Multiple copies of cyreport.exe - 100% CPU

craigwhalland — Wed, 08 Mar 2023 07:24:44 GMT

I have a scenario where I have installed a new Canon LiDE400 scanner on a classroom windows 10 desktop using the Canon Driver from the Canon Website.

Reboot the desktop and runs fine. As soon as you launch any software that calls upon the scanner (windows fax and scan / Photoshop) and launch the scan - the machine spikes to 100% CPU with almost a hundred copies of cyreport.exe running.

Swapped back to a different older model scanner and no issues. Agent is 7.9.0

Not seeing this on another Windows 11 laptop running same agent. Scan completes fine.

Windows 10 Machine runs fine until the scan commences.

Any ideas where to troubleshoot?

Re: Multiple copies of cyreport.exe - 100% CPU

eluis — Wed, 08 Mar 2023 09:06:04 GMT

Hi @craigwhalland and thank you for writing to live community

I would check first if this driver is signed by the canon vendor (you can right click and see in the signatures area of the properties of the file). If possitive, add it as a trusted signer because Canon is a legit vendor and if the driver is coming from them it should be signed by them and so be trusted.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Add-a-Disable-Prevention-Rule

I strongly recommend to add first just the signer and hash and path if you have them following the instructions on the above doc, to be as much specific as you can, so not leaving room for an attacker to place a malicious file with the same name as the driver in the same location.

If after doing the above you still have performance peaks and same issues you described, please feel free to open a TAC support ticket.

Please mark this answer and an Accepted solution if it solved your problem

KR,

Luis

topic Multiple copies of cyreport.exe - 100% CPU in Cortex XDR Discussions

Multiple copies of cyreport.exe - 100% CPU

Re: Multiple copies of cyreport.exe - 100% CPU