Endpoint Protection

 View Only
  • 1.  COH64.exe Old issue? New to Me..-causing problems HELP!

    Posted Jan 15, 2011 10:28 PM

    I have done some reseach online and on here and it seems that this program is a Symantec one.  I have found little information on it, and forgive me if I'm not looking in the right place, but I can't seem to find much information on this. 

    It's happened in the last couple of days.  I have verififed that this program, COH64.exe is indeed in a symantec folder on my computer (can't remember the exact location, but it's where it's supposed to be), and it is somewhat new to my computer because today this program (and this has been the issue for the last two-three days now), has been using up the CPU/system resources like crazy.  I can barely do much on my computer, even web pages and clicking on links go in slow motion becuase this program is running one and even two sites (at the same time), when I look at my resource meter (win7 64 bit home prem.) and running SEP11 latest version. 

    Any thoughts on this?  I have tried to "end the process" and if it lets me (it doesn't always), my system gets better for a few minutes.  Most of the time, it starts/or appears back again and many times the computer won't let me "end process" on it.  Everywhere I read online says that this is a normal symantec process and I shouldn't mind it, but I cannot have my system resources and hard drive running constantly without end.  The only thing I can do so I can write this q/a here right now without LAG is becuase I have stopped SEP in the componen services for the moment.  Any suggestions please?!?!?!

     



  • 2.  RE: COH64.exe Old issue? New to Me..-causing problems HELP!

    Posted Jan 15, 2011 11:48 PM

    Disable the Proactive Threat Protection Compoment of SEP temporarily and see what the outcome is

    Are you on the latest version, RU6 MP2?



  • 3.  RE: COH64.exe Old issue? New to Me..-causing problems HELP!

    Posted Jan 16, 2011 07:12 AM

    Yes, I've even ran the SEP Tool (I do have SEP RU6 MP2 at least I believe, if memory serves, I clicked help and about, it says SEP 11.0.6200.754), and aside from that report, when I look into the log files on PTP, I get those TruScan load errors and the failure error, and whiteliest error. 

     

    Do I leave this coh64.exe running/going?  I could delete the exe file and/or even the whole folder it's in, but it's a legitimate part of symantec since I've checked because it's in a symantec folder (and not some random place on the hard drive which would make me think it's not a valide file).  So knowing it seems legit, is this a normal file/exe program to have right now? 



  • 4.  RE: COH64.exe Old issue? New to Me..-causing problems HELP!

    Posted Jan 16, 2011 10:13 AM

    COH64.exe is the SONAR component and it's a part of the Proactive Threat Protection component.

    If it's causing you this much trouble, you can remove the component altogether.

    PTP is only partially supported on 64-bit systems at this time:

    Symantec Endpoint Protection 11.0 compatibility with 64-bit platform

    Problem


    This document contains information on the expected behavior of Symantec Endpoint Protection 11.0 when applied to 64-bit processors and operating systems.

    Symptoms
    Symantec Endpoint Protection 11.0 compatibility with 64-bit platform.

     

    Solution


    Currently the following SEP features do not run on 64 bit Windows systems:

    -    Device Control
    -    Tamper Protection (AKA SymProtect)
    -    Right Click “Scan for Viruses…”
    -    Lotus Notes (Domino), Microsoft Exchange and POP3/SMTP email scanning
    -    System Lockdown
    -    Central Quarantine
    -    Proactive Threat Protection will not detect poller type keyloggers (although this shouldn’t be cause for concern as Auto-Protect is far more accurate at detecting keyloggers)

    /apps/media/inquira/resources /resources

       

     

    I would also suggest opening a case with support



  • 5.  RE: COH64.exe Old issue? New to Me..-causing problems HELP!

    Posted Jan 20, 2011 10:13 AM

    So TruScan is using a lot of CPU on one PC?  What else is the PC running? Is the PC virtual? How do you have TruScan configured (on the SEPM).

    AV Policy  >  TruScan  >  third tab in particular.