High CPU usage from Windows Defender

trashbag · 26 Jul 2018

I have W10 Pro, version 1803, build 17134.19 (although these issues started when I was still on whatever the previous build was numbered) with a i7-6700k, 16gb RAM and a Samsung 750 EVO 500gb.

As of the past week or so I've noticed that Windows Defender's CPU usage, specifically from MsMpEng.exe (Antimalware Service Executable), has increased dramatically when opening/closing certain programs, namely Windows Update in Settings and Firefox.

Whenever I open up "Update & Security" in the Settings app or start/exit Firefox, it not only causes MsMpEng's CPU usage to spike up to 10-15% for the next 20 or so seconds, but also slow down other programs running on my computer during that time. Nothing else has ever slowed down my computer like this, not even games running on max settings - which I should add, typically use MORE than 10-15% CPU.

While it's entirely possible that Defender has always spiked to 10-15% CPU usage considering I've never really had a reason to pay attention to it before, it's never caused the slowdown until recently.

I can circumvent the CPU spikes for Firefox by adding the Firefox process/folders to Defender exclusions, but I haven't found out what to exclude for Windows Settings/Update other than the entire C:\Windows folder, which does work but seems rather excessive.

I've already tried running a full malware scan (came back clean), sfc/ scannow (also came back clean) and chkdsk (clean yet again). Nothing else on my computer has been having issues, just this.

So has anyone else been having increased CPU usage from Defender as of late, or am I the only one? Could a problematic Defender update have caused this?

According to Google I'm not the only one who has encountered the Firefox-Defender CPU usage issue recently but I haven't been able to find anything about any Windows Update-Defender CPU usage issues.

dalchina · 27 Jul 2018

My experience when I first upgraded to Win 10 a lo-o-o-ng time back was wrestling to get control of CPU use. One of the first things I found I had to do was install a 3rd party AV so Defender wasn't an offender in CPU usage terms.

I never tried to investigate, and what I experienced then may be inapplicable to current builds.

trashbag · 27 Jul 2018

I've tried using BitDefender in the past but eventually went back to Defender due to the myriad of problems that BitDefender had of its own. Either way, Defender has never given me any problems until the past week or so.

I just want to know if other people are also having issues with Defender as of late so I can pinpoint if it's a recent definition update that's screwed things up or something else entirely.

dalchina · 27 Jul 2018

FWIW you may get more info if you try this:
Antimalware Service Executable taking up high CPU for several hours! - Page 2 - Windows 10 Forums
post #11

You could also scan thru comments on the threads per recent update per build for 1803 in the News section to see if anything's been reported.

Whenever I open up "Update & Security" in the Settings app or start/exit Firefox, it not only causes MsMpEng's CPU usage to spike up to 10-15% for the next 20 or so seconds,

- you could try running
chkdsk c: /F
(PC will need to reboot)

Which build of FF are you using? Incompatibility reported ref. later FF builds.
** See
How to Fix High Windows Defender Disk Activity When Using Mozilla Firefox

Workaround for FF:

A little while ago, I uninstalled Quantum from my ThinkPad E545 and reinstalled the previous good release (56.0.2) that I had been running. Performance (cpu & mem usage) has returned to acceptable levels. And Windows Defender is no longer actively running. I don't even see it running in the background in Task Manager.

Going back to a previous Firefox release may not be the best solution but it was the easiest workaround. I'm going to uninstall Firefox Quantum from my desktop PC which has the worst problem and which I'd originally reported above. I'll add an update/reply once I've done that.
Defender utilization extremely high since Firefox Quantum update - Microsoft Community

trashbag · 27 Jul 2018

I've already tried chkdsk, that came out clean as well.

I'm not having problems with Defender at high usage for prolonged periods of time or slowing stuff down constantly, it only happens for 10-20 seconds when I open up or close Firefox or open up a specific part of the Settings app.

I'm on the latest non-beta version of Firefox, 61.0.1. Either way I'm not overly concerned about the whole Firefox deal, considering others have reported the same issue recently. This comment in particular basically sums it all up. 1441918 - Antimalware Service Executable very active when using Firefox

It's the issue with Settings/Update & Security that's flummoxing me. I just want to see if anyone else that uses Defender has been encountering the same issues.

trashbag · 27 Jul 2018

Well, thanks to the tip about Resource Manager I've pinpointed that Windows writes to the USOShared folder in ProgramData every time I open up Update & Security in Settings, causing MsMpEng to scan that folder which in turn causes the CPU spike and slowdown. By excluding the USOShared folder from Defender, the CPU spike and slowdown no longer occur when I check updates.

What's weird though is that even though USOShared is in ProgramData instead of the Windows folder, excluding the entire Windows folder also prevents the CPU spike. Maybe Settings, which is located in the Windows folder, acts like some sort of middle man between Defender and the USOShared folder?

Thanks for tipping me off there. However, I'm still curious to know if anyone else had been having this same issue recently, especially considering that this has never happened before the past week or so, even without any Defender exclusions.

dalchina · 27 Jul 2018

Glad that helped to give a workaround. Puzzling if Defender causes a problem with a MS product.. but not seen anything similar reported. Tried a quick forum search, could easily have missed it.

If you can be bothered, you could try uninstalling a recent Windows update...

My USOshared folder just contains a Log folder with a load of etl's. I don't know what they relate to exactly; opening them in WP Analyzer seems to show they contain no data...

Some sort of Windows update log file.

trashbag · 27 Jul 2018

USO apparently stands for Update Service Orchestration. You'll notice every time you open up Windows Update, the "date modified" for some of the ETL log files in there will change to whatever time you opened up WU.

Evidently MsMpEng.exe was scanning a bunch of the files in that folder every time Windows Update was started.

dalchina · 27 Jul 2018

Contention - access problems? I wonder what would happen if you manually scanned the folder. I suppose there could be a corrupt file... Might be interesting to try.

JAM83 · 27 Jul 2018

I hate Windows Defender with a passion. I wish there was someway, somehow I could just delete it from the system entirely. Right now, I have it disabled and i'm running Malwarebytes.