Free antivirus for Windows 10? Defender Issue...

[andyoxon]

Getting fed up with Windoze Defender gobbling large and constant chunks of CPU activity, so that the fan is on constantly.

Any recommendations for free AntiVirus software?    https://uk.pcmag.com/antivirus/120817/the-best-free-antivirus-protection

Wondering about Sophos free.  Have had Avast a few years ago, but became less than impressed with it's constant marketing of subscription features.

[rusky]

Have a look at Eset &  bitdefender

[De Sisti]

360 Total Security.

[Canardly]

Malwarebytes

[DaveJ]

The free version of Malwarebytes doesn't have any real time protection, so its more a tool for cleaning up (other) computers after they've been infected, than protecting a working machine. 

[DaveReading]

Getting fed up with Windoze Defender gobbling large and constant chunks of CPU activity, so that the fan is on constantly.

Are you sure  it's Defender that's responsible ?

[Davef]

AVG free

[Polar Bear]

I was a fan of both AVG and Avast for many years but both have their nagging built in now and neither performs especially well against the opposition when you check out the reviews.

Recently I have allowed Windows Defender to donit's best and again, I have suffered no issues.

I read a lot of decent reports about Kaspersky and Malwarebytes for paid protection.  I think that I'd go Malwarebytes if I was paying because it's what Carey Holzman, a pc tech on YouTube seems to prefer.  Serving private and business clients as he does, he needs to be able to rely on what he recommends given that he is going to have to clean up the mess in many cases afterwards.

[andyoxon]

Getting fed up with Windoze Defender gobbling large and constant chunks of CPU activity, so that the fan is on constantly.

Are you sure  it's Defender that's responsible ?

Not sure, apart from Antimalware Service Executable is constantly top of CPU usage list chewing through 25-35%.   I system restored to remove last two updates, but made no diffs.

[Afasoas]

It will only be chewing through that much CPU when there is:

(a) heavy I/O utilisation (have you got an SSD in this machine, have you benchmarked it lately?)
(b) a lot of read from/write to disk - for example larged download taking place or dropbox/nextcloud/onedrive etc. synchronising

N.B. it is usually symptom rather than cause. Defender is actually pretty quick and efficient so when you fall into this situation, it is usually a symptom of something else wrong.

[andyoxon]

Thanks.  Yep, it's a SSD, boot time is very quick (according to Glary).  How do I benchmark it?  I've only been aware of fan on quite recently.  System restore took about 2hrs!

[Cudzoziemiec]

Pfizer or AstraZeneca?


coat!

[Afasoas]

Thanks.  Yep, it's a SSD, boot time is very quick (according to Glary).  How do I benchmark it?  I've only been aware of fan on quite recently.  System restore took about 2hrs!

I tend to use CrystalDiskMark for benchmarking an SSD.

If you do task manager -> more details and on the processes tab look at the disk column, is the utilisation anything more than 5-10% for any length of time? If so, you can click into the performance tab, click 'open resource monitor' at the bottom and in resource monitor open the Disk tab. Look for the processes other than the antimalware service executable consuming disk I/O.

[DaveReading]

Thanks.  Yep, it's a SSD, boot time is very quick (according to Glary).  How do I benchmark it?  I've only been aware of fan on quite recently.  System restore took about 2hrs!

I tend to use CrystalDiskMark for benchmarking an SSD.

If you do task manager -> more details and on the processes tab look at the disk column, is the utilisation anything more than 5-10% for any length of time? If so, you can click into the performance tab, click 'open resource monitor' at the bottom and in resource monitor open the Disk tab. Look for the processes other than the antimalware service executable consuming disk I/O.

Resource Monitor can also be started with PerfMon /res via Windows+R, or from the command line.

[andyoxon]

With CPU on 50%, Antimalware S Exec 25%, Disk is 1% (ASE 0Mbps)  Power usage very high.

I turned off Defender antivirus & threat - rebooted, made no difference.

[Polar Bear]

Perhaps Antimalware is in fact malware then.

[Afasoas]

With CPU on 50%, Antimalware S Exec 25%, Disk is 1% (ASE 0Mbps)  Power usage very high.

I turned off Defender antivirus & threat - rebooted, made no difference.

There's definitely something wrong there. Difficult to diagnose remotely.
What process is reading from/writing to disk?

It might be worth have a trawl though the system and application event logs in eventvwr.

[FifeingEejit]

A quick look in my task manager

Antimalware service executable
|- Microsoft Defender Antivirus service

using 0.1% of CPU
230MB of memory
No disk, no network,

A right click shows that the exe is MsMpEng and lives in C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2101.9-0
It's also a signed executable
Signer is Microsoft Windows publisher and timestamped 5th Feb

Worth comparing.

[andyoxon]

Mine is same version & timestamp.  Location in Defender directory.  Currently fluctuating on CPU:15-30%, memory:~430MB: , disk:0MB/s, power:very high 

On task manager details MsMpEng.exe CPU 07 and "system idle process" CPU 60

[Afasoas]

Mine is same version & timestamp.  Location in Defender directory.  Currently fluctuating on CPU:15-30%, memory:~430MB: , disk:0MB/s, power:very high 

On task manager details MsMpEng.exe CPU 07 and "system idle process" CPU 60

If those are percentages, what is using the other 33% CPU utilisation?

[andyoxon]

Mine is same version & timestamp.  Location in Defender directory.  Currently fluctuating on CPU:15-30%, memory:~430MB: , disk:0MB/s, power:very high 

On task manager details MsMpEng.exe CPU 07 and "system idle process" CPU 60

If those are percentages, what is using the other 33% CPU utilisation?

System stuff by the looks of it.

On eventviewer TruecolorALS has come up with 49500 events since 8pm!  Otherwise a mix of stuff which doesn't mean much to me e.g. distributed COM
How do I look at the process r/w the disk?

on resource monitor NT Kernel & systems is on nearly 200 'threads'

[andyoxon]

May be worth undoing the system restore & then rolling back to the earlier point at time of major update... ?  Have a Windows Module Install on 19/2 rest pt, & automatic rest pt for 11/2

edit noticed I have ~70Gb left on the ~1TB SSD

[Afasoas]

May be worth undoing the system restore & then rolling back to the earlier point at time of major update... ?  Have a Windows Module Install on 19/2 rest pt, & automatic rest pt for 11/2

Resource monitor (discussed above) should give some insight into disk activity. I've seen situations with AV products that cloud storage products where by:

Cloud product syncs thousands of stub files to the device
AV scans stub files
Because cloud product thinks a process wants the full file (because AV has 'read' the stubfile) cloud product downloads the full file
AV scans full file

.... machine consequently bottlenecked for hours/days and happily filling up the disk.


Maybe a clean reinstall is the quickest path to resolution.
If you can wait until sometime next week, I could probably take a look via Microsoft Quick Assist.

[andyoxon]

Thanks.  I restored to 11 Feb (pre a number of updates) and all seems OK now.  Currently Defender Antimalware Service Executable on 0% CPU and 170MB memory.  Total CPU on 3-5%.  I created a new restore point, and paused updates for a week.  Dell Support Assist had already installed some updates post-restore, so these don't seem to be the issue.
ETA - though I guess Dell updates potentially could have a conflict with paused MS updates...
ETA.  +1 week.  Fan noise back + defender upto 30% CPU. Possibly WD updates themselves not the issue.   Dell did update recently.  Rolled back 3 days.  Fan quiet again.   Paused updates again & uninstalled Dell updates (auto)/assist. 

[andyoxon]

Solution (hopefully).  Looks like the Antimalware Service Executable - MsMpEng.exe constant running was caused by some incompatibility between recent MS updates & TrueColourALS (continual errors in eventviewer).  I uninstalled TrueColor, and high % CPU / fan noise seem back to normal now.