Hello community and especially Norton dev team.
I've found situation where user-mode NIS process(ccsvchst - running from current user (not SYSTEM)) are constantly using a lot of CPU resources. And only restart or ccsvchst kill can solve the problem. I don't know the root cause of this problem but further analysis revealed the following information:
EXCEPTION_RECORD: ffffffffffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 0000000000000000 ExceptionCode: 80000003 (Break instruction exception) ExceptionFlags: 00000000 NumberParameters: 0
FAULTING_THREAD: 0000000000000b60
PROCESS_NAME: ccsvchst.exe
FAULTING_MODULE: 00000000774b0000 kernel32
DEBUG_FLR_IMAGE_TIMESTAMP: 50b8488e
MODULE_NAME: wow64cpu
ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION} Breakpoint A breakpoint has been reached.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid
MOD_LIST: <ANALYSIS/>
BUGCHECK_STR: APPLICATION_FAULT_WRONG_SYMBOLS_FILL_PATTERN_ffffffff
PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS_FILL_PATTERN_ffffffff
DEFAULT_BUCKET_ID: WRONG_SYMBOLS_FILL_PATTERN_ffffffff
LAST_CONTROL_TRANSFER: from 000000007529283e to 0000000075292e09
STACK_TEXT: 00000000`000ae988 00000000`7529283e : 00000000`77bc01b4 00000000`75300023 00000000`00000246 00000000`0021fb64 : wow64cpu!TurboDispatchJumpAddressEnd+0x6c0 00000000`000ae990 00000000`7530d07e : 00000000`00000000 00000000`75291920 00000000`77ae5410 00000000`779fecd1 : wow64cpu!TurboDispatchJumpAddressEnd+0xf5 00000000`000aea50 00000000`7530c549 : 00000000`00000000 00000000`00000000 00000000`75304ac8 00000000`7ffe0030 : wow64!Wow64SystemServiceEx+0x1ce 00000000`000aeaa0 00000000`77a14956 : 00000000`00133940 00000000`00000000 00000000`77b02670 00000000`77ad5978 : wow64!Wow64LdrpInitialize+0x429 00000000`000aeff0 00000000`77a11a17 : 00000000`00000000 00000000`77a14061 00000000`000af5a0 00000000`00000000 : ntdll!RtlUniform+0x6e6 00000000`000af4e0 00000000`779fc32e : 00000000`000af5a0 00000000`00000000 00000000`7efdf000 00000000`00000000 : ntdll!RtlCreateTagHeap+0xa7 00000000`000af550 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrInitializeThunk+0xe
STACK_COMMAND: ~0s; .ecxr ; kb
FOLLOWUP_IP: wow64cpu!TurboDispatchJumpAddressEnd+6c0 00000000`75292e09 c3 ret
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: wow64cpu!TurboDispatchJumpAddressEnd+6c0
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: wow64cpu.dll
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: WRONG_SYMBOLS_FILL_PATTERN_ffffffff_80000003_wow64cpu.dll!TurboDispatchJumpAddressEnd
This problem shows up very infrequently but it's very annoying.