Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 4 subscribers
  • Views 1554 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Deadlock detected - scanning displayswitch.exe

Paul James

Hi all,

Noticed that over the past month or so we keep getting errors/alerts from various devices saying "Deadlock detected while asynchronously scanning file "C:\windows\system32\displayswitch.exe"

For some reason it's always this displayswitch.exe file that causes this issue and not seen any other files causing this alert.

We are running SEC V5.5.1 with V10.8.9 for the clients. All clients are running Windows 10 1909 OS's and are a mix of laptops and desktops with all the latest Microsoft updates.

I'm pretty sure this issue only seems to of started when Sophos got updated to V10.8.9 for the clients.

Many thanks



This thread was automatically locked due to age.
Parents
  • 0

    Hello Paul James,

    this seems to be an issue with 10.8.9, there are a few threads you can find when searching for deadlock detected. A workaround can be found in this thread but it's low-level and has to be applied on the endpoint.

    Christian

  • 0 in reply to QC

    Hi Christian

    Many thanks for that..... I did see a few threads about this but it always seemed to mention Citrix but we don't use Citrix here.

    Is this causing an issue when it flags about a deadlock and this file ? ? ?

    Do we know if Sophos are going to do anything to stop this happening in the future ? ? ?

    Many thanks

  • 0 in reply to Paul James

    Hello Paul James,

    it seems that it's some bug that more or most likely surfaces with Citrix but it can occur with other files as well. displayswitch.exe has been mentioned in other threads, and I've seen the deadlock message on about 20 endpoints out of 4500+, most prominently atapi.sys. As far as I understand Sophos is investigating and intends to fix it. Seems to be some scanner-internal problem that's not causing other issues.

    Christian

Reply
  • 0 in reply to Paul James

    Hello Paul James,

    it seems that it's some bug that more or most likely surfaces with Citrix but it can occur with other files as well. displayswitch.exe has been mentioned in other threads, and I've seen the deadlock message on about 20 endpoints out of 4500+, most prominently atapi.sys. As far as I understand Sophos is investigating and intends to fix it. Seems to be some scanner-internal problem that's not causing other issues.

    Christian

Children
Unfiltered HTML