search cancel

a thread in symcscan.exe spin-locks and holds one core in case that SPE service is started upon OS boot time


Article ID: 162754


Updated On:


Protection Engine for Cloud Services Protection Engine for NAS


An issue is reported that a thread in symcscan.exe spin-locks in case that service is started upon OS boot time. That is, if system is equipped with 4 CPUs, then symcscan.exe consumes about 25% of system CPU time.

We hereby quote a sample stack of such thread:


00fbf9d8 76702cc7 0000037c 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
00fbfa4c 76702c02 0000037c ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x99
00fbfa60 7750fc3a 0000037c ffffffff 0b984786 KERNELBASE!WaitForSingleObject+0x12
00fbfb20 7750f974 00000000 000004d3 00000030 sechost!ScSendResponseReceiveControls+0xda
00fbfbd0 7751edc7 00fbfdc0 00fbfecc 00fbfc7c sechost!ScDispatcherLoop+0xd1
00fbfbe4 003b2bed 00fbfc0c 003b2c36 00fbfbfc sechost!StartServiceCtrlDispatcherA+0x53
00fbfc0c 003b0c00 00fbfecc 00fbfdc0 7c79e3f4 symcscan!CNTService::RunService+0x2d 
00fbfc50 003a1c1a 00fbfecc 00fbfdc0 00fbfc7c symcscan!CServiceMain::RunService+0x60 
00fbff18 0043e3f8 00000001 01d21808 01d21858 symcscan!main+0x73a 
00fbff60 76f17c04 ff1ee000 76f17be0 0b340549 symcscan!__tmainCRTStartup+0x10b 
00fbff74 778ead1f ff1ee000 0bad3e24 00000000 kernel32!BaseThreadInitThunk+0x24
00fbffbc 778eacea ffffffff 778d024b 00000000 ntdll!__RtlUserThreadStart+0x2f
00fbffcc 00000000 0043e44e ff1ee000 00000000 ntdll!_RtlUserThreadStart+0x1b

As seen in the above, symcscan.exe is calling Windows API StartServiceCtrlDispatcher() as per design of Windows Service. And StartServiceCtrlDispatcher() is not able to return, which causes hang-up state of symcscan.exe.

This issue has been reported in an environment where attached NIC is being disabled.


no error message is yielded.


This issue occurs only on the virtual environment.


This issue has been resolved in SPE 7.5.5 under etrack #3915419.