Forum Discussion

SenseiAlper's avatar
SenseiAlper
Seasoned Novice
3 months ago
Solved

BUG REPORT – EasyAntiCheat_EOS.sys Kernel Scan Loop

Game

Apex Legends

Anti-Cheat

Easy Anti-Cheat (EOS)

Platform

  • Windows 10 22H2 (same behavior previously observed on Windows 11)
  • Issue persists even after clean OS installation

Problem Description

While Apex Legends is running, the kernel driver easyanticheat_eos.sys performs continuous scanning without stopping.
This causes persistent high CPU usage through kernel components such as:

  • ntoskrnl.exe
  • Wdf01000.sys
  • occasionally dxgkrnl.sys

CPU usage immediately returns to normal as soon as the game is closed.

Critical Comparison (Important)

On the same system, with the same OS and hardware:

  • Fortnite – had the same issue before, later fixed
  • VRChat – had the same issue before, later fixed
  • Apex Legends – issue still persists

This strongly indicates:

  • Not a hardware problem
  • Not an OS or GPU driver issue
  • Apex-specific Easy Anti-Cheat EOS module / policy regression

Attempted Fixes (No Effect)

  • Windows 11 → Windows 10 downgrade
  • Multiple NVIDIA GPU driver versions
  • Memory Integrity / VBS / Hyper-V disabled
  • Easy Anti-Cheat reinstall
  • All overlays and third-party tools disabled

Possible Cause (Hypothesis)

The Apex Legends-specific Easy Anti-Cheat EOS game module may be causing a kernel callback loop, particularly on older CPU architectures.

  • I found a solution that helped me, although it was very complex;
    and I have no idea which of the following helped me, but I was pretty stressed out until I did everything, and I didn't test the game.
    First, I uninstalled my antivirus (I had Avast, and it had a core isolation feature, i.e., its own sandbox);
    then I tried enabling core isolation in Windows Defender, but it reported that it couldn't do it because Unhappy with my old drivers, it gave me an impressive list (and since my system is over 9 years old...it migrated from 7 to 10, it was complaining about the old driver sys files).
    I downloaded the program Autoruns from the Microsoft repository
    https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns


    and used it to delete old library versions and registry entries: these were drivers from a WD MY PASSPORT portable HDD, an old IVT Bluetooth dongle, and drivers from my FIIO E07K DAC;

    Naturally, they were all dated around 2016 and were signed for Windows 7. I think I removed all of them through the built-in Add/Remove Programs feature, but apparently drivers leave behind a significant amount of data (in case of reinstallation or downgrading to an older version).
    After that, I enabled kernel isolation in Windows Defender, checked that VT-d virtualization was enabled in the BIOS, and finally, I deleted the following folders from the game folder:

    The list of items I deleted is marked in yellow.


    r2 (it contains the file responsible for the entire list of files that need to be restored during the repair function);
    Support;
    EasyAntiCheat;
    __Installer
    C:\Program Files (x86)\EasyAntiCheat_EOS\

    and all the files that were in the game's root folder
    leaving only the content folders, which are heavy
    and I also ran a repair through the launcher

    I don't know which of all this helped me...maybe the anti-cheat was updated while I was doing this, or maybe Avast was so smart, with its system analyzer and sandbox, that it prevented the anti-cheat bootstrapper and the game from escaping the kernel, or maybe the new anti-cheat version (updated with the 2nd split ) itself didn't like my old driver's versions and kept hanging in the system because of them...

    I DON'T KNOW

    The only thing I can recommend first is to enable core isolation in Windows Defender, and if that doesn't help, then uninstall your anti-virus (if you have Avast, of course) :D

    P.S. sorry for my ENG..it's not my native

     

    UPD. I ran a reverse engineering experiment, and repeat the bug. Installed avast again, and disabled core isolation in Windows Defender. Anti-cheat and Apex sit are in the kernel, and Avast doesn't let them out, he lock't them in self sandbox :D
    By the way, with kernel isolation enabled in Windows Defender, with avast this bug doesn't exist... Conclusion: antiviruses are evil, Windows Defender rules :D

    If you have avast installed, you can send them a warm hello in the bug reports... and of course, ENABLE CORE ISOLATION in Windows Defender... this is exactly what will protect you and your nerves from bloatware software in the form of antiviruses😁

9 Replies

  • m1namoto's avatar
    m1namoto
    Seasoned Novice
    2 months ago

    I found the deeper solution for blocking the anti-cheat in the ntoskrnl process, in my case it was related to the cumulative windows update KB5071546, which is aimed at improving the firewall, perhaps the update was installed crookedly via windows update, because when trying to uninstall it, the system wrote that "not all update components were removed." Therefore, I downloaded this cumulative package from the Microsoft repository

    https://www.catalog.update.microsoft.com/Home.aspx

    find in search KB5071546

    and downloadig for my version of the OS (W10 LTSB 21H2), and reinstalled it, and then reset the firewall to default settings by running the <netsh advfirewall reset> command in the console; turned off core isolation and rebooted the PC; after that, launched the EA app, granted connection permissions and that's it...2-3 sessions of 20-40 minutes, a total of 2-3 matches, and no problems, Apex closes as instantly as with core isolation enabled; I'm most likely assuming that the update screwed up some of the connection permissions for EAC itself, which is why after the end of the game session, EAC didn't received a resolve from the server.How did I end up like this? It was just a coincidence that I updated just as the second split was about to begin: I installed both the cumulative update and updated my antivirus, and then I started noticing that I wasn't the only one having these problems. The catch is, I'm on Windows 10, and people were reporting the problem starting on November 25th with Windows 11... so I don't know what cumulative update from microsoft sent them at the end of november😁

    P.S. So, regarding the EAC, there's a joke about it: don't shoot the pianist, he plays as best he can... and is not guilty of anything

    P.P.S. Viva la microsoft...threw a puzzle 🤪

  • m1namoto's avatar
    m1namoto
    Seasoned Novice
    3 months ago

    I think that this is how they improve the fight against cheaters, so that **bleep** with DMA cards don't have access to memory interception, and that soon enabling core isolation will be a prerequisite for playing Apex, like it was in the case of BF6, where they made the presence of a secure boot mandatory... and that's great.

  • SenseiAlper's avatar
    SenseiAlper
    Seasoned Novice
    3 months ago

    I can't belive i'm saying this but i think enabling Core Isolation fixed the issue so far...40 minutes in and it's fine. I'm speechles lol.

  • SenseiAlper's avatar
    SenseiAlper
    Seasoned Novice
    3 months ago

    I don't have any antivirus softwares but i actually have Core Isolation disabled in Windows by default. I am going to definitely try this right now. 

  • m1namoto's avatar
    m1namoto
    Seasoned Novice
    3 months ago

    I found a solution that helped me, although it was very complex;
    and I have no idea which of the following helped me, but I was pretty stressed out until I did everything, and I didn't test the game.
    First, I uninstalled my antivirus (I had Avast, and it had a core isolation feature, i.e., its own sandbox);
    then I tried enabling core isolation in Windows Defender, but it reported that it couldn't do it because Unhappy with my old drivers, it gave me an impressive list (and since my system is over 9 years old...it migrated from 7 to 10, it was complaining about the old driver sys files).
    I downloaded the program Autoruns from the Microsoft repository
    https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns


    and used it to delete old library versions and registry entries: these were drivers from a WD MY PASSPORT portable HDD, an old IVT Bluetooth dongle, and drivers from my FIIO E07K DAC;

    Naturally, they were all dated around 2016 and were signed for Windows 7. I think I removed all of them through the built-in Add/Remove Programs feature, but apparently drivers leave behind a significant amount of data (in case of reinstallation or downgrading to an older version).
    After that, I enabled kernel isolation in Windows Defender, checked that VT-d virtualization was enabled in the BIOS, and finally, I deleted the following folders from the game folder:

    The list of items I deleted is marked in yellow.


    r2 (it contains the file responsible for the entire list of files that need to be restored during the repair function);
    Support;
    EasyAntiCheat;
    __Installer
    C:\Program Files (x86)\EasyAntiCheat_EOS\

    and all the files that were in the game's root folder
    leaving only the content folders, which are heavy
    and I also ran a repair through the launcher

    I don't know which of all this helped me...maybe the anti-cheat was updated while I was doing this, or maybe Avast was so smart, with its system analyzer and sandbox, that it prevented the anti-cheat bootstrapper and the game from escaping the kernel, or maybe the new anti-cheat version (updated with the 2nd split ) itself didn't like my old driver's versions and kept hanging in the system because of them...

    I DON'T KNOW

    The only thing I can recommend first is to enable core isolation in Windows Defender, and if that doesn't help, then uninstall your anti-virus (if you have Avast, of course) :D

    P.S. sorry for my ENG..it's not my native

     

    UPD. I ran a reverse engineering experiment, and repeat the bug. Installed avast again, and disabled core isolation in Windows Defender. Anti-cheat and Apex sit are in the kernel, and Avast doesn't let them out, he lock't them in self sandbox :D
    By the way, with kernel isolation enabled in Windows Defender, with avast this bug doesn't exist... Conclusion: antiviruses are evil, Windows Defender rules :D

    If you have avast installed, you can send them a warm hello in the bug reports... and of course, ENABLE CORE ISOLATION in Windows Defender... this is exactly what will protect you and your nerves from bloatware software in the form of antiviruses😁

  • SenseiAlper's avatar
    SenseiAlper
    Seasoned Novice
    3 months ago

    I'm experiencing the exact same thing now. Even though I closed the game, the system continues to consume 20-25% of the CPU.

  • Bobbybenny12's avatar
    Bobbybenny12
    Seasoned Newcomer
    3 months ago

    I have the same issue except EasyAntiCheat_EOS driver fails to terminate when the game and EasyAntiCheat processes close. It also doesn't respond to sc stop. It will fully utilize my CPU until it finishes, typically taking more than 30 minutes, or if I just restart my system.

  • i think i have the same issue but the game crashes when trying to play any mode except firing range it started with the merry mayhem drop "Apex keeps crashing with a DXGI_ERROR_DEVICE_HUNG error or an 0x8000001 integrity error whenever I hover over certain legends (like Mirage or using seer's alt) in the locker. The models load slowly, sometimes show up as white placeholders, and then the game crashes." from my post earlier

     i tried reinstalling drivers and downgrading windows too but nothing works

  • Additional technical clarification:

    This issue previously affected Fortnite and VRChat on the same system and was resolved for both games after updates.

    The problem now persists only in Apex Legends, which strongly suggests an Apex-specific Easy Anti-Cheat EOS regression, not a system or configuration issue.

Featured Places

Node avatar for Apex Legends Technical Issues

Apex Legends Technical Issues

Having issues with Apex Legends? Join here to find help with connectivity, performance issues, crashes and more.Latest Activity: 11 minutes ago
40,024 Posts