Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix

[TheHunter]

Fck me, it 's back.. -_-, MS is so dumb..

I still advise removing Defender and replacing it with some better and less intrusive.

any good suggestion? I did try a few in the past, avast, avira, kaspersky - removed this right away, it blocked too much lol, trendmicro -had this for a long time, then switched to nod32 security until they messed it up and firewall started to consume more cpu..

Then I installed malwarebytes Tinywall and kept default Defender, and haven't looked back, until this counter control issue started to happen., I still remember it good, it was this year around mid January @ win10.

I bought this 11700kf end of December 2021 and all was ok at first, tested/benchmarked a lot. Then few weeks later I started to see some strange regression..

 

[lexluthermiester]

any good suggestion?

Comodo is my current fav and goto. It has the best personal firewall I've seen so far and it is fully customizable. The HIPS functions, which watchdogs programs and the OS, is exceptional. Comodo makes microsoft look like monkey's flinging poo.

https://download.comodo.com/cis/download/installs/8060/standalone/cispro_installer.exe?af=7639

The free version does not exire. It'll ask you to try the pro version and to be fair $40 for a 3PC 1year license is damn decent.

 

[Solaris17]

Defender - 0x222: All three fixed function counters are programmed to mode 2. This is the value that Windows Defender sets these counters to when it is using them.

This doesn't seem entirely accurate. "Defender" while obviously causing issues in this context by setting these values; any software can assign these values. Are you performing other checks to be certain it is defender before reporting it as the performance issue @unclewebb ?

 

[unclewebb]

This doesn't seem entirely accurate.

You are 100% correct. Any software can use these timers within the CPU and any software can set these timers to mode 2.

The word Defender is only a warning. It is not a confirmation that Windows Defender is guilty of anything. Open the Task Manager, go to the Details tab and have a look to see if the Microsoft Malware Protection Engine (MsMpEng.exe) is using more CPU cycles than usual.

If I had this problem, I would run a consistent benchmark like Cinebench R23 and I would compare my score to when these timers are not being set to mode 2. If you are running Windows Defender and you see a noticeable increase in performance when these timers are not being set to mode 2, and MsMpEng.exe is using more CPU cycles than usual, I would conclude that Windows Defender is why your performance is being reduced.

 

[Solaris17]

You are 100% correct. Any software can use these timers within the CPU and any software can set these timers to mode 2.

The word Defender is only a warning. It is not a confirmation that Windows Defender is guilty of anything. Open the Task Manager, go to the Details tab and have a look to see if the Microsoft Malware Protection Engine (MsMpEng.exe) is using more CPU cycles than usual.

If I had this problem, I would run a consistent benchmark like Cinebench R23 and I would compare my score to when these timers are not being set to mode 2. If you are running Windows Defender and you see a noticeable increase in performance when these timers are not being set to mode 2, and MsMpEng.exe is using more CPU cycles than usual, I would conclude that Windows Defender is why your performance is being reduced.

Sick thanks for explaining!

 

[TheHunter]

Seems to be ok again.. and i didnt start anything unusual last time when i saw it, maybe they fixed it again with recent defender update.

weird stuff..

@lexluthermiester

does that comodo av also disable Defender?

 

[Mussels]

does that comodo av also disable Defender?

Defender disables the moment any other AV is installed and active

 

[lexluthermiester]

Defender disables the moment any other AV is installed and active

This.

 

[TheHunter]

So I was still struggling with defender, but then I said enough and installed that Comodo AV only part and now it says

all the time.

Bye bye defender

 

[AusWolf]

So I was still struggling with defender, but then I said enough and installed that Comodo AV only part and now it says
View attachment 291936

all the time.

Bye bye defender

I went the hard way: I upgraded to a Ryzen 7 7700X, and my 11700 is in my HTPC now, where the defender-restricted performance doesn't matter anymore.

 

[ThrashZone]

Hi,
The third party AV does have to register with defender to disable WD
Most AV's will give the option on install or in their settings.
Amazing how many want to use both

 

[lexluthermiester]

Amazing how many want to use both

Right? Just crazy as hell.

 

[Mussels]

Hi,
The third party AV does have to register with defender to disable WD
Most AV's will give the option on install or in their settings.
Amazing how many want to use both

which is smart, after having dealt with users who disabled their AV because an ad on a fake pirate website told them to disable their AV to get their movie to play... it's annoying, but at least it's valid that defender won't shut off without a recognised AV to prevent malware and idiocy disabling all antivirus.

 

[bug]

which is smart, after having dealt with users who disabled their AV because an ad on a fake pirate website told them to disable their AV to get their movie to play... it's annoying, but at least it's valid that defender won't shut off without a recognised AV to prevent malware and idiocy disabling all antivirus.

I wouldn't call it "smart". I think it's sad when people use computers without understanding what an AV does or how it works. People using computers there days are so "smart", they don't know what the URL bar in a browser is for

 

[Mussels]

I wouldn't call it "smart". I think it's sad when people use computers without understanding what an AV does or how it works. People using computers there days are so "smart", they don't know what the URL bar in a browser is for

because it changed over the years and varies between browsers?

 

[bug]

because it changed over the years and varies between browsers?

Yeah, that requires a PhD to understand or keep track of

 

[lexluthermiester]

Yeah, that requires a PhD to understand or keep track of

Not really. It requires one to pay attention, little more.

 

[TheHunter]

Yeah, after I installed this Comodo AV some defender part wanted to contact microsoft and I allowed it, after I did that it somehow magically enabled Denfender as well, had to reboot the system then it was ok again.
This happened 2x so far in 1 month, I think it was by update Tuesdays..

 

[lexluthermiester]

Yeah, after I installed this Comodo AV some defender part wanted to contact microsoft and I allowed it, after I did that it somehow magically enabled Denfender as well, had to reboot the system then it was ok again.
This happened 2x so far in 1 month, I think it was by update Tuesdays..

You need to disable Defender completely and not allow it to run again.

 

[Veseleil]

You need to disable Defender completely and not allow it to run again.

Running the defender free OS in the first place was such a relief.

 

[lexluthermiester]

Yeah, after I installed this Comodo AV some defender part wanted to contact microsoft and I allowed it, after I did that it somehow magically enabled Denfender as well, had to reboot the system then it was ok again.
This happened 2x so far in 1 month, I think it was by update Tuesdays..

Running the defender free OS in the first place was such a relief.

I hate to link an external article, but it is a good example of why I just won't use it.

Examination of 18 antivirus programs shows Microsoft Defender has the highest system load

AV-TEST, an independent organization that evaluates and rates antivirus and security suite software, tested 18 antivirus packages for Windows 10. The examination involved testing the programs against...

www.techspot.com

Personally, I think AV-Test.org was being a bit generous and nice. My reasoning for that is Windows Defender is FAR more annoying than ANY other AV. It deletes things without asking first, STILL.
Eff Windows Defender...

 

[claylomax]

Has it been fixed? Every time I boot my computer now Counter Control says Normal; before it would say Defender.

 

[AusWolf]

Has it been fixed? Every time I boot my computer now Counter Control says Normal; before it would say Defender.

Wait a couple of minutes after boot - Defender can take its time to kick in.

 

[claylomax]

It's the same after two hours.
Can anybody check please?

 

[Mussels]

I hate to link an external article, but it is a good example of why I just won't use it.

Examination of 18 antivirus programs shows Microsoft Defender has the highest system load

AV-TEST, an independent organization that evaluates and rates antivirus and security suite software, tested 18 antivirus packages for Windows 10. The examination involved testing the programs against...

www.techspot.com

Personally, I think AV-Test.org was being a bit generous and nice. My reasoning for that is Windows Defender is FAR more annoying than ANY other AV. It deletes things without asking first, STILL.
Eff Windows Defender...

Nah it doesn't delete - it quarantines them. You can do two clicks and get them back and excluded from future scans (It doesnt like a few of my router hacking tools, but it's also clear that they're "Hack Tools" and potentially unwanted)

When you compare the results instead of techspots view on them, it's not quite what they make you think
Equal best protection, equal best usability, 5.0 of 6.0 for performance

The ones they recommend like Avast have constant popups peddling addons and upgrades, so i'm not sure how that's got better usability

Their forums had the best answer on this one (Still an issue now, older post was just the funniest and first hit)