Windows PCs with McAfee AV are the latest broken by Microsoft’s April updates

Credit: ID 6602043 © Jonathan Ross |

Windows computers running two McAfee security products are the latest to suffer boot issues after installing Microsoft’s April 9 security-only updates and monthly rollups. 

The boot issues are affecting Windows 7 and Windows 8.1 users running systems with McAfee’s Security ENS Threat Prevention 10.x and McAfee Host Intrusion Prevention (Host IPS) 8.0. 

“It may cause the system to have slow startup or become unresponsive at restart after installing this update,” Microsoft noted in an April 19 update for known issues affecting the the April 9 update on Windows 7 systems. 

Similar boot problems are also affecting users with Avast for Business, Avast CloudCare, and AVG Business Edition antivirus; Arcabit antivirus; and Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC). 

Microsoft is still investigating the source of the problems and is planning on posting an explanation once it’s found. 

McAfee however says it has a proof of concept fix available for customers affected by slow boot times and slow performance issues after installing the April Windows updates. Customers can get the fix by contacting it. It’s current workaround is to disable any Access Protection rule that protects a service.  

The problems haven’t been as widespread for Windows 10 users after installing the April updates, however Microsoft confirmed that Arcabit users on Windows 10 version 1809 are experiencing unresponsive systems once restarting after the April update. 

According to McAfee, the cause of slowdowns affecting systems with its security software are changes to the Windows Client/Server Runtime Subsystem (CSRSS), which “introduced a potential deadlock” with its ENS product.     

Avast has posted steps to fix the issue and notes that customers have reported that rolling back the April 9 updates or Windows 7 and Windows 8.1 systems resolves the boot problems.  

Microsoft has temporarily blocked the update for affected Arcabit, Avira and Sophos users, while pointing to support pages for fixes related to Avast and McAfee users.      

The issues also affect the corresponding Windows Server versions of Windows 7 and Windows 8.1, which are Windows Server 2008 R2 and Windows Server 2012 R2. 

Sophos has warned customers to uninstall the April update if the system has not been rebooted after installing it. 

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Follow our new CSO Australia LinkedIn
Follow our new social and we'll keep you in the loop for exclusive events and all things security!
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags sophosantivirusmcafeeAvastAvirawindows defenderWindows 10

More about AvastAviraCustomersEnterpriseIntrusionIPSMcAfeeMicrosoftSECSophos

Show Comments

Featured Whitepapers

Editor's Recommendations

Brand Page

Stories by Liam Tung

Latest Videos

More videos

Blog Posts