search cancel

System might encounter hang issue if Endpoint Protection and ESCORT are installed together


Article ID: 170577


Updated On:


Endpoint Protection


If you install both Symantec Endpoint Protection (SEP) and ESCORT into a system the system will hang randomly.
There are interoperability issues here with Reason Core Security (ESCORT) on the stack with SEP.

Details are as below.

  1. THREAD x is holding a loader lock on a .dll A in the context of ccsvchst.exe and generates an ALPC call to csrss.exe.
  2. The Server thread processing the ALPC message is thread Y.
  3. SEP is trying to scan "" and then emulates the execution of ESCORT binaries (like Escndl.dll, icdcnl.dll).
  4. ESCORT binaries (like Escndl.dll, icdcnl.dll) then tries to load the same .dll A (above) on the critical section.


SEP 12.x and 14.x


Deadlock or Hang results


Installing both SEP and ESCORT (Reason core Security anti-malware security software) on the same system is not recommended.
The following method can be used as a workaround.

  1. Add an exclusion to SEP for Manifest file.
    • Manifest file path-  \Windows\winsxs\Manifests\
  2. Add exclusion to ESCORT for ccSvcHst.exe