help & Support link in the main product UI. In the One Click Support dialog that emerges, click About, then click the Norton Internet Security tab. You can download the latest version (15.5.0.23) here.
Thanks,
Matt
Matt,
I just installed the latest version this morning. I previously did an uninstall then used the Norton Removal tool.
Right now as I type the SYSTEM process is show 45-50% CPU and 100MB usage.
Now I just made 3 changes to settings.
Uncheck Scan removable drives when connected (on a laptop and usually plug/unplug 2-3 devices throughout the day)
Uncheck Scan inside compressed files
Check Scan Microsoft documents
Exclude VM files (run VMware and ShadowProtect)
My current system is a clean install of Win XP Pro but not a format of drive. That means that I had files which have / had orphaned SIDs. I had thought I had changed them all, but found some more this morning. Does this impact scanning?
Lastly, for me If I had some idea of how it deals with scanning I might be able to narrow down the issue. I am not a typical user, as I do a lot of development and consulting work , so often have a wide swath of applications installed/uninstalled. I also run things like Windowblinds, VM, Altiris SVS, etc...
Thanks
Hi sonicdivx,
I've sent you a forum email with additional instructions.
Thanks,
Matt
Matt,
Shortly after receiving the email, I tried things mentioned even though not running 360. No luck.
Well its saturday and just let the laptop sit overnight with just my external Hard drive plugged in and all is fine now. That said problem is probably still there as this is typical behaviour. Come monday I'll post if anything changes.
Kevin
Matt, update yeah still have the issue. If I leave the computer connected for several hours it generally goes away. If I then go into Hibernate and thus unplug external hard drives, then later continue there is a high probability ccsvchst will have high cpu usage.
To me it seem related to removable / network drives maybe. I know I have scan removable unchecked, but that is one of the few constant changes that occur. Also the fact this is a clean install too. Now maybe it is Altiris SVS too since I have about 15 apps setup with it.
Is there anyway to monitor ccsvchst and see what files it is trying to process? I know if I saw that I could probably rule out a few things and have a better idea of what is going on.
Thanks
Hi sonicdivx,
I sent you a forum email - did you receive it? There were some instructions there for the next steps.
Thanks,
Matt
Matt,
I had received the posts and even though most do not apply to me (I am running Internet Security 2008, Windows XP Pro SP3) I reviewed them.
Several important points.
1 I have easily identifiable errors messages that point to ccsvchst. No Windows or Norton error messages (including event viewer)
2 If I leave my machine on and leave my removable HD plugged in eventually cpu usage goes away (i.e. normal behaviour)
3 Regardless of mode (cold boot, warm boot, Hibernate) cpu usage could spike.
4 I have tried disabling via Internet Security options, AV, Firewall, Monitoring and this makes no difference even after 15 minutes.
5 this is a new install of Windows XP, but the underlying HD has not been formatted so there are probably some files with addtional unknown SIDs
6 this is a notebook computer ACER 8204 2GB RAM 160GB HD ATI 1600
Now without bluescreening the computer can I use something like Sysinternals Process Explorer to look at what ccsvshst is accessing. I really need a way to check that. If I see what it is trying to process, I may be able to fix
Thanks
Kevin
Matt,
Not sure why didn't check this but did the following and the high cpu usage stopped.
Services
Turned off "Symantec Settings Manager"
This obviously stopped "Symantec Event Manager" tooo
Once done the system instance of ccsvchst stopped using CPU. Of course now I can open Protection Center :)
So if that help in diagnosing.
Did you stop this via task manager? Does the problem return on restart? If so, try the following:
Options -> Norton Internet Security
Real-Time Protection
See if "Load Auto-Protect during system startup" is checked or not. If checked, uncheck it.
Also under Real-Time Protection: General Settings" see if "Turn on Advanced Mode" is checked as well. Uncheck if it is.
Reboot
Let us know what happens. Thanks.
I stop the services via the services panel. If I restart the problem it does return. Also if I reboot, after having stopped services, the problem will return.
I did notice that when I stopped those 2 services that my email client, Thunderbird, would not send/receive email and would generate an error. Where as my web browser would continue to function. Not sure if that means anything.
Currently "Load Auto-Protect during system startup" is checked.
"Turn on Advanced Mode" is unchecked.
I'll try turning off the system startup setting.
Hi sonicdivx,
I'd like to have you check something. The next time it happens, check to see if you just pulled down new defs. On XP, you can find those in C:\Program Files\Common Files\Symantec Shared\VirusDefs - look for the folder with the latest date (note the time as well). If there is some kind of virus def corruption problem, it's possible that using Intelligent Updater could correct it.
Thanks,
Matt
Matt,
I will keep an eye on that too. Hopefully problem will occur within next day so I can get a response back to you guys.
Kevin
Hi Kevin,
Any signs yet?
Matt
Matt,
Of course the problem since the last messages has not reared its head, not that I'm complaining, so when it does I'll be trying things.
Kevin