Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix

[OneMoar]

Was this all just an honest mistake or was someone trying to make Intel CPUs look slower than they are? All CPU reviews during the last few years are suddenly suspect if they were not testing for this issue. Windows Defender can start and stop this part of its algorithm at any time. As soon as it starts, performance tanks.

can we not with the clickbait speculation

great job finding this its a minor bug and will be shortly patched if enough noise is made about it

6% is hardly significant in the grand scheme

remember that your average user doesn't care and if it doesn't impact the average user neither does intel/microsoft

and PSA:Windows defender Consistently ranks at the top of the protection and performance charts it should be your goto when basic protection is required

 

[AusWolf]

if they have, i do not notice it defender is at 0% Malware protection is at 0.2% which is MsMp (and also use half the RAM your screenshot show )

Defender is at 0% on my system as well, and look at the results.

 

[GreiverBlade]

How is it caused by Intel?

duh, because the issue is predominantly affecting Intel setup? (half joke)

Defender is at 0% on my system as well, and look at the results.

before or after using the tool in that news???

 

[AusWolf]

before or after using the tool in that news???

Both, actually.

 

[lexluthermiester]

i have always known and said...!
now we have it in black and white.

I kiss your eyes.
fantastic job!

@lexluthermiester

Right? At least now we know and have a fix. Of course, this does nothing for the other problems inherent with Windows Defender..

Well I'll stick with disabling windows/ microsoft pretender Oops defender with @W1zzard scripts
It's pure-d crapware anyway get a real antivirus

Same. I'll stick with the complete removal procedure I've been utilizing for nearly a decade.

 

[ThrashZone]

Right? At least now we know and have a fix. Of course, this does nothing for the other problems inherent with Windows Defender..


Same. I'll stick with the complete removal procedure I've been utilizing for nearly a decade.

Hi,
Yeah 10 was bad but 11 is far worse than that.

I just started removing pretender early this year mainly because I started using it a bit more.

 

[lexluthermiester]

cue microsoft & intel patching this in 3 2 1 ...

First, this is purely a microsoft coding problem. Second, it's been happening for donkey's years. You really expect them to patch it anytime soon?

Was this all just an honest mistake or was someone trying to make Intel CPUs look slower than they are? All CPU reviews during the last few years are suddenly suspect if they were not testing for this issue. Windows Defender can start and stop this part of its algorithm at any time. As soon as it starts, performance tanks.

Really makes one wonder about all the reviews and benchmarks we've seen over the years. This is one of the MANY reasons I remove defender from the systems I use.

can we not with the clickbait speculation

What?!?

PSA:Windows defender Consistently ranks at the top of the protection and performance charts it should be your goto when basic protection is required

Seriously, you gotta hush your cakehole.

 

[AusWolf]

Really make one wonder about all the reviews and benchmarks we've seen over the years. This is one of the MANY reasons I remove defender from the systems I use.

Seriously, you gotta hush your cakehole.

So what do you use instead?

Honestly, even with this issue, I still think Windows Defender is and should be the go-to antivirus app for 99% of home users.

 

[OneMoar]

First, this is purely a microsoft coding problem. Second, it's been happening for donkey's years. You really expect expect them to patch it anytime soon?

Really make one wonder about all the reviews and benchmarks we've seen over the years. This is one of the MANY reasons I remove defender from the systems I use.

What?!?

Seriously, you gotta hush your cakehole.

go be wrong somewhere else lex

Test Microsoft Defender Antivirus (Consumer) 4.18 for Windows 10 (221213)

The current test Microsoft Defender Antivirus (Consumer) 4.18 for Windows 10 (221213) from April 2022 of AV-TEST, the leading international and independent service provider for antivirus software and malware.

www.av-test.org

I have waning tolerance for idiots as I age please do your homework first defender has for years consistently been as good if not better then most solutions on the market the only recommendation I give other then defender is Avria or MBAM if the situation calls for a second option &
the amount of times I have run a scan with MBAM or AVRIA and they have found something that defender missed is ...... honestly can't tell you because I haven't seen it happen in person yet

 

[ThrashZone]

Hi,
I'm sure it's by design
Just like intel now using all these crap thermal defective cores for ms back ground services also by design.

 

[AusWolf]

Fun fact: after applying the fix, my CPU's idle power consumption drops from 12-15 W to 8.5 W. Now somebody tell me about Rocket Lake being inefficient!

 

[plastiscɧ]

6% is hardly significant in the grand scheme

would you say the same if your car is drinking 6% more. or 6% inflation is okay...?!

i have been insulted of course that in the past:

okay i am still here and this thread here is very insightful. everything must be put on the table. then things can also get better.

 

[OneMoar]

its interesting because programmatically speaking there is little reason to use that register to begin with its a `old` way of doing it something that has existed since at least nethalm
and its even more interesting because seemly older chips are not affected in the same way
its like somebody took a page out of the initial intel documentation for it and never bothered to check if it worked properly on newer platforms

somebody should run a test with VT-D on vs Off and see if the behavior changes
intel's performance counters have been the subject of many an issue for awhile
there was a rash of bad actors abusing them to ddos linux machines back in like 2011ish

 

[unclewebb]

clickbait speculation

I agree. Sorry for my enthusiasm.

6% is hardly significant in the grand scheme

I think you under estimate how many computer buying decisions are based on far less than a 1000 point difference in Cinebench scores. If two computers were sitting at more or less the same price point and one was performing that much better, no one would be buying the lower performing computer.

remember that your average user doesn't care and if it doesn't impact the average user neither does intel/microsoft

I totally agree. That is why I do not think Microsoft will ever make any changes to Windows Defender to reduce its impact on performance.

Windows defender Consistently ranks at the top of the protection and performance charts

I did not say that Windows Defender is a bad antivirus program. I think a lot of user negativity towards Defender is because of this flaw that was discovered. I think Windows Defender can still be a top ranked antivirus program without needing to use so many CPU cycles. If Windows Defender can randomly stop this part of its algorithm, does it really need to be running for hours at a time? Probably not. Protection still seems to work fine whether this part of Windows Defender is running or not.

never bothered to check if it worked properly on newer platforms

All Intel CPUs use performance monitoring counters. These counters were used in Core 2 Duo CPUs and probably quite a few Intel CPUs before that. There is no problem with these counters at the hardware level. The number of available counters for each CPU has changed over time. Newer CPU generations include more programmable counters.

Monitoring these counters is just an easy way to detect when Windows Defender has started to run some special procedure that may last for 5 minutes after first booting up or it can start at any time after that and go on for hours.

On my computer, when booting up after a blue screen, this part of the Windows Defender algorithm will not start for the first 5+ minutes. If this is important, it should start up immediately upon every boot.

 

[OneMoar]

I agree. Sorry for my enthusiasm.


I think you under estimate how many computer buying decisions are based on far less than a 1000 point difference in Cinebench scores. If two computers were sitting at more or less the same price point and one was performing that much better, no one would be buying the lower performing computer.


I totally agree. That is why I do not think Microsoft will ever make any changes to Windows Defender to reduce its impact on performance.


I did not say that Windows Defender is a bad antivirus program. I think a lot of user negativity towards Defender is because of this flaw that was discovered. I think Windows Defender can still be a top ranked antivirus program without needing to use so many CPU cycles. If Windows Defender can randomly stop this part of its algorithm, does it really need to be running for hours at a time? Probably not. Protection still seems to work fine whether this part of Windows Defender is running or not.


All Intel CPUs use performance monitoring counters. These counters were used in Core 2 Duo CPUs and probably quite a few Intel CPUs before that. There is no problem with these counters at the hardware level. The number of available counters for each CPU has changed over time. Newer CPU generations include more programmable counters.

Monitoring these counters is just an easy way to detect when Windows Defender has started to run some special procedure that may last for 5 minutes after first booting up or it can start at any time after that and go on for hours.

it should clear the registers thats on defender for not handling it correctly, but the issues with the perf MSR 0X38D go back to 2009 its always been a bit janky
but this is like a hour fix stops if somebody on the defender team notices have you filed a feedback hub report yet?

and I didn't say that you were implying defender was bad it was directed at the yahoos jumping on the 'defender sucks' bandwagon without knowing wtf they are talking about
jesus people do you not notice that every other av provider uses more cpu then defender I have seen idle cpu usage in the 30-40% range with other solutions (looking at you trendmicro,norton)

If i saw a AV product using 4% cpu at idle I would jump for joy because thats pretty dam fine compared to everybody else

 

[ThrashZone]

Hi,
You're not helping your case mentioning those two shit companies

 

[unclewebb]

have you filed a feedback hub report yet?

Not yet. If this is an important issue I think they will find out about it soon enough.

I have used Windows Defender for years because of its low CPU usage. After this fix is applied, CPU usage is even lower.

Some of Windows Defender's competition have become extremely bloated. I have not used Trend Micro or Norton in years. I do not know how the recent versions compare to Windows Defender when it comes to CPU usage.

 

[OneMoar]

Not yet. If this is an important issue I think they will find out about it soon enough.

I have used Windows Defender for years because of its low CPU usage. After this fix is applied, CPU usage is even lower.

Some of Windows Defender's competition have become extremely bloated. I have not used Trend Micro or Norton in years. I do not know how the recent versions compare to Windows Defender when it comes to CPU usage.

trendmicro is a good 10% on a i7 9700 I just checked a client pc

 

[chrcoluk]

Mine just says not used. So I guess i am ok.

 

[lexluthermiester]

go be wrong somewhere else lex

Look in a mirror. Happy sand-brushing to you.

I have waning tolerance for idiots

Aww, that was adorable. You must not like yourself very much then. Any other treasures of wisdom you want to share, hmmmm?

So what do you use instead?

There are plenty of good ones that are on par with or better than defender in the detection arena without being so invasive, intrusive and annoying. Many of them use lower/fewer system resources to get the job done. Comodo is my current fav.

I still think Windows Defender is and should be the go-to antivirus app for 99% of home users.

We could not disagree more on that.

I did not say that Windows Defender is a bad antivirus program.

I have and will continue to do so. Windows Defender is crapware compared to much of the competition.

I think a lot of user negativity towards Defender is because of this flaw that was discovered.

Not at all. The annoying habit of defender deleting files without user prompting/verification is a big reason. By default defender takes that action on files which contain known or suspected viral-like routines, even for files that don't actually contain a virus. This can be a serious effing headache for many forms of legitimate work. The next problem is that defender reports back to microsoft every single file it scans, regardless of whether you want it to or not. This is a serious problem for data that needs complete confidentiality/secrecy.

Not yet. If this is an important issue I think they will find out about it soon enough.

Don't hold your breath on that one..

 

[DBH]

Ohh updated my old Throttlestop and can confirm it's fixed the issue! Thanks

 

[AusWolf]

There are plenty of good ones that are on par with or better than defender in the detection arena without being so invasive, intrusive and annoying. Many of them use lower/fewer system resources to get the job done. Comodo is my current fav.

Is it free?

I'll have a look at it. I have my reservations, though, as I haven't used any other antivirus app since Defender started to come integrated in Windows.

Edit: How do you find Defender annoying? It's only a module in your system settings / Windows security centre. It couldn't be any lower profile than this.

 

[Deleted member 24505]

I have a fix too...AMD CPU (couldn't resist )

The issue is not with the Intel hardware so your comment is

12700k, no issue here, apart from the crappy ADL CPU i guess.

 

[Jism]

This article reminded me to switch off quick scan in it's completeness.

also the upping of random "samples" to MS ... I really dont need it.

 

[bug]

I have a fix too...AMD CPU (couldn't resist )

Since you couldn't resist: use Linux