High CPU usage from Windows Defender

mroek said:

@ignatzatsonic: If disabling real-time protection in Defender solves the problem, then I am unsure if it is actually the same problem. In my testing, I saw no improvement from disabling the real-time protection. Adding certain exclusions helped a little, but not by much. It merely reduced the impact of the problem a little.

In my case, on the other hand, disabling real-time protection did "solve" the problem - it basically shut down resource hogging MsMpEng.exe process.

mroek said:

@ignatzatsonic: If disabling real-time protection in Defender solves the problem, then I am unsure if it is actually the same problem. In my testing, I saw no improvement from disabling the real-time protection. Adding certain exclusions helped a little, but not by much. It merely reduced the impact of the problem a little.

Mroek:

Tough to say if we have the identical problem or just a related problem.

My symptoms began maybe in mid-July.

1: Major slowdown in response times to mouse input, to the point of freezing the PC for 10 or 20 seconds at a time. Can't scroll a Word doc, can't open an app, etc.

2: Occurred a dozen or more times a day, seemingly at random, but never for more than 20 seconds at a time.

3: Occurred whether or not a browser was open, so apparently unrelated to Firefox.

4: Any time the slowdown was occurring, I could see in Task Manager that "Antimalware Service Executable" had jumped up to occupying 25% or 30% of CPU. It may as well have been 100%, because I could do nothing but wait until it fell to 0%, at which point the mouse became responsive again.

5: I did some fiddling with services in Task Manager, to no avail. The only thing that made it go away permanently was using Brink's regedit found in tutorials on this site.

6: I did NOT ever try adding any exclusions to real-time protection.

Your guess is as good as mine, maybe better.

@ignatzatsonic
That are exactly the problems I had (scrolling and all).
In my case disabling real-time protection did help, although (obviously) it made my system vulnerable.

KF1983 said:

@ignatzatsonic
That are exactly the problems I had (scrolling and all).
In my case disabling real-time protection did help, although (obviously) it made my system vulnerable.

Thanks for confirmation of same symptoms.

I think for the time being I'm going to keep Defender real-time disabled with the reg edit and rely on Malwarebytes.

May re-enable Defender real-time in a month or three to see if any MS updates have fixed it in the interim.

KF1983 said:

In my case, on the other hand, disabling real-time protection did "solve" the problem - it basically shut down resource hogging MsMpEng.exe process.

Interesting. In my case the system was actually slowed down even when Defender was not using a lot of CPU.

My best guess is that issues with the db file can manifest itself as different symptoms. I'm quite confident that removing this file to allow it to be recreated is totally safe, and that it should be tried by those that have any of these issues.

I finally fixed my problems after weeks of my laptop being crippled.

The issue appeared to be as others were saying, a broken database file.

To remove it I had to:

1. Decrypt my hard drive
2. Create a Ubuntu boot USB
3. Change my hard drive mode from RAID to AHCI in BIOS
4. Boot from USB
5. Rename the database files as per previous posts
6. Change the disk type back to RAID in BIOS
7. Boot Windows again

What a freaking nightmare...

I am wondering now why Windows Defender has got executables on both C:\Program Files\Windows Defender (usual location) and C:\ProgramData\Microsoft\Windows Defender\Platform (btw, it seems older platform versions can be deleted... but be careful). Still using AVAST Free until someone confirms WD slowdowns are solved.

eLPuSHeR said:

I am wondering now why Windows Defender has got executables on both C:\Program Files\Windows Defender (usual location) and C:\ProgramData\Microsoft\Windows Defender\Platform (btw, it seems older platform versions can be deleted... but be careful). Still using AVAST Free until someone confirms WD slowdowns are solved.

At least for me I can confirm without any doubt that my issues has been resolved by the steps outlined in this thread. It is of course possible that Avast Free steals less resources overall, but I'm back to where I was before the issue started, and I've always just used Defender on this computer.

f14tomcat said:

@eLPuSHeR

Poked around a little. What I found is that the stuff in ProgramData is the WD Engine, not the WD executable. The platform. Last updated 7/31/2-018.

---

Update information

---

This package includes monthly updates and fixes to the Windows Defender antimalware platform that is used by Windows Defender Antivirus in Windows 10.

---

https://support.microsoft.com/en-us/...lware-platform

Thanks. That makes sense. ProgramData is used to store updates to the Windows Defender Antimalware Platform.

mroek said:

At least for me I can confirm without any doubt that my issues has been resolved by the steps outlined in this thread. It is of course possible that Avast Free steals less resources overall, but I'm back to where I was before the issue started, and I've always just used Defender on this computer.

Thanks. Of course Windows Defender is still a very good AV. Need to be polished a little though, specially for us, gamers.