ccApp is preventing computer shutdown ... and similar issues

[Migration User]

I have a SEP 11.6a installation where all PC's (5) are failing with the same problem, and it have started around 1-2 weeks efter upgrade from RU5 to RU6a.

Most times the computer fails to shutdown, and windows says the "ccApp.exe is preventing the computer to shutdown"
You the have to answer OK, several times, to get the computer to shut down properly.

We haven't faced theese problems before, and contacting support didn't help much - the steps taken.
- Reinstall SEP client
- Install User Profile Hive Cleanup Service
- Disable Network Treat Protection, and others
- Disable scan for removeable media's

But still the same problem, next step is to try and deplot RU5 client instead of RU6a - but that's not really the best way to go in my opinion.

Have any of you guys seen anything like this, and hopefully have some clues on how to proceed.

Best regards
Gorm

[Migration User]

[Migration User]

ccApp is used for email protection.In one PC remove it and observe

[Migration User]

Take the backup of the regisrty and then

Navigate to HKEY_CURRENT_USER\Control Panel\Desktop\ AutoEndTasks  and set the value to 1

[Migration User]

How to add or remove features to existing Symantec Endpoint Protection client installations 

[Migration User]

I have "only" enabled "Antivirus and Antispyware Protection" and "TruScan Proactive Threat Scan"
Antivirus Email Protection is disabled in Client Install Feature Set.

Are you sure that ccapp.exe is for email only ?

Best regards
Gorm

[Migration User]

Changin the regisrty is a work around, it is not the solution


Title: 'Unable to shutdown computer with error message "ccapp.exe is not responding" click here to end the process'
Document ID: 2010061410233448
> Web URL: http://service1.symantec.com/support/ent-security.nsf/docid/2010061410233448?Open&seg=ent

[Migration User]

The ccapp.exe file stands for Common Client Application and is the executable responsible for checking emails and auto-protect facilities as part of the Symantec.

The ccapp.exe file is used as the SEP’ real-time scanner. When Windows loads, the ccapp.exe file also loads as VxD or virtual device driver. As the ccapp.exe file executes behind the scenes, it scans your system for Trojan Horses, viruses, and worms.

Before Windows can completely shut down, the ccapp.exe file will scan the boot drives for sector viruses if a floppy disk can be found inside the drive. In case a virus is detected, a message will be displayed asking you to repair the infected floppy disk boot record.

[Rafeeq]

start - run
msconfig
click on startup, uncheck ccapp.exe\
reboot and try now

[Migration User]

Nice one :)

I'll give it a go along with HungAppTimeout so we don't have to wait so long.

This is a workaround, but there must be a "fix" or is this caused by an internal "bug" in SEP RU6a ?

Best regards
Gorm

[Migration User]

yes I am sure.
Go to start-->run type msconfig click ok
Go to startup and uncheck ccapp.exe.......

[Migration User]

Now this is interesting !

/Gorm

[postechgeek]

I agree. This is a good course of action, at least helps with the support calls. You can push this out via group policy and then work on the issue in a test enviroment with having tons of people call the support the support desk.

[Migration User]

I have a case open with Symantec already to address this specific issue (among others).  An original recommendation from them was to remove 'ccApp' from the 'Run' key in the registry, but that has the same effect as not running ccApp.exe at all, and is not a 'fix' for this issue, just a workaround with less effectiveness with their product.

I'm guessing that we'll be doing all the legwork of capturing and forwarding runtime logs so that they may have a fix in the next release.

I'll be sure to post up anything new that makes a difference.

[postechgeek]

TFS-Keith,

See the top of this thread. You don't have to remove ccApp from starting up. If you turn "on" or set AutoEndTasks to 1, that forces the applications to close on shutdown. I know this isn't the best solution, but I'm sure you know how users are. They will flood the help desk saying they can't shut down. This is an easy to push out workaround that will help in that regard.

Thanks,
Mike

[Migration User]

We are having the same issue here on only about 5 out of 100 PCs are having the issue. I can not remove ccapp, we need email scanning. The "autoendtasks" does not exist in the registry on the computers here (Win XP SP3). Can I just add a string or Dword?  This will be effective on logoff too correct? not just shutdown?

[postechgeek]

@ Rossk,

Yes, you can create the string. If you add the string "AutoEndTasks"  to the following key:
HKEY_USERS>.DEFAULT>Control Panel>Desktop

This should fix the issue for all the users, not just the current user. I tried creating a ADM file so that it could be imported via GP, but I couldn't get it to work correctly. This will fix the issue with the ccapp.exe at shutdown or any hanging up for that matter.

The value should be set to 1.

We are having the issue here as well. Hope that helps.

Mike

[Migration User]

Ok, I will see if I can make an adm template and Ill post it up

[postechgeek]

I found this as well:
http://service1.symantec.com/support/ent-security.nsf/docid/2010061410233448?Open&seg=ent

This is what I have for the ADM file:
CLASS MACHINE

CATEGORY "AutoEndTasks"

POLICY "Auto End Tasks"    
    KEYNAME "Control Panel\Desktop"
            EXPLAIN "Auto End Tasks"
            VALUENAME "AutoEndTasks"
            VALUEON "1"
                    VALUEOFF "0"
    END POLICY
    
    END CATEGORY

However, you have to change the filtering to be able to see it in gpedit.msc. You can change the value from gpedit, but it never seems to change in the registry.

Mike

[Migration User]

Hmm... I have this:

-----------------------------------------------------------------------------------------------------------
CLASS USER
 

CATEGORY CCAPP

        POLICY "Disable CCAPP End Now"

 KEYNAME "Control Panel\Desktop"
            EXPLAIN !!DisableCCAPPEndNow_Help
                VALUENAME "AutoEndTasks"
                    VALUEON NUMERIC 1
                    VALUEOFF NUMERIC 0
        END POLICY

END CATEGORY

[strings]
CCAPP="Ross' CCAPP Template"
DisableCCAPPEndNow="Disable's the end now pop up at log off for CCAPP (non-policy)"
DisableCCAPPEndNow_Help=""When set to Enabled, the CCAPP "end now" will not pop up when user logs off, instead it will auto kill the box. When set to disable, the box will still come up. This is not a fix, but a work around"
-----------------------------------------------------------------------------------------------------------

Still haven't gotten it to work yet.

Even if it was working, I just tried the reg change to a couple PCs, "simply changing the key to 1" and I logged off and the same "end now" window pops up.

[postechgeek]

Changing the registery key seemed to work for me. Might want to try this key, instead of the .DEFAULT key.

HKEY_CURRENT_USER\Control Panel\Desktop\AutoEndTasks

Try restarting the machine.

I might try a create a script and see if we can merge a .reg file remotely, maybe using PSexec or something. The only problem I think we will need to get around is if we export the key, we will get all the values. Anyone know how to export a single string to a .REG file?

Mike

[Migration User]

Well that reg change works, but only for the user you change it under. I logged on to someone's computer with my account, changed the reg (HKEY_CURRENT_USER\Control Panel\Desktop\AutoEndTasks to 1)
Logged off, and the ccapp didnt pop up and hang, but I had the user logg on under her account and I checked the reg and the setting under her login account was still set to 0. So I changed that and now she is good, but I just dont know how pushing it out via a GPO will work if it only changes the setiing for the account making the changes right? which would be my domain admin account.

[Migration User]

Any luck with pushing out the reg change? I still need a way to accomplish this.

[Migration User]

Can anyone get a screenshot of this message? I decided Im just going to put a picture of the error in an email with the .reg file attached and send it company wide and say, if you have this message, double click the fix CCAP.reg  

I cant capture a pic of the message though.