Root Cause

Deep Security Agent version 12.0 Update 2 and 11.0 Update 15 enables a new function for the Anti-Malware (AM) driver that checks whether the target file is a Portable Executable (PE) file or not.

In certain environments, Windows may access a remote file after entering credentials. If the AM driver takes a long time to check if the remote file is a PE, the process will be blocked by the Anti-Malware module before the check is complete.

Solution

This issue is fixed in the following DSA builds:

• Deep Security Agent 12.0 Update 9 or later
• Deep Security Agent 11.0 Update 21 and later