Symantec Endpoint Protection (SEP) scans never finishs, definitions stop updating, and ccSvhHst.exe process is using high CPU and becomes stuck in a "Stopping" state if an attempt is made to restart SEP services. Only a system restart resolves the stuck service state. After the restart, the definitions are updated.
SEP versions 12.1.x and 14
Virus and Spyware Protection definitions do not update on some clients because the Symantec Endpoint Protection service deadlocks when it tries to reload the definitions during a scan.
This issue was fixed in SEP 12.1 RU6 MP7 and SEP 14.0 MP2.
When symptoms occur, reboot the machine or terminate the ccSvcHst.exe process that's running as SYSTEM and restart the Symantec Endpoint Protection service. Tamper Protection must be off in order to terminate the process. Example command lines to automate the process and service restart: