Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. The Lounge
  3. What's the current status of free anti-virus tools

What's the current status of free anti-virus tools

Scheduled Pinned Locked Moved The Lounge
windows-admintoolshelpquestionannouncement
30 Posts 8 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D Offline
    D Offline
    Dan Neely
    wrote on last edited by
    #1

    On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

    Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

    L G D P O 8 Replies Last reply
    0
    • D Dan Neely

      On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

      Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

      L Offline
      L Offline
      Lost User
      wrote on last edited by
      #2

      so you are seriously going to let it hammer your CPU (and disk?) untill an update comes out that maybe will help (and maybe it wont)? If it doesn't, wat then? wait another month? any proper OS would let you take control, that's just sick. roof before your own eyes 10 sucks, and each update it's getting worse and more bloated (contrary to ms' very promise that would never happen).

      This internet thing is amazing! Letting people use it: worst idea ever!

      D 1 Reply Last reply
      0
      • L Lost User

        so you are seriously going to let it hammer your CPU (and disk?) untill an update comes out that maybe will help (and maybe it wont)? If it doesn't, wat then? wait another month? any proper OS would let you take control, that's just sick. roof before your own eyes 10 sucks, and each update it's getting worse and more bloated (contrary to ms' very promise that would never happen).

        This internet thing is amazing! Letting people use it: worst idea ever!

        D Offline
        D Offline
        Dan Neely
        wrote on last edited by
        #3

        no. I'm looking for a replacement to use until it gets fixed. But since I'm hoping a newer version will fix it, I'd prefer to use a free AV in the interim rather than pay for something that I only need for a few weeks.

        Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

        L 1 Reply Last reply
        0
        • D Dan Neely

          On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

          Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

          L Offline
          L Offline
          Lost User
          wrote on last edited by
          #4

          Dan Neely wrote:

          On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7.

          I'd recommend sticking with Windows Defender. Open powershell and do:

          Get-MpComputerStatus

          If it's in the middle of a full scan you might want to make sure that network drives are not being scanned. (Unless you want this) Also, you should check if you have sample submission enabled. If the something was found on the machine it may be gathering samples for automatic submission.

          Get-MpPreference | findstr Samples

          The Defender cmdlet is documented here if you want to mess around with the settings. [Set-MpPreference](https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps) Best Wishes, -David Delaune

          D 2 Replies Last reply
          0
          • D Dan Neely

            no. I'm looking for a replacement to use until it gets fixed. But since I'm hoping a newer version will fix it, I'd prefer to use a free AV in the interim rather than pay for something that I only need for a few weeks.

            Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

            L Offline
            L Offline
            Lost User
            wrote on last edited by
            #5

            I'd be wary of many of the most popular "free" av software, they too often leave something behind even when "fully removed." If it still works in 10 I'd start with one of the popular old versions of mbam - 1.75. There's instructions on the web how stop it updating to latest program version while still getting the latest virus definitions (and how to avoid 'extras' installing) - set it as run on demand only leaving defender as the primary auto-scanner, after all [normally] defender 'aint bad on 10.

            This internet thing is amazing! Letting people use it: worst idea ever!

            1 Reply Last reply
            0
            • D Dan Neely

              On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

              Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

              G Offline
              G Offline
              glennPattonWork3
              wrote on last edited by
              #6

              I did use AVG but it lost a couple of features I liked & kinda turned into spyware wanting to upload your Docs folder to the web...went to Windows Defender and never had an issue.

              1 Reply Last reply
              0
              • L Lost User

                Dan Neely wrote:

                On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7.

                I'd recommend sticking with Windows Defender. Open powershell and do:

                Get-MpComputerStatus

                If it's in the middle of a full scan you might want to make sure that network drives are not being scanned. (Unless you want this) Also, you should check if you have sample submission enabled. If the something was found on the machine it may be gathering samples for automatic submission.

                Get-MpPreference | findstr Samples

                The Defender cmdlet is documented here if you want to mess around with the settings. [Set-MpPreference](https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps) Best Wishes, -David Delaune

                D Offline
                D Offline
                Dan Neely
                wrote on last edited by
                #7

                Randor wrote:

                Also, you should check if you have sample submission enabled.

                As long as MS will silently upload anything it doesn't think contains sensitive information, that setting will remain off. There is no prompt before all uploads option, so it's staying off. I can try the PS command when I'm home, but all scheduled scans were disabled as part of my earlier troubleshooting, and since I tried running a full one manually I know it only takes 3-4 hours to complete the one/day that was schedulded shouldn't be pegging my system 24/7.

                Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                1 Reply Last reply
                0
                • D Dan Neely

                  On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

                  Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                  D Offline
                  D Offline
                  dandy72
                  wrote on last edited by
                  #8

                  On Windows 10: Open Resource Manager (see the bottom left corner of Task Manager's Performance tab), switch to Disk, sort by Image. Do you only have a few instances of msmpeng.exe, or dozens/hundreds? Each instance should show what file it's accessing. Are new instances being created/deleted all the time, or is the list pretty much static? This should at least give you an idea of WTE is keeping it so busy. (I'm assuming you're talking about the built-in Windows Defender...third-party AV tools might behave differently)...

                  L D 2 Replies Last reply
                  0
                  • D dandy72

                    On Windows 10: Open Resource Manager (see the bottom left corner of Task Manager's Performance tab), switch to Disk, sort by Image. Do you only have a few instances of msmpeng.exe, or dozens/hundreds? Each instance should show what file it's accessing. Are new instances being created/deleted all the time, or is the list pretty much static? This should at least give you an idea of WTE is keeping it so busy. (I'm assuming you're talking about the built-in Windows Defender...third-party AV tools might behave differently)...

                    L Offline
                    L Offline
                    Lost User
                    wrote on last edited by
                    #9

                    dandy72 wrote:

                    third-party AV tools might behave

                    leap of faith

                    This internet thing is amazing! Letting people use it: worst idea ever!

                    D 1 Reply Last reply
                    0
                    • L Lost User

                      dandy72 wrote:

                      third-party AV tools might behave

                      leap of faith

                      This internet thing is amazing! Letting people use it: worst idea ever!

                      D Offline
                      D Offline
                      dandy72
                      wrote on last edited by
                      #10

                      Don't twist my words by excluding a key part. :-) I actually wrote they "...might behave differently", not "might behave". Which, you're correct, would absolutely be a leap of faith. Especially as of late. These days I have no faith whatsoever in third-party AV software making anything better at all.

                      1 Reply Last reply
                      0
                      • D dandy72

                        On Windows 10: Open Resource Manager (see the bottom left corner of Task Manager's Performance tab), switch to Disk, sort by Image. Do you only have a few instances of msmpeng.exe, or dozens/hundreds? Each instance should show what file it's accessing. Are new instances being created/deleted all the time, or is the list pretty much static? This should at least give you an idea of WTE is keeping it so busy. (I'm assuming you're talking about the built-in Windows Defender...third-party AV tools might behave differently)...

                        D Offline
                        D Offline
                        Dan Neely
                        wrote on last edited by
                        #11

                        Just one process. I did notice something screwy comparing resmon with task manager. According to the resmon's bytes/sec counter, MsMpEng.exe was writing almost constantly and just doing reads in occasional smaller bursts, task manager shows exactly the opposite pattern. A torrent of reading (32GB in the last 24 hours since reboot) and an occasional burst of writing (320mb total since reboot). Other than that something screwy is going on - which I already knew - this isn't giving me any more of an idea WTE is wrong.

                        Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                        D 1 Reply Last reply
                        0
                        • L Lost User

                          Dan Neely wrote:

                          On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7.

                          I'd recommend sticking with Windows Defender. Open powershell and do:

                          Get-MpComputerStatus

                          If it's in the middle of a full scan you might want to make sure that network drives are not being scanned. (Unless you want this) Also, you should check if you have sample submission enabled. If the something was found on the machine it may be gathering samples for automatic submission.

                          Get-MpPreference | findstr Samples

                          The Defender cmdlet is documented here if you want to mess around with the settings. [Set-MpPreference](https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps) Best Wishes, -David Delaune

                          D Offline
                          D Offline
                          Dan Neely
                          wrote on last edited by
                          #12

                          Does anything here give you an idea what might be going on? Nothing is jumping out for me.

                          PS C:\Users\DanNeely> Get-MpComputerStatus

                          AMEngineVersion : 1.1.15100.1
                          AMProductVersion : 4.18.1807.18075
                          AMServiceEnabled : True
                          AMServiceVersion : 4.18.1807.18075
                          AntispywareEnabled : True
                          AntispywareSignatureAge : 0
                          AntispywareSignatureLastUpdated : 8/2/2018 4:08:51 PM
                          AntispywareSignatureVersion : 1.273.750.0
                          AntivirusEnabled : True
                          AntivirusSignatureAge : 0
                          AntivirusSignatureLastUpdated : 8/2/2018 4:08:52 PM
                          AntivirusSignatureVersion : 1.273.750.0
                          BehaviorMonitorEnabled : True
                          ComputerID : 4ACCDFA9-756F-4F63-ACFB-94D622CF17B5
                          ComputerState : 0
                          FullScanAge : 1
                          FullScanEndTime : 7/31/2018 11:42:45 PM
                          FullScanStartTime : 7/31/2018 6:56:34 PM
                          IoavProtectionEnabled : True
                          LastFullScanSource : 1
                          LastQuickScanSource : 2
                          NISEnabled : True
                          NISEngineVersion : 1.1.15100.1
                          NISSignatureAge : 0
                          NISSignatureLastUpdated : 8/2/2018 4:08:52 PM
                          NISSignatureVersion : 1.273.750.0
                          OnAccessProtectionEnabled : True
                          QuickScanAge : 1
                          QuickScanEndTime : 7/31/2018 10:51:25 PM
                          QuickScanStartTime : 7/31/2018 10:47:14 PM
                          RealTimeProtectionEnabled : True
                          RealTimeScanDirection : 0
                          PSComputerName :

                          PS C:\Users\DanNeely> Get-MpPreference | findstr Samples
                          SubmitSamplesConsent : 0
                          PS C:\Users\DanNeely>

                          Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                          L 1 Reply Last reply
                          0
                          • D Dan Neely

                            Just one process. I did notice something screwy comparing resmon with task manager. According to the resmon's bytes/sec counter, MsMpEng.exe was writing almost constantly and just doing reads in occasional smaller bursts, task manager shows exactly the opposite pattern. A torrent of reading (32GB in the last 24 hours since reboot) and an occasional burst of writing (320mb total since reboot). Other than that something screwy is going on - which I already knew - this isn't giving me any more of an idea WTE is wrong.

                            Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                            D Offline
                            D Offline
                            dandy72
                            wrote on last edited by
                            #13

                            Is it constantly writing to the same file? Anything unusual about said file?

                            D 1 Reply Last reply
                            0
                            • D dandy72

                              Is it constantly writing to the same file? Anything unusual about said file?

                              D Offline
                              D Offline
                              Dan Neely
                              wrote on last edited by
                              #14

                              The only thing it's hit continuously for the last 20 minutes has been the NTFS volume log, it's admitted to touching at least 4 other files during that time. OTOH the 2 sets of numbers in resmon don't add up and are much lower than the rate that task managers totals are updating. In the last 75m, according to that it's read 210GB and written 80MB. https://i.imgur.com/HuntFLY.png

                              Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                              D 1 Reply Last reply
                              0
                              • D Dan Neely

                                Does anything here give you an idea what might be going on? Nothing is jumping out for me.

                                PS C:\Users\DanNeely> Get-MpComputerStatus

                                AMEngineVersion : 1.1.15100.1
                                AMProductVersion : 4.18.1807.18075
                                AMServiceEnabled : True
                                AMServiceVersion : 4.18.1807.18075
                                AntispywareEnabled : True
                                AntispywareSignatureAge : 0
                                AntispywareSignatureLastUpdated : 8/2/2018 4:08:51 PM
                                AntispywareSignatureVersion : 1.273.750.0
                                AntivirusEnabled : True
                                AntivirusSignatureAge : 0
                                AntivirusSignatureLastUpdated : 8/2/2018 4:08:52 PM
                                AntivirusSignatureVersion : 1.273.750.0
                                BehaviorMonitorEnabled : True
                                ComputerID : 4ACCDFA9-756F-4F63-ACFB-94D622CF17B5
                                ComputerState : 0
                                FullScanAge : 1
                                FullScanEndTime : 7/31/2018 11:42:45 PM
                                FullScanStartTime : 7/31/2018 6:56:34 PM
                                IoavProtectionEnabled : True
                                LastFullScanSource : 1
                                LastQuickScanSource : 2
                                NISEnabled : True
                                NISEngineVersion : 1.1.15100.1
                                NISSignatureAge : 0
                                NISSignatureLastUpdated : 8/2/2018 4:08:52 PM
                                NISSignatureVersion : 1.273.750.0
                                OnAccessProtectionEnabled : True
                                QuickScanAge : 1
                                QuickScanEndTime : 7/31/2018 10:51:25 PM
                                QuickScanStartTime : 7/31/2018 10:47:14 PM
                                RealTimeProtectionEnabled : True
                                RealTimeScanDirection : 0
                                PSComputerName :

                                PS C:\Users\DanNeely> Get-MpPreference | findstr Samples
                                SubmitSamplesConsent : 0
                                PS C:\Users\DanNeely>

                                Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                L Offline
                                L Offline
                                Lost User
                                wrote on last edited by
                                #15

                                Hey, Is it still at high CPU usage? Actually it looks great. Looks like your full scans are taking ~5 hours to complete. I am surprised that you have NIS enabled. Is this a server or device exposed to the public? Could you do one more check? Check to see if Defender has detected any threats:

                                Get-MpThreatDetection

                                D 1 Reply Last reply
                                0
                                • L Lost User

                                  Hey, Is it still at high CPU usage? Actually it looks great. Looks like your full scans are taking ~5 hours to complete. I am surprised that you have NIS enabled. Is this a server or device exposed to the public? Could you do one more check? Check to see if Defender has detected any threats:

                                  Get-MpThreatDetection

                                  D Offline
                                  D Offline
                                  Dan Neely
                                  wrote on last edited by
                                  #16

                                  Randor wrote:

                                  Is it still at high CPU usage?

                                  Currently at a solid 1 core, down from as much as 2.5 cores within the last day.

                                  Randor wrote:

                                  Actually it looks great. Looks like your full scans are taking ~5 hours to complete. I am surprised that you have NIS enabled. Is this a server or device exposed to the public?

                                  This is my main personal desktop. I'd never heard of NIS before today, but after throwing it at google, have ran into a few articles claiming that other than briefly a half dozen years ago it's been a non-disablable part of MSE.

                                  Randor wrote:

                                  Could you do one more check? Check to see if Defender has detected any threats:

                                  I assume this is a negative:

                                  PS C:\Users\DanNeely> Get-MpThreatDetection
                                  PS C:\Users\DanNeely>

                                  Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                  L 1 Reply Last reply
                                  0
                                  • D Dan Neely

                                    Randor wrote:

                                    Is it still at high CPU usage?

                                    Currently at a solid 1 core, down from as much as 2.5 cores within the last day.

                                    Randor wrote:

                                    Actually it looks great. Looks like your full scans are taking ~5 hours to complete. I am surprised that you have NIS enabled. Is this a server or device exposed to the public?

                                    This is my main personal desktop. I'd never heard of NIS before today, but after throwing it at google, have ran into a few articles claiming that other than briefly a half dozen years ago it's been a non-disablable part of MSE.

                                    Randor wrote:

                                    Could you do one more check? Check to see if Defender has detected any threats:

                                    I assume this is a negative:

                                    PS C:\Users\DanNeely> Get-MpThreatDetection
                                    PS C:\Users\DanNeely>

                                    Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                    L Offline
                                    L Offline
                                    Lost User
                                    wrote on last edited by
                                    #17

                                    Dan Neely wrote:

                                    I assume this is a negative:

                                    Yes. OK, If you really want to explore deeper and have 30 minutes to investigate then do the following: 1.) Download [Microsoft Message Analyzer](https://www.microsoft.com/en-us/download/details.aspx?id=44226) 2.) Launch the program as Administrator and choose "New Session" 3.) Click the "Add Provider" button and add the Microsoft-Windows-Windows Defender ETW provider to the session. 4.) Choose an appropriate log level (Verbose is default) 4.) Click 'Start' You will get a *very* verbose log of what exactly Windows Defender is doing internally. You can use this to see if Windows Defender is repeatedly scanning the same file/files/folder. Unfortunately I don't think there is a public [OPN Parser](https://docs.microsoft.com/en-us/message-analyzer/managing-microsoft-opn-parser-packages) available for this provider. Best Wishes, -David Delaune

                                    D 1 Reply Last reply
                                    0
                                    • L Lost User

                                      Dan Neely wrote:

                                      I assume this is a negative:

                                      Yes. OK, If you really want to explore deeper and have 30 minutes to investigate then do the following: 1.) Download [Microsoft Message Analyzer](https://www.microsoft.com/en-us/download/details.aspx?id=44226) 2.) Launch the program as Administrator and choose "New Session" 3.) Click the "Add Provider" button and add the Microsoft-Windows-Windows Defender ETW provider to the session. 4.) Choose an appropriate log level (Verbose is default) 4.) Click 'Start' You will get a *very* verbose log of what exactly Windows Defender is doing internally. You can use this to see if Windows Defender is repeatedly scanning the same file/files/folder. Unfortunately I don't think there is a public [OPN Parser](https://docs.microsoft.com/en-us/message-analyzer/managing-microsoft-opn-parser-packages) available for this provider. Best Wishes, -David Delaune

                                      D Offline
                                      D Offline
                                      Dan Neely
                                      wrote on last edited by
                                      #18

                                      Well, i tried. Not sure if I got it set up correctly. It ran, but with a notice about errors/warnings while loading modules, and an error log that looked like it was having network problems. The collection was on the sparse side afterward. A few hundred items at startup, a hundredish over the next half hour, and then a few hundred more at shutdown. Looking at the entries in the middle, it looks like a list of running processes/services, I didn't notice any of the files resourcemon suggests it's constantly touching. This's probably as far as I can take it in the near term. I need a fully functioning system for tomorrow night, and will be booting MSE for something else in the morning.

                                      Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                      1 Reply Last reply
                                      0
                                      • D Dan Neely

                                        On one of my PC's MS's AV tool has gone retarded and is trying to hog ~2.5 cores 24/7. The suggested fixes available via google were useless. Everyone copy pasta'd the same list: 1) kill scheduled scans to see if one of them was running when you were trying to use the PC. nope. 2) whitelist the MSE executable itself. Because cargo cult??:confused: nope. 3) disable it via registry edit. Works, but has its own problem. :sigh: 4) buy the product of the company posting the copypasta (this one not seen on MS forums for some reason). For the moment I'm hoping that this months windows update will unfubar things and would prefer not to buy something unless this turns out to be a lingering problem...

                                        Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                        P Offline
                                        P Offline
                                        Peter Shaw
                                        wrote on last edited by
                                        #19

                                        I had this problem under Win7, solution was to just right click on the defender icon on the task bar, find the settings and turn off real time disk/memory scanning. It still kept a watch on what was in memory, and stopped threats getting in, but it wasn't constantly scanning the hard drive looking for threats. Not seen it re-occur since I moved to W10 tho.

                                        D 1 Reply Last reply
                                        0
                                        • P Peter Shaw

                                          I had this problem under Win7, solution was to just right click on the defender icon on the task bar, find the settings and turn off real time disk/memory scanning. It still kept a watch on what was in memory, and stopped threats getting in, but it wasn't constantly scanning the hard drive looking for threats. Not seen it re-occur since I moved to W10 tho.

                                          D Offline
                                          D Offline
                                          Dan Neely
                                          wrote on last edited by
                                          #20

                                          The current version doesn't let you permanently disable major components other than the upload to cloud for analysis stuff because lots of enterprise customers would also balk at that. As do I since the only 2 options when it's enabled are "silently upload anything of concern" and "only prompt for things MSE thinks might have sensitive information". There is no "prompt before all uploads" option. If the latter did exist I'd probably enable the feature, but I don't trust any Artificial Idiot to always get things right.

                                          Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason? Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful? --Zachris Topelius Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies. -- Sarah Hoyt

                                          P 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • World
                                          • Users
                                          • Groups