some prog is trying to take over my PC

[DeeKnow]

couple days ago I noticed my internet connection going nuts (packets out was running into millions) and my CPU utilization stuck near 95%, and the fan running non-stop... my kid on another pc could not use the web at all. after some investigation, it turns out a little file called cchost.exe was the culprit. I deleted it, and everything retuned to normal.

today i switch on and start to work, and the exact same thing starts up... cchost.exe again, using up all my CPU cycles and hogging the bandwidth... obviously it launches itself or it hides somewhere.

strangely, my antivirus does not catch anything, and ad-aware also does not find anything wrong. when i googled for cchost, all i can find is that it is somekind of open source media sharing tool... I have never heard of it, but i have two young kids into music, so i am sure they visit music sites...

anyone know about this, and about how to get rid of whatever program is launching this unwanted service??

 

[LeadMagnet]

AD-Aware


SpyBot

 

[JulesMaximus]

Funny, I'm having a similar problem on one of my home PCs. I might have to look into that. Anti-virus doesn't detect anything and adaware doesn't either. I try to open a web page and it starts to load but then just halts 90% of the time.

 

[Brainonska511]

Google came up with this: http://wiki.creativecommons.org/CcHost

But the link to the official installation (and possibly removal) instructions was down.

 

[Schadenfroh]

see my sig

 

[ryan256]

Do this... kill the process, track down the executable, rename it, reboot. Unless it tries to reinstall itself in which case its probably a virus..... Problem solved.

 

[Proletariat]

Its skynet.

 

[DeeKnow]

Originally posted by: ryan256
Do this... kill the process, track down the executable, rename it, reboot. Unless it tries to reinstall itself in which case its probably a virus..... Problem solved.

well... at best a virus that my anti-virus doesn't catch - thats not very good

 

[mordantmonkey]

Originally posted by: DeeKnow

Originally posted by: ryan256
Do this... kill the process, track down the executable, rename it, reboot. Unless it tries to reinstall itself in which case its probably a virus..... Problem solved.

well... at best a virus that my anti-virus doesn't catch - thats not very good

and what anti-virus would that be?
*hoping we aren't using the same one*

 

[essasin]

ad-ware should take care of your problem

 

[DeeKnow]

well, i did mention that ad-aware sees nothing wrong...

 

[ryan256]

Originally posted by: DeeKnow
well... at best a virus that my anti-virus doesn't catch - thats not very good

Well.. you are running the latest .dat files for your anti-virus software right?
Besides... the software might not catch it cause its not technically a virus. Gator and hotbar are some pretty evil pieces of software but alot of virus programs pass right over them. Try the renaming trick. When the computer can't locate the executable it won't run.

 

[pontifex]

Originally posted by: ryan256

Originally posted by: DeeKnow
well... at best a virus that my anti-virus doesn't catch - thats not very good

Well.. you are running the latest .dat files for your anti-virus software right?
Besides... the software might not catch it cause its not technically a virus. Gator and hotbar are some pretty evil pieces of software but alot of virus programs pass right over them. Try the renaming trick. When the computer can't locate the executable it won't run.

or it will just copy a new version into place, which happened when he deleted it.

 

[MisterJackson]

Originally posted by: Proletariat
Its skynet.

Shhh......you aren't supposed to tell!

 

[dabuddha]

Wrong forum!

 

[shortylickens]

Originally posted by: dabuddha
Wrong forum!

Ditto.
And looking at my work computer, I think cchost is part of your Norton Suite.
Its either the Norton Anti-Virus or Firewall.
Which (if any) do you have on your sysytem?

 

[dguy6789]

Originally posted by: Proletariat
Its skynet.

No, folding/seti is skynet.

 

[DeeKnow]

Originally posted by: shortylickens

Originally posted by: dabuddha
Wrong forum!

Ditto.
And looking at my work computer, I think cchost is part of your Norton Suite.
Its either the Norton Anti-Virus or Firewall.
Which (if any) do you have on your sysytem?

I have Symantec, and I doubt cchost.exe is a part of Norton.
The file i deleted had a system date about 30 min before I first noticed my system thrashing

I have rebooted twice in the last two days and the problem hasn't recurred, so hopefully I am rid of whatever it was...

will post again if it comes back... everything else is working fine, and I dont seem to have lost any data.

 

[DeeKnow]

okay the damn thing is back... after about 2 days, for no apparent reason

I just had to kill cchost.exe twice, and i deleted the file (in \winnt\system32), but it comes back...
how do I figure out which executable is creating and launching this process..??

 

[GeekDrew]

IIRC, system32\cchost.exe *is* from Symantec/Norton. I've seen Symantec cause thrashing many times.

 

[AMDZen]

Maybe you should try getting rid of everything Norton.

Yes I am 100% serious, that software is about the worst there is. Although, just getting rid of it entirely is a project in and of itself. Search google, I've seen little .reg files you can download that will do most of the cleaning with a single click, but Norton is a bit of a pain to remove entirely.

 

[DeeKnow]

Originally posted by: ryan256
Do this... kill the process, track down the executable, rename it, reboot. Unless it tries to reinstall itself in which case its probably a virus..... Problem solved.

and how do I do this (track down the executable)?

 

[GeekDrew]

Originally posted by: DeeKnow

Originally posted by: ryan256
Do this... kill the process, track down the executable, rename it, reboot. Unless it tries to reinstall itself in which case its probably a virus..... Problem solved.

and how do I do this (track down the executable)?

I'm thinking that by "track down the executable" he meant find its location on your hard drive. You already know that part.

 

[DeeKnow]

no... i mean the executable that creates the file that thrashes my pc..

cchost.exe is causing the thrashing and monopolizing the bandwidth. but obviously, since it keeps re-appearing, another executable is recreating it. I was asking how do i locate which process/file is doing that???

 

[Captante]

This appears to be the home-page of the developers of cchost.exe ... perhaps if you try to contact them they can be of some assistance... its worth a shot anyway.

http://www.ccmixter.org/