Scanning on Windows with Intel AMX

View as Markdown

Why do Windows Explorers or CLI scans crash on Intel AMX-capable systems?

On systems with Intel Advanced Matrix Extensions (AMX), third-party endpoint protection can crash the runZero Explorer process mid-scan, on both physical hardware and virtual machines. The endpoint protection injects code without sizing its stack correctly; when that code raises an exception, the AMX exception frame it writes corrupts the runZero thread.

Two workarounds are available:

  1. Disable AMX.
  • If the Explorer runs on Windows as a Hyper-V guest, enable Processor Compatibility for that VM, and restart.
  • For other types of virtual machines or physical systems, disable AMX in the BIOS or hypervisor CPU settings.
  1. Disable or replace the endpoint protection software.
  • For Microsoft Defender, excluding the runZero process is not enough: Defender still injects the buggy code into the runZero Explorer.
  • The system may need a full restart to return the service to a non-hooked state.

If the crash persists after either workaround, use the “Download Logs” option from the Explorer details page and contact runZero support. The .err file in this ZIP contains the crash logs, the current state of AMX, and the list of loaded DLLs.

Updated