Slow performance when svchost.exe is prevented from loading non-Microsoft signed DLL files

Technical Articles ID: KB95542
Last Modified: 2022-04-26 04:58:35 Etc/GMT

Environment

Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.7.x
ENS Threat Prevention 10.7.x, 10.6.x

Problem

When you install ENS Threat Prevention or ENS ATP, on the system at Windows Security, App & browser control, Exploit protection settings, Program settings, svchost.exe is added with "Code integrity guard" enabled. This configuration prevents non-Microsoft signed DLLs from injecting svchost.exe. Thereafter, you notice slow performance on the system.

"Code integrity guard" enabled for svchost.exe

Cause

ENS enters a continuous loop of loading ENS Antimalware Scan Interface (AMSI) DLLs in svchost.exe. This issue occurs because the operating system keeps preventing the loading of non-Microsoft signed DLLs.

Solution

Select "Audit only" or disable "Code integrity guard" for svchost.exe.

Affected Products

Endpoint Security Adaptive Threat Protection
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Slow performance when svchost.exe is prevented from loading non-Microsoft signed DLL files

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Slow performance when svchost.exe is prevented from loading non-Microsoft signed DLL files

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title