Crash with BugCheck 0xEF (CRITICAL_PROCESS_DIED) when Endpoint Protection is installed on Windows 10

Products

• Endpoint Protection

Issue/Introduction

You have a Windows 10 system with Symantec Endpoint Protection (SEP) 14.0 or higher that experiences a crash with BugCheck 0xEF (CRITICAL_PROCESS_DIED). A look at the resulting crash dump shows the presence of Sysfer (our Application Control user mode library).

# Call Site

00 nt!KeBugCheckEx

01 nt!PspCatchCriticalBreak

02 nt!PspTerminateAllThreads

03 nt!PspTerminateProcess

04 nt!NtTerminateProcess

05 nt!KiSystemServiceCopyEnd

06 SYSFER!Hook

07 ntdll!TppWorkerpInnerExceptionFilter

08 ntdll!TppWorkerThread$filt$0

09 ntdll!_C_specific_handler

0a ntdll!_GSHandlerCheck_SEH

0b ntdll!RtlpExecuteHandlerForException

0c ntdll!RtlDispatchException

0d ntdll!KiUserExceptionDispatch

0e appsruprov!ArupMergeStatsList

0f appsruprov!ArupMergeStats

10 srumsvc!SruTier1StoreMarkAndMergeRolloverEntries

11 srumsvc!SruTier1StoreRolloverEntries

12 srumsvc!ATL::CComModule::UpdateRegistryFromResourceD

13 srumsvc!SruWorkItemQueryProvider

14 srumsvc!SruWorkQueueThreadPoolCallback

15 ntdll!TppWorkpExecuteCallback

16 ntdll!TppWorkerThread

17 KERNEL32!BaseThreadInitThunk

18 ntdll!RtlUserThreadStart

 

The above stack text (which should be read from bottom to top) is of a dump that showed svchost.exe crashing as a result of an exception code 0x2 ("The system cannot find the file specified.") having been thrown by faulting module appsruprov.dll (Microsoft's Application System Resource Usage Monitor –SRUM– provider), which called its ArupMergeStatsList function. Sysfer hooks into the stack after the exception is thrown but before the process crashes. 

Environment

• Windows 10
• SEP 14.0 or higher

Resolution

This typically is not the SEP's client fault, the crash in svchost.exe occurs before the hook by sysfer.dll (Application Control), the root cause of the crash should be analyzed and will vary.
Automated crash analysis may point to sysfer.dll as the cause but this is misleading.

If the crash occurs repeatedly and you want to exclude the possibility of SEP being responsible, you may create an Application Control exception for svchost.exe, ensuring to also exclude all child processes. The crash will still happen but sysfer.dll will no longer be present in the stack