COH_Mon events every hour

Jack Wilson's picture

We get a lot of the Service Control Manager's EventID 7035: "The COH_Mon service was successfully sent a start control" events in the System event log. About once every hour.
Is this normal?  If so, is there any way to reduce this "noise"?

Thanks,
-jack

Aniket Amdekar's picture

Hi Jack, What is the OS on

Hi Jack,

What is the OS on your machine? What all components have you installed for the SEP client? What is the version of SEP client installed? Did you have an earlier version of SAV on this machine?

Aniket

Rafeeq's picture

Hi

Did you had nortan installed before ?

COH_Mon is the TRUSCAN driver, otherwise called SONAR in the consumer product and previously Confidence Online Heavy from the WholeSecurity product line

if you had please remove that and do a fresh install. Refer this for more info

https://www-secure.symantec.com/connect/forums/scan-causing-desktop-login-problems

Rafeeq

Jack Wilson's picture

These are all (30+) WinXP

These are all (30+) WinXP machines, with all features of SEP 11 RU5 installed. Overtime, they have been upgraded from SAV -> SCS -> SEP.  Norton was never installed. Some of these machines have had Cleanwipe used before reinstalling SEP.

Rafeeq's picture

Hi

on one machine can you remote SEP MU5
Remote all the symantec folders
delete
c:\program files
symantec \symantec shared folders\reboot the box
and isntall SEP MU5
let me know if you see any symptoms as mentioned in this doc

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008013109171848

Rafeeq

Jack Wilson's picture

Hi

Previously on some of these machines, I've uninstalled SEP, ran CleanWipe and deleted various folders and reinstalled SEP. This was done for other reasons. But, these machines and the others currently have the issue with COH_Mon.

Is this different from what you suggest?

-jack