ccSvcHst.exe crashes on Windows 7 with Citrix XenDesktop components installed

book

Article ID: 157880

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection processes and modules crash or will not start on Windows 7 SP1 32-bit when Citrix XenDesktop components are installed, such as (Desktop Delivery Controller, Virtual Desktop Agent, etc.)

 

The following Event ID 1000 errors seen in application log:

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a
Faulting module name: ccEraser.dll, version: 112.2.0.13, time stamp: 0x50186bf0
Exception code: 0xc0000005
Fault offset: 0x00211f1b
Faulting process id: 0x9b4
Faulting application start time: 0x01ce197ec1e4e64f
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\VirusDefs\20130305.034\ccEraser.dll
 
Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a
Faulting module name: BHEngine.dll_unloaded, version: 0.0.0.0, time stamp: 0x50f06189
Exception code: 0xc0000005
Fault offset: 0x6d420ae0
Faulting process id: 0x1230
Faulting application start time: 0x01ce1a51de97fb79
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
Faulting module path: BHEngine.dll
 
Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a
Faulting module name: fsllib32.dll_unloaded, version: 0.0.0.0, time stamp: 0x50092399
Exception code: 0xc0000005
Fault offset: 0x6d415502
Faulting process id: 0x844
Faulting application start time: 0x01ce1a51dfb803bd
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
Faulting module path: fsllib32.dll
 
Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x6d415502
Faulting process id: 0x840
Faulting application start time: 0x01ce1a552ce3c6c9
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
Faulting module path: unknown
 
Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a
Faulting module name: IDSxpx86.dll, version: 11.1.1.5, time stamp: 0x503d833b
Exception code: 0xc0000005
Fault offset: 0x00034a1d
Faulting process id: 0x2a4
Faulting application start time: 0x01ce1a5552338597
Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\IPSDefs\20130301.012\IDSxpx86.dll

 

Cause

The Citrix Presentation Server API hooks attach to running processes and load a number of dll modules into the address space of the running application. This can cause problems for some applications which requires disabling the API hooks from attaching to those processes.

 

Resolution

Exclude Citrix from attaching to the Symantec Endpoint Protection processes by following the instructions in the following Citrix document. Please ensure you backup the registry before making any changes:

http://support.citrix.com/article/CTX107825

It is recommended, on 64-bit machines, to add the exclusions to the 32-bit and 64-bit registry hives outlined in the document. Exclude the following files, others may be needed as well if you're seeing crashing of other applications or modules:

ccsvchst.exe, smc.exe, sesclu.exe, smcgui.exe


See related article regarding Symantec Endpoint Protection 11.x:

RTVScan.exe crashes on a Windows 2008 R2 64-bit Citrix XenApp 6 server
http://www.symantec.com/docs/TECH150373