Windows update causes problems with McAfee, Sophos and Avast

A recent patch for Windows seems to have caused problems with anti-malware software, writes Ars Technica. In recent days, Microsoft has added more and more antivirus programs to its list of known problems. These include software from Sophos, Avira, ArcaBit, Avast and McAfee.

The problems arose after the patch that appeared on April 9th. Affected machines do not seem to have any problems until a user tries to log in. The system then freezes.

It is not clear whether the systems are completely jammed or are only exceptionally slow to operate. Some users have indicated that they can log in, but that this process takes ten or more hours. The problems occur with Windows 7, 8.1, Server 2008 R2, Server 2021 and Server 2012 R2.

It is possible to start a device in safe mode. The current advice is to use this method to disable the antivirus software so that the machine can start up normally. Sophos also reports that adding the software’s own directory to the list of excluded locations is also a solution.

Problem

Microsoft is currently blocking the update for users of Sophos, Avira and ArcaBit. McAfee’s still under investigation. ArcaBit and Avast have published updates that solve the problem. Avast recommends that systems be left on the login screen for about fifteen minutes and then restarted. The antivirus software should then automatically update itself in the background.

Avast and McAfee also gave a hint about the underlying problem. It seems that Microsoft has implemented a change in CSRSS, an important component of Windows that coordinates and manages Win32 applications. This would cause the antivirus software to crash. The applications try to access a resource, but are blocked because they already have exclusive access to the resource.