Windows Defender uses more system resources on Intel PCs

Kevin Glynn, the developer of popular tools like ThrottleStop and RealTemp, discovered a bug in Windows Defender that caused it to consume more system resources than necessary. It has also released a new app that fixes this problem.

Windows Defender consumes more resources on Intel processors

Antivirus programs constantly scan your system for unusual activity to prevent malware from affecting your system. This is normal, and Windows Defender is no exception to this.

But there is more than meets the eye. A screenshot shared by Techpowerup shows that Defender was using about 4% CPU while running CineBench, and some benchmark comparisons resulted in a 6% loss because the antivirus was using excessive resources. It uses them for real-time protection notifications.

Windows Defender uses more system resources on Intel processors

Computer processors have special registers called hardware performance counters. Techpowerup’s report mentions that Windows Defender uses all possible hardware performance counters, including the fixed function counters of Intel processors.

These counters can operate in one of 4 possible modes:

  • Disabled
  • Operating system (ring-0)
  • User (ring >0)
  • All Ring Levels

Windows Defender sets these counters to mode 2 at random intervals for an indefinite amount of time. This can happen at any time, on startup or during normal use. The problem is that it starts eating away at CPU usage, leaving less resources for other programs.

Interestingly, AMD processors are not affected by this issue.

The value of these performance counters are set to Mode 3 or All-Ring levels, when you run system monitoring tools like ThrottleStop, HWinfo to name a few. When Windows Defender detects a change in the counter, it doesn’t reset it, which also ensures your computer is running at peak efficiency.

Now you can’t have system tools running all the time. So how to solve this problem?

Counter Control and ThrottleStop 9.5

Say hello to a new app called Counter Control. This application, also made by Glynn, fixes the performance impact of Windows Defender. How does he do this? It monitors and logs the IA32_FIXED_CTR_CTRL register located at MSR 0x38D. It not only shows whether Defender is impacting your system’s performance, but also provides a way to set the counter to Mode 3. The best part is that it doesn’t affect Windows Defender’s antivirus capabilities, so your computer’s security is not compromised.

How can I check if my Intel computer is affected?

Download Counter Control and run it, it’s portable software. The utility supports most Intel processors released since 2008.

If you see code 0x222 in the application GUI, it means that Windows Defender is using unnecessary CPU cycles to take control of the counter. Here is a screenshot I took that highlights the status.

Counter control

Click the Reset Counters button in the app and the code will change to 0x330 indicating everything is normal. That’s it.

Fixed Windows Defender performance with Counter Control

Do I have to run Counter Control every time I start my computer? Yes, you will need to run it and click Reset Counters when your PC restarts. This is necessary because Windows Defender starts using the counters randomly.

Windows Defender Boost ThrottleStop 9.5

Alternatively, you can use ThrottleStop 9.5 to fix the performance issue. The latest update to the popular Undervolting app introduces a new feature called Windows Defender Boost. Enable this option and run the application when you start the computer. It’s basically the same as using Counter Control, but if you’re already using ThrottleStop to underpower your laptop, it saves you an extra click.


Windows Defender would affect the performance of Intel processors

Article name

Windows Defender would affect the performance of Intel processors

The description

Windows Defender can affect the performance of Intel processors. Here’s how you can fix it.




Ghacks Technology News