ccSvcHst.exe crashes on Windows 7 with Citrix XenDesktop components installed

Products

• Endpoint Protection

Issue/Introduction

Symantec Endpoint Protection processes and modules crash or will not start on Windows 7 SP1 32-bit when Citrix XenDesktop components are installed, such as (Desktop Delivery Controller, Virtual Desktop Agent, etc.)

 

The following Event ID 1000 errors seen in application log:

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a

Faulting module name: ccEraser.dll, version: 112.2.0.13, time stamp: 0x50186bf0

Exception code: 0xc0000005

Fault offset: 0x00211f1b

Faulting process id: 0x9b4

Faulting application start time: 0x01ce197ec1e4e64f

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe

Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\VirusDefs\20130305.034\ccEraser.dll

 

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a

Faulting module name: BHEngine.dll_unloaded, version: 0.0.0.0, time stamp: 0x50f06189

Exception code: 0xc0000005

Fault offset: 0x6d420ae0

Faulting process id: 0x1230

Faulting application start time: 0x01ce1a51de97fb79

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe

Faulting module path: BHEngine.dll

 

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a

Faulting module name: fsllib32.dll_unloaded, version: 0.0.0.0, time stamp: 0x50092399

Exception code: 0xc0000005

Fault offset: 0x6d415502

Faulting process id: 0x844

Faulting application start time: 0x01ce1a51dfb803bd

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe

Faulting module path: fsllib32.dll

 

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

Exception code: 0xc0000005

Fault offset: 0x6d415502

Faulting process id: 0x840

Faulting application start time: 0x01ce1a552ce3c6c9

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe

Faulting module path: unknown

 

Faulting application name: ccSvcHst.exe, version: 12.1.1.5, time stamp: 0x5073320a

Faulting module name: IDSxpx86.dll, version: 11.1.1.5, time stamp: 0x503d833b

Exception code: 0xc0000005

Fault offset: 0x00034a1d

Faulting process id: 0x2a4

Faulting application start time: 0x01ce1a5552338597

Faulting application path: C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe

Faulting module path: C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\IPSDefs\20130301.012\IDSxpx86.dll

 

Cause

The Citrix Presentation Server API hooks attach to running processes and load a number of dll modules into the address space of the running application. This can cause problems for some applications which requires disabling the API hooks from attaching to those processes.

 

Resolution

Exclude Citrix from attaching to the Symantec Endpoint Protection processes by following the instructions in the following Citrix document. Please ensure you backup the registry before making any changes:

http://support.citrix.com/article/CTX107825

It is recommended, on 64-bit machines, to add the exclusions to the 32-bit and 64-bit registry hives outlined in the document. Exclude the following files, others may be needed as well if you're seeing crashing of other applications or modules:

ccsvchst.exe, smc.exe, sesclu.exe, smcgui.exe


See related article regarding Symantec Endpoint Protection 11.x:

RTVScan.exe crashes on a Windows 2008 R2 64-bit Citrix XenApp 6 server
http://www.symantec.com/docs/TECH150373