Noticed that over the past month or so we keep getting errors/alerts from various devices saying "Deadlock detected while asynchronously scanning file "C:\windows\system32\displayswitch.exe"
For some reason it's always this displayswitch.exe file that causes this issue and not seen any other files causing this alert.
We are running SEC V5.5.1 with V10.8.9 for the clients. All clients are running Windows 10 1909 OS's and are a mix of laptops and desktops with all the latest Microsoft updates.
I'm pretty sure this issue only seems to of started when Sophos got updated to V10.8.9 for the clients.
Hello Paul James,
this seems to be an issue with 10.8.9, there are a few threads you can find when searching for deadlock detected. A workaround can be found in this thread but it's low-level and has to be applied on the endpoint.
Many thanks for that..... I did see a few threads about this but it always seemed to mention Citrix but we don't use Citrix here.
Is this causing an issue when it flags about a deadlock and this file ? ? ?
Do we know if Sophos are going to do anything to stop this happening in the future ? ? ?
it seems that it's some bug that more or most likely surfaces with Citrix but it can occur with other files as well. displayswitch.exe has been mentioned in other threads, and I've seen the deadlock message on about 20 endpoints out of 4500+, most prominently atapi.sys. As far as I understand Sophos is investigating and intends to fix it. Seems to be some scanner-internal problem that's not causing other issues.
Is there any update on this issue?