Ccsvchst.exe cpu usage Issue

Norton Security | Norton Internet Security
21

Matt,

 

If finally happened again.  As far as I can tell things were fine until the following. 

 

I was in firefox went to a site and attempted to watch a live video stream. The site said I needed Flash 9 (was already installed , but hey whatever). So attempt to download. At first fails due to a bad FF3 exit. Second time success. That is when I noticed it.  Also I had been download a file over the internet, but discount that as 2 hours earlier download a video from same place no problem.

 

So too me the Flash 9 update seems to have caused the issue.

 

Oh tried intellegent updater no go. Also had uncheck those other setting and no change

 

22

Hi sonicdivc,

 

Okay, so if we can reproduce this at will using the same steps, let's get the debug logging in place and get some logs. Remember to set all three advanced options for the Norton Reporting Assistant (debug on, noupload and performance monitoring).

 

This also reminds me of a problem we had initially with the 2007 release where CPU spiked as the result of a bad interaction with an .flv player. What kind of flash player(s) do you have installed?

 

Thanks,

 

Matt

23

Matt,

 

Yeah I think I remember that issue too. I  currently have version   WIN 9,0,124,0  of the all plugin/activeX installed.  No I have one little issue

 

I had to uninstall NIS. Mainly because it was causing my laptop to hit about 74-79 C  and slowing my work down.  So, I will unistall tonight or tomorrow the other security suite and reinstall NIS.   In the past uninstall /reinstall of NIS did not change the behavior and I expect as much. Once I reinstall as soon as I see something I make sure debug/logging is on and capture.

24

Hi again,

 

It would also be good to know if the same site, same video has a problem through IE. Firefox does have some known issues around flash CPU spikes, but I'm not sure that was your only use case.

 

Matt

25

Matt,

 

Yeah I have seen the FF Flash cpu spike before, but I know that issue and the ccsvchst issue are not related as the ccsvchst issue has occurred even when no browsers are open (say a reboot).

26

Hi sonicdivx,

 

Yeah, I thought of that after posting my response. I'm hoping that the debug logs will shed light on this one, particularly the performance monitoring.

 

Thanks again,

 

Matt

27

umm Matt where do I turn on those settings?  I don't seem to have a Reporting Assistant, am I missing something?

 

Thanks

1 Like
28

Sorry about that - I thought I had sent those along previously. Here's a doc with the instructions:

 

Title: 'Sending log file information to Symantec Technical Support'
Document ID: 2006071711255039
> Web URL: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2006071711255039?Open&src=w
 

The options are in the setup dialog under "Advanced".

 

Thanks again,

 

Matt

 

 

29

Matt capturing right now.  Also the problem came back as soon as i reinstalled NIS (Removal Tool NOT used).  So even though I uninstalled then installed a different package then unistalled that package then reinstalled NIS problem still exists.

 

 

30

Matt ,

 

Have the file its 23 MB  where you want me to FTP it too?

31

Hi -  I sent you a forum email with the details.

 

Thanks,

 

Matt

32

Matt, unfortunately didnt catch it , but the high cpu stopped again a couple of hours ago (had been going since yesterday even after some reboots).

 

Also the info you sent didnt work. Ill try later

33

Matt,

Something to add. I turned on LiveUpdate notificaton to do and when it runs it gets a failure updating

Intrusion Prevention Signatures/Defintions LU8125 error

I tried the PIUpdate tool no go. Is there a way to manually clear that file (without doing a removal). Maybe that is partly the issue

 

 

From log:

 
Query liveupdatedir location.
6/20/2008, 16:47:50 GMT -> Storing liveupdatedir into standard variable map with value: C:\Program Files\Symantec\LiveUpdate.
6/20/2008, 16:47:50 GMT -> Progress Update: PATCH_START: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis"
6/20/2008, 16:47:50 GMT -> Progress Update: SECURITY_PACKAGE_TRUSTED: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip"
6/20/2008, 16:47:50 GMT -> Signer: cn=Symantec Corporation,ou=Usage - SigningProd02Token,ou=Locality - Arizona,ou=Product Group - LiveUpdate,ou=SymSignature,o=Symantec Corporation
6/20/2008, 16:47:50 GMT -> Progress Update: UNZIP_FILE_START: Zip File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Dest Folder: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263"
6/20/2008, 16:47:50 GMT -> 1213749515jtun_nis8enidcurd25.x86.full.zip is in RAR format.
6/20/2008, 16:47:51 GMT -> Progress Update: UNZIP_FILE_FINISH: Zip File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Dest Folder: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263", HR: 0x0      
6/20/2008, 16:47:51 GMT -> LiveUpdate couldn't expand replacement path [IPSDefsInstallDir].
6/20/2008, 16:47:51 GMT -> Progress Update: PATCH_ERROR: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis", HR: 0x802A0006
6/20/2008, 16:47:51 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR
6/20/2008, 16:47:51 GMT -> EVENT - PRODUCT UPDATE FAILED EVENT - Update available for Symantec Intrusion Prevention Signatures - MicroDefsB.CurDefs - SymAllLanguages. Update for CurDefs takes product from update 80613001 to 80617001. Server name - liveupdate.symantecliveupdate.com, Update file - 1213749515jtun_nis8enidcurd25.x86, Signer - cn=Symantec Corporation,ou=Usage - SigningProd02Token,ou=Locality - Arizona,ou=Product Group - LiveUpdate,ou=SymSignature,o=Symantec Corporation, package install code 0. The Update executed with a result code of 1825, => The install script for this product had a syntax error, so LiveUpdate could not install it.
6/20/2008, 16:47:51 GMT -> CSendHttpRequest::SendRequest() successfully impersonated the COM client (revert on destroy).
6/20/2008, 16:47:51 GMT -> CSendHttpRequest::SendRequest() successfully impersonated the COM client (revert on destroy).
6/20/2008, 16:47:51 GMT -> Progress Update: PATCH_FINISH: Patch File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\1213749515jtun_nis8enidcurd25.x86.full.zip", Script File: "C:\Documents and Settings\All Users.WINXP08\Application Data\Symantec\LiveUpdate\Downloads\Updt263\nisids.dis", HR: 0x802A0006
6/20/2008, 16:47:51 GMT -> HR 0x802A0006 DECODE: E_DIS_SCRIPT_SYNTAX_ERROR


[edit: reformated log for readability.]
Message Edited by Allen_K on 06-20-2008 05:11 PM
34

To confirm that this is not a virus issue try disabling Norton nad check CPU usage.If this does not work try uninstalling and reinstalling Norton.