RTVScan.exe crashes on a Windows 2008 R2 64-bit Citrix XenApp 6 server

book

Article ID: 153748

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Various Symantec Endpoint Protection processes and services crash or will not start on a Citrix XenApp 6 server.

Faulting application name: Rtvscan.exe, version: 11.0.6070.422, time stamp: 0x4bd1409a
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
Exception code: 0xc0000005
Fault offset: 0x0002e777
Faulting process id: 0x21b4
Faulting application start time: 0xRtvscan.exe0
Faulting application path: Rtvscan.exe1
Faulting module path: Rtvscan.exe2
Report Id: Rtvscan.exe3


Faulting application name: SescLU.exe, version: 11.0.6005.440, time stamp: 0x4bc9264c
Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdb3b
Exception code: 0xc0000005
Fault offset: 0x0002ea00
Faulting process id: 0x1724
Faulting application start time: 0xSescLU.exe0
Faulting application path: SescLU.exe1
Faulting module path: SescLU.exe2
Report Id: SescLU.exe3

Cause

The Citrix Presentation Server API hooks attach to running processes and load a number of dll modules into the address space of the running application. This can cause problems for some applications which requires disabling the API hooks from attaching to those processes.

Resolution

Exclude Citrix from attaching to the Symantec Endpoint Protection processes by following the instructions in the following Citrix document. Please ensure you backup the registry before making any changes:

http://support.citrix.com/article/CTX107825

It is recommended, on 64-bit machines, to add the exclusions to the 32-bit and 64-bit registry hives outlined in the document. Exclude the following files, others may be needed as well if you're seeing crashing of other applications or modules:

rtvscan.exe, smc.exe, sesclu.exe, smcgui.exe, ccsvchst.exe
 

Citrix may also change the group that the SMC service runs as and the following registry key may need to be changed as well if the SMC service does not start automatically when the machine boots.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\SERVICES\Smcservice\Group (REG_SZ) =

PNP_TDI

After making this change restart the machine for the changes to take affect.


See related article regarding Symantec Endpoint Protection 12.1.x:

ccSvcHst.exe crashes on Windows 7 32-bit with Citrix XenDesktop components installed
http://www.symantec.com/docs/TECH204913

 


Applies To

Windows 2008 R2 64-bit

Citrix XenApp 6