I just got my first instance of the Symantec 8506,422 error. Autofix was able to repair the situation successfully, according to the History Log for the event.
However, as is my standard procedure when something like this happens, I saved out and rebooted. CcSvcHst was still locked up after NIS notified that the repair was successful - giving the standard error message at shutdown indicating that Windows was not able to close the program.
A restart produced normal operation without requiring any other remedial action.
Circumstances:
A major Live Update occurred as the last item logged before the autofix log entry. All items in that Live Update were successful - there were no errors noted in the log regarding the LU. The machine had just freshly reinitialized itself with the new data - the immediately-preceding log item of "No user is logged in" preceded the autofix log item by 8 minutes and 3 seconds.
User Activity taking place at the time of the error:
I was editing an EAX Preset for my Audigy 2 ZS Soundcard. I had deleted an invalid preset from the Hard Disk - while I had that item still in memory such that I could make the desired edits and then resave the modified preset in a different folder.
As a result of the crash, my EAX functions were damaged - I could hear the weirdness (echo) from an EAX effect in the timbre of the shutdown sound.
When I rebooted, my EAX operations were disabled and the preset that I was editing was gone. Fortunately, this did not result in corruption of my EAX Effects Database - and I was able to re-enable the EAX effects and restart my editing session from scratch. I have had situations where something has corrupted the database - necessitating a complete reinstall of the Sound Card drivers to reinitialize the database back to its standard configuration (which wipes out all my custom EAX presets and necessitates re-importing all of them - which is not a difficult process but is a minor annoyance).
There was nothing else going on with that machine when the autofix event occurred.
System Characteristics:
OS is Windows XP-SP3 - completely patched and up to date. NIS is Version 2012 - Version 19.2.6.10 - which has been up and running stably on this machine for weeks to months.
The Hardware is a P4B-2.4GHz, 2GB DDR 400, on an Intel D845PESV Motherboard with the latest P09 BIOS for that board. Disk Storage is 2 Seagate 7200.9 Sata Hard Disks (one 250GB, one 160GB) connected to a SIL-3512 PCI Sata Card running the latest non-RAID firmware and drivers. This disk subsystem has run stably for months.
Sound Card is an Audigy 2 ZS Platinum with the SB0250A LiveDrive - running the latest Sound Card Driver release from Creative Labs for this card. This sound driver has run stably for months.
Speculation:
The only thing of note that I can relate to this situation - is the use of the Sound Blaster EAX Preset Editor during a reinitialization of the NIS Firewall/Intrusion-Protection Engines.
In checking others in the forums reporting similar problems - I note they mentioned their problems occurred regularly every morning - which would be consistent with them editing something on their machine while a Live Update was going on - and the consequent Engine reinitialization "on the fly" impacting their temporary files and/or memory-space - which did not reflect what was on-disk at that moment. IMO, this observation requires further investigation.
Recommendation:
NIS should definitely not go "bump in the night" when reinitializing itself after a Live Update while a user has work in progress. Hopefully, the above gives some clues as to where to begin as far as investigations into this instability.
Hope this helps.