Windows Defender scan very slow.

Topic

New Reply

Good Afternoon All

I am new to this forum and also a computer beginner, so I hope I am in the right place.

I have a desktop PC and a Lenovo ThinkPad laptop both running Windows 10 Home 64bit both fully updated to v.1909.

Today I did Full Scans on both machines using Windows Defender.  Both came up clear of any issues but with very different times taken. Laptop way more than desktop.

Desktop was 48 minutes for 858,286 Files.                 Storage = 71.4 GB used  :  859 GB free.

Laptop was 2 hours 40 minutes for 1,374,500 Files.  Storage = 64.9 GB used  :  386 GB free.

The laptop was only upgraded to Windows 10 from Windows 7  in January 2020 and I was expecting a bit of a slow start with Defender whilst it was “learning” the new system on the laptop, but these scans (done every 2 weeks) have been getting progressively longer.

Please can anyone offer an explanation/solution to this?  Have I got some setting wrong somewhere or is it a ‘blip’ in the Defender programme?

Thanks for reading,

Regards,

Roy

Reply | Quote

Replies

“Laptop was 2 hours 40 minutes for 1,374,500 Files. Storage = 64.9 GB used : 386 GB free.”
— Did it report any threats?

I saw that once on a desktop I was working on that reported 0 threats and I never found out why it took so long.
— Afterward I ran Quick Scan and there weren’t any threats found.
— And in your case, comparing it to your desktop is a good idea.
— Maybe the desktop is a modern PC with “improved” specs, maybe with an SSD drive?

BTW, Windows Defender Quick scan is supposed to run daily automatically
— Does it do that?

HP EliteBook 8540w laptop Windows 10 Pro (x64)

Reply | Quote

daddybear wrote:

but these scans (done every 2 weeks) have been getting progressively longer.

It may be that you have other things running, or you have lots more files.

Check what else is running when you scan.  Right click on the Task Bar and select Task Manager. What other processes are using CPU and disk before the scan starts?

How many files are on the disk? Do you have a record?
Is the disk an HDD or SSD?
Try cleaning up the drive before a scan. In Explorer, right click on C: and select Properties > Disk Clean-up.

cheers, Paul

Reply | Quote

cmptrgy and Paul T.

Many thanks for your prompt replies – will reply to both together for ease.

No threats reported from scan.

Task Manager – Before scan just shows Task Manager and Windows Security.

– During scan shows AntiMalware Service Executable (Windows Defender)

CPU up to 100% at times : Mem 64%  :  Disk up to 100% at times.

Desktop is from June 2013  : i5-3470CPU  : 3.20 GHz  : 8.00 GB RAM

Laptop is from Sept 2016  : AMD A8-8600P : 10 cores 4C + 6G : 1.60GHz : 4.00 GB RAM

Don’t know if Defender is doing Auto Daily Quick scan. How would I check ?

Both Desktop and Laptop have HDD drives.

Files on disks are :- Desktop 291,369  and Laptop 298,835

Disk Clean-up shows 7.97 GB available ( 6.5 GB is Windows Update Clean-up). Haven’t done this yet – do you think it necessary?  Always do C Cleaner basic (not Registry Clean) before scans anyway.

One thing I did not mention – Laptop has Lenovo Recovery (Q) Drive showing in ‘My Computer’ window with size of 13.8 GB.  “Properties” show the drive as empty though !! Can it be involved in any slowness ?

Think that is all I can check for you – hope it means something, but it doesn’t to me !!

Regards,

Roy

 

Reply | Quote

I would check to make sure there is not another anti-virus or other security software installed.

Reply | Quote

Sometimes scans are just slow, particularly if you have a lot of large files like pictures. Neither of your scan times strikes me as particularly long given the number of files.

1 user thanked author for this post.

b

Reply | Quote

“Desktop is from June 2013 : i5-3470CPU : 3.20 GHz : 8.00 GB RAM
Laptop is from Sept 2016 : AMD A8-8600P : 10 cores 4C + 6G : 1.60GHz : 4.00 GB RAM
The desktop has double the CPU speed and double the RAM.
— Also what size HDD’s are there on each PC?

Those could be factors
“CPU up to 100% at times : Mem 64% : Disk up to 100% at times.”
— I imagine that pertains to your slower laptop?

“Laptop has Lenovo Recovery (Q) Drive showing in ‘My Computer’ window with size of 13.8 GB.
“Properties” show the drive as empty though !! Can it be involved in any slowness ?”
— I’m not sure about that yet.

“Disk Clean-up shows 7.97 GB available ( 6.5 GB is Windows Update Clean-up). Haven’t done this yet – do you think it necessary?”
— I do clean that up when I see that in order save as much disk space as possible.

“Don’t know if Defender is doing Auto Daily Quick scan. How would I check ?”
Click on the hidden icons on the taskbar right side.
Click on the Windows Defender icon. It should have a white arrow within a green background.
— If yours have different colors let us know.
The security at a glance dashboard will show up
Most entries should have the white arrow within a green background.
— If yours have different colors let us know.
Open virus and threat protection
— It will report information for it’s latest Quick scan
— It runs automatically every day for me but not at the same time everyday.

HP EliteBook 8540w laptop Windows 10 Pro (x64)

Reply | Quote

Thanks to all for replies.

Answers for cmptrgy.

HDD sizes  – Desktop  1 TB  7200 rpm.    Laptop  500 GB 5400 rpm.

100% CPU is for slower Laptop.

Desktop is CPU up to 38% :  Mem  43%  :  Disk  100% (during full scan)

— “I do clean that up when I see that in order save as much disk space as possible.”

The laptop has 386 GB free out of  451 GB so is it still necessary to clean up ?  Will the 7.97 GB cause such a huge slowdown on the scan ?

All Defender icons have white arrow on green.

Can’t see yet if Auto Daily Quick scans are being done.  Will post later about this.

Regards

Roy.

 

Reply | Quote

100% disk and CPU is unusual. Check your disk for problems with the disk manufacturers diags.

Make a backup first, as always.

cheers, Paul

Reply | Quote

Paul –

Please see reply above to cmptrgy for values of the desktop PC  for CPU, Mem and Disk compared to the Laptop.

How do I check for disk problems with “manufacturers diags” ?

Is a System Restore point OK for the backup ?

Regards

Roy.

Reply | Quote

Let’s go over “The laptop has 386 GB free out of 451 GB so is it still necessary to clean up ? Will the 7.97 GB cause such a huge slowdown on the scan ?” in your post #2251919.
I treat my PC’s like I treat my car, house etc.: keep them well maintained even if there isn’t an issue yet.
I deal with items like that as part of my monthly maintenance regimen.
— It’s not something I look for unless there’s an outstanding issue similar to your situation: I just let it be taken care of during my monthly maintenance regimen.
— At this point in time it may not be a major issue but don’t wait until eventually things get worse.
— You’ve only had your Windows 10 on this laptop since January 2020.
— Keep it well maintained while its easy to do.

On Windows Defender, I’m notified by Notifications every day when it has run.
— That can be adjusted or turned off I believe but I don’t have a problem with being notified as I make sure my security protection is well maintained similar to my monthly maintenance regimen.
— Plus with the PC’s I work on, too many of them are all of a sudden infected and I show those whom I help how to make sure their AV keeps their PC safe & secure regardless of which AV they use.

It shouldn’t be necessary to run Windows Defender Full Scan: let it run Quick Scan for the days/time your laptop is in use.
— As has been requested, do you have another anti-virus or other security software installed?

HP EliteBook 8540w laptop Windows 10 Pro (x64)

Reply | Quote

cmptrgy.

Many thanks for the additional advice – will do disk clean-up as you suggest.

I do a “Housekeeping” run every 2 weeks on both Desktop and Laptop.  This involves clearing browser records, C Cleaner run (not Registry), ‘on-demand ‘ scans with Malwarebytes and SuperAntiSpyware – both free versions with no real-time protection and which do not start with Windows – and then backups to external HDDs for disk and documents using Aomeii backupper.

These are not particularly related to Patch Tuesday but fall near enough to it anyway.

The Defender scan is alternated between Quick and Full every two weeks as part of this housekeeping rota.  This is where the discrepancy between the two machines has become apparent. Prior to updating Win 7 to Win 10 on the laptop I used Avira AV and the differences then were negligible.

Have seen very heavy CPU usage during scan of a process called MsMpEng.exe – do you think this could be involved in slowing down the scan?

Regards

Roy.

Reply | Quote

daddybear wrote:

Have seen very heavy CPU usage during scan of a process called MsMpEng.exe – do you think this could be involved in slowing down the scan?

That is the Defender scan program (Microsoft Malware Protection Engine).

Windows 11 Pro version 22H2 build 22621.2361 + Microsoft 365 + Edge

Reply | Quote

[cmptrgy]

That’s great daddybear that you want to stay on top of how your PC’s run.
— I remember doing a “housekeeping” procedure on a weekly basis once upon a time, moved up to bi-weekly and became confident in going with a monthly schedule.

On your Windows Defender Quick and Full scans every two weeks, may I recommend allowing Windows Defender to run automatically on a daily basis and replace the full scan with Windows Defender Offline scan only once a month?
— I don’t think it makes sense to run the full scan as it takes as long as 2 hours 40 minutes.
— Your Windows Defender dashboard looks fine.

You could still troubleshoot the full scan concerns you have brought up
— The factors on that are there are twice as many files compared to your desktop PC but after researching that myself recently that doesn’t seem unusual for whatever reason.
— BTW I don’t think this has been asked about: do you use more “intensive” apps, games or demanding items that take up system resources on the laptop?
Now onto the speed: the 500 GB 5400 rpm HDD is a factor vs. the 1 TB 7200 rpm HDD.
— Would you consider an SSD or a 7200 rpm HDD?

On the “Have seen very heavy CPU usage during scan of a process called MsMpEng.exe – do you think this could be involved in slowing down the scan?”
b has explained what that is.
I don’t believe it’s a cause of slowing down the scan but it’s a result of the factors that have been mentioned.

I’d like to get back to “BTW I don’t think this has been asked about: do you more “intensive” apps, games or demanding items that take up system resources on the laptop?” relative to system resources.

Use Windows PowerShell (Admin) or Command Prompt (Run as administrator)
Run SFC /SCANNOW and see if it reports “Windows Resource Protection did not find any integrity violations”.
— If it does, you won’t have to go any further but please let us know.
— If that is what happens, restart the laptop.
— I don’t know if that’s necessary to do but that is what I do anyway.
It might report “Windows Resource Protection found corrupt files and successfully repaired them.”
— After that restart the laptop.
— I don’t know if that’s necessary to do but that is what I do anyway.
— Please let us know.
— On the next day or 2nd day run SFC /SCANNOW again to ensure finding corrupt files and successfully repairing them doesn’t return because more actions will then have to be implemented.
— After that restart the laptop.
— I don’t know if that’s necessary to do but that is what I do anyway.
— Please let us know.

Then there’s running “Dism /Online /Cleanup-Image /Restorehealth” w/o the quotes if applicable.
Applicable meaning if SFC /SCANNOW doesn’t report “Windows Resource Protection did not find any integrity violations” or if “Windows Resource Protection found corrupt files and successfully repaired them.”, does return it’s time to run “Dism /Online /Cleanup-Image /Restorehealth”.
— It takes a while to run and at the end you will need to wait until you see
DISM /Online /Cleanup-Image /CheckHealth operation completed successfully.
When you reach [===100.0%===], wait a little longer to see the final reported result.
I don’t remember the exact wording of the final result as I haven’t had to use it in quite a while but wait it out and let us know the result.
Then restart the laptop.

I can’t predict how it will go for you but I do suspect that SFC /SCANNOW will not report “Windows Resource Protection did not find any integrity violations” the first time as I’ve seen that so many times. I could be wrong but I just want to bring up the reality of what you might see. I have seen people get “upset” about that but I let them know it isn’t their fault and at that point let’s hope it’s applicable to sharpen their system resources somewhat or something like that.
Good luck.

HP EliteBook 8540w laptop Windows 10 Pro (x64)

• This reply was modified 3 years, 5 months ago by cmptrgy.

Reply | Quote

cmptrgy – have done all the checks you suggested but first to answer your questions:-

“do you use more “intensive” apps, games” – no, never.

“Would you consider an SSD or a 7200 rpm HDD?” – no, the laptop is mainly used by my wife for basic computing eg; e-mails, e bay, online shopping and recently Skype (because of the UK lockdown). She is very happy with the speed in all respects other than the Win Defender scan.

SFC /SCANNOW :-

1st Day – said “Windows Resource Protection found corrupt files and successfully repaired them”  (tried to attach CBS Log File to this post but forum won’t allow me)

Restarted Laptop.

2nd Day – said “Windows Resource Protection did not find any integrity violations”

Restarted Laptop.

On future procedures I am very interested in your recommendation of :-

“allowing Windows Defender to run automatically on a daily basis and replace the full scan with Windows Defender Offline scan only once a month?”

Two points on this – 1) how do I set up Defender to run a Quick Scan on a daily basis and 2) where do I find the results of the Offline Scan ?

I am sorry to take up so much of your time but please can I ask a couple more questions related to this topic which have cropped up from looking round Google etc.

1) We temporarily disabled Real Time Protection on Defender and then ran a full scan. It completed in 1 hour 20 mins less than before – is this a safe thing to do?

2) I have read that adding MsMpEng.exe to the Defender exclusions will effectively stop it scanning itself – do you think this would reduce the number of files involved in the scan and thus reduce the CPU load down from 100% – is it safe and is it worth a try?

Still keen to use your Offline suggestion for routine but just wondered about further troubleshooting the full scan in case of future need.

Think that is all for now.  Thank you so much for being so patient with me – I really do appreciate your help and support.

Regards,

Roy.

Reply | Quote

daddybear wrote:

Is a System Restore point OK for the backup ?

Restore Point is not a backup.
You need software and a USB hard disk for a backup.

cheers, Paul

3 users thanked author for this post.

fisher75, cmptrgy, Elly

Reply | Quote

Let’s cover Windows Defender Quick Scan vs. Full scan.
I’m not an expert on how to explain this but in summary a Quick Scan inspects the likely areas to be infected.
— Most AV perform the same way by default.
A full scan does a complete scan off everything in the PC.
— It isn’t unusual to see as many files as you see and as long as it takes.
— I’ve just run a full scan on a PC and had similar results.
— I’d say It isn’t a matter of how slow the PC runs, it’s a matter of how long it takes to do a job that it’s called to do.
— If your PC were slow in everything else, then that’s when a slow PC needs to be addressed.
— I would leave your laptop as-is.
Check Quick Scan Vs Full Scan in Antivirus Programs
https://antivirusinsider.com/quick-scan-vs-full-scan/

On “1) We temporarily disabled Real Time Protection on Defender and then ran a full scan. It completed in 1 hour 20 mins less than before – is this a safe thing to do?
2) I have read that adding MsMpEng.exe to the Defender exclusions will effectively stop it scanning itself – do you think this would reduce the number of files involved in the scan and thus reduce the CPU load down from 100% – is it safe and is it worth a try?” in your post ##2252300.
— Don’t do that: it defeats the purpose of the Full scan and I believe it isn’t safe to do.

On Windows Defender daily scan, since your WD dashboard looks fine and since you are able to disable and most likely follow up enabled it, your Windows Defender is running fine. I believe I have read there are times that disabling Windows Defender in certain circumstances has been recommended but I haven’t had to do so and don’t recommend it w/o asking about it in one of AskWoody’s forum if a recommendation comes up to do that.

On “1) how do I set up Defender to run a Quick Scan on a daily basis”
— I believe it is doing that: What I suspect is the laptop isn’t reporting when WD is run in the notification area.
— Some people don’t want to be bothered by it: myself I don’t mind.

If you want to see those notifications, these are the settings on my laptop
Windows Defender dashboard > Virus and threat protection > Virus and threat protection settings > Manage settings > scroll down to Notifications > Change notification settings > next page shows Virus and threat protection notifications > my get informational notifications is On along with a few more items checked.

“where do I find the results of the Offline Scan?”
— You should find that in WD dashboard.: you might even to receive an up-front notification.
— I don’t recall exactly where as it’s been a long time since I’ve had to know that.

On SFC /SCANNOW, on the first day, you got “Windows Resource Protection found corrupt files and successfully repaired them”
— I suspected that AS at this point that isn’t unusual.
— On (tried to attach CBS Log File to this post but forum won’t allow me). That’s ok, that’s fine actually.
On the 2nd day, your “Windows Resource Protection did not find any integrity violations”
— Excellent.

HP EliteBook 8540w laptop Windows 10 Pro (x64)

2 users thanked author for this post.

fisher75, Elly

Reply | Quote

Very sorry for the delay in replying – my e-mail alert didn’t work this time although it has been OK so far during our conversations.

Anyway, I am here now so thanks for all your thoughts and info.

I will follow all your suggestions to set up a new regime which will suit us better re. scanning.

I will have to look into your instructions about checking notifications for Offline scan results and also daily notifications.  If you don’t hear from me (thank goodness I can hear you say !! ) you will know I have sorted it. If I am still stumped please can I come back to ask for more help ?

Regards and Best Wishes,

Roy.

Reply | Quote

We’re here 24/7/365 if you need help any time. 🙂

Reply | Quote