In my case, Windows Defender likes to scan a file named mpenginedb.db-wal, which is in ProgramData/Microsoft/Windows Defender/scans, causing frequent stalling for 10 or 20 seconds at a time.
I have no idea if scanning that file is normal.
I have disabled Windows Defender real-time scanning via a registry edit.
I am using only Malwarebytes for real-time protection until and unless MS resolves the issue.
@ignatzatsonic: I am also seeing that file being accessed by the process (not sure it is scanning it, though), but it does not correlate with the elevated CPU usage. This file is more or less accessed by the process all the time, also when it is not consuming CPU.
I haven't seen any serious disk I/O while CPU is consumed, I'd have expected to at least see some high(ish) disk transfer rates if that was the cause, but CPU is consumed while disk transfer by the process is merely a few kB/s, if even that.
It doesn't use a lot of memory either, just 2-300 MB.
Here are screenshots from Process Explorer and Resource Monitor for the process while the CPU consumption is elevated:
I keep reading reports like these. It seems something is broken for latest versions of Windows Defender. Right now I am using a custom install of a third-party AV. Windows Defender has become sluggish for me (I am a gamer).
PS - How about setting a folder exclusion for \ProgramData\Microsoft\Windows Defender?
Yes, it may well be that there is a bug in the current Defender, but probably only some people are affected.
I will try to add an exclusion for the folder mentioned, but I already have an exclusion for the process itself, which didn't do anything. And I think the same will be true for the full folder, but trying it doesn't harm, of course.
Adding that folder exclusion did nothing, as suspected. This all seems rather random, and it would have been nice to be able to find out what Defender is doing with those CPU cycles, because it sure doesn't look like it's scanning anything.
Another piece of information: It seems it isn't as random as I thought, at least not today. It seems to run in cycles, starting the CPU usage around every 16 minutes, running for approximately 4 minutes each time. During these 4 minutes, the computer is a lot more sluggish, even if the process uses only 12.5 % CPU. I have nothing else running at such a schedule, so I'm still clueless.
And turning off real-time protection in Defender does nothing.
Thanks for the reports mroek. This seems to be a hard issue to diagnose at first sight. How about disabling all schedules for WD temporarily?
To add to this, my Alienware R3 has been crippled for weeks by this latest patch of the alleged anti malware software.
This is a wide spread fault, someone at Microsoft has catastrophically broken the real time scanner.
The problem has been identified by many users all reporting slightly different symptoms but all the same issue, high CPU usage by MsMpEng.exe causing huge lag spikes to the system and even crashing explorer. Adding exclusions some times fixes it and some times doesn't, simply disabling it seems the only fix until Microsoft issue a fix.
Procmon will show nothing but constant read writing to mpenginedb files which users cannot change, delete or rename.
You can see here:
1441918 - Antimalware Service Executable very active when using Firefox
That the devs at Firefox have reported it directly to their contact at Microsoft and presumably a fix will come along as a result.
You can see all over the place people reporting the same thing:
High disk usage of Antimalware Service Executable : Windows10
on Windows has been running with 30 to 50 percent CPU usage for weeks now. Why is it doing this and how do I stop it? : techsupport
Software developers make mistakes we get it, but for Microsoft to have mandatory forced updates and release a bug of this scale crippling countless machines then not publish it is mindbogglingly anti consumer. It takes serious dedication, time and technical expertise to identify this bug and as far as I can tell we only know it actually exists because of the back channel communication between Firefox devs and Microsoft employees.
Wasted days of my time, very poor form.
I hope this information helps anyone else with the issue and saves people some time.
It sure seems that this is a more widespread issue than what I thought, but it clearly does not affect everyone, or else the outcry would have been even bigger.
Now, I have something more to report. As suggested by eLPuSHeR, I disabled all the WD tasks, and actually that caused the issue to go away. There is one tiny CPU peak every minute after doing so, instead of the regular 4 minute runs I reported about earlier.
Then I started re-enabling the tasks, one by one, and with enough time between to see if the issue reappeared. It did not, oddly enough. Then I rebooted my computer, and after a 5 minute (or so) period with the same issue (during this time Defender also downloaded new definitions), it seems to have gone back to those tiny 1-minute peaks, which causes no issues.
I'm not really confident the problem has been fixed, though. Most likely not, as just disabling and re-enabling those tasks should not really make any difference. Ill just have to wait and see, and if the problem returns I'll try the same trick again.
Quote
