Systems with older versions of Sysmon are slow/unresponsive at startup

Technical Articles ID: KB88078
Last Modified: 4/19/2021

Environment

McAfee Endpoint Security Threat Prevention (ENS) 10.x
McAfee Host Intrusion Prevention (Host IPS) 8.0
McAfee VirusScan Enterprise (VSE) 8.8

Microsoft Sysinternals Sysmon version 10.42 and earlier

Problem

Some issues are seen on systems that have older versions of Sysmon and one or more McAfee products installed.

Any of the following can be observed:

The system appears to become unresponsive during a system startup.
The system is slow to start (over 40 minutes).
The McShield service is in a stopped state. Attempts to start it cause the system to become unresponsive.

The issue can be amplified on systems with a Tanium Client installed.

Cause

A deadlock occurs when you use older versions of Sysmon on a system that also has a McAfee product installed. In some older versions of Sysmon, the use of loader lock had a conflict with the McAfee filter driver which resulted in a deadlock. The above symptoms occur when a specific Sysmon configuration option (ImageLoad) is enabled, and results in the use of the loader lock API. A deadlock then occurs when the McAfee filter driver intercepts the call.

Solution

Uninstall the older version of Sysmon and download and install the latest version. Download Sysmon from: https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon.

Workaround

For this particular issue on affected systems, consider an exclusion of the mcshield.exe executable from within Sysmon. If that does not resolve the issue, consider an exclusion for all processes inside C:\Program Files\Common Files\McAfee\SystemCore from Sysmon.

Related Information

Key search string assistance: dead-lock, dead lock

Affected Products

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Host Intrusion Prevention 8.0 (EOL)
Known Issue/Product Defect
VirusScan Enterprise 8.8 (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Systems with older versions of Sysmon are slow/unresponsive at startup

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Systems with older versions of Sysmon are slow/unresponsive at startup

Environment

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Choose your region

Title

Title