Question "Antimalware Service Executable" process immensely slows down the computer very often by using up to 70 % CPU

[Kletoss]

On each (even new) Win installation that "Antimalware Service Executable" process immensely slows down the computer very often by using up to 70 % CPU:

How could one avoid / stop that? What sense does that have? Why is this Win crap doing it all the time?

 

[Lafong]

What version and build number of Windows are you on?

Build number probably has 9 digits revealed by winver command.

 

[Kletoss]

This one:

 

[Lafong]

Coincidentally......that's the exact same version I have.

4 or 5 years ago, I had a similar problem to yours but cannot recall the resolution, other than it disappeared. Presumably due to an ordinary Windows Update that I get from time to time.

Just watching my own use of that process in Task Manager...my CPU usage ranges from 0 to 3%. Nearly always below .5%.

 

[Kletoss]

Coincidentally......that's the exact same version I have.

Is it really such a big coincidence as Win user generally should have the same versions because of the automatically installed updates?

Coincidentally......that's the exact same version I have.

But I have had it on each Win (10) version, if I remember it correctly. Not only with this one.

Presumably due to an ordinary Windows Update that I get from time to time.

So some update(or Win) simply causes a problem some other fixes the problem.

Just watching my own use of that process in Task Manager...my CPU usage ranges from 0 to 3%. Nearly always below .5%.

Yes, that seems to be a reasonable value.

 

[Lafong]

https://answers.microsoft.com/en-us...-service/b20c6fef-0ce1-4ad1-8874-f76c8a89523a

You might find something useful above.

I have not had the problem since 2018, but it apparently shows up occasionally for some people to this day.

 

[Kletoss]

OK. Many thanks for the link!

 

[HnVr]

I had the same problem starting on 29 SEP 2022 and passed two weeks of biggest frustration, could barely work and lost many hours trying to fix this.
My machine is a Lenovo Thinkpad X1 Gen9 with integrated WWAN device Quectel EM120R-GL.

I realized that after disabling Windows Defender real-time protection (Echtzeitschutz) in Settings, the Antimalware Service Executable MsMpEng.exe indeed stopped using that many CPU ressources, but the overall system load remained still quite high, at least much higher than normal idle state. Task Manager (and also Process Explorer from Sysinternals) did not show any individual process using all that CPU, but showed the total CPU at still around 20% (thus the sum of the processes did not add up to the overall CPU usage). That led to the conclusion that Defender CPU usage might be only the symptom of another problem.

In Windows Event Log (Ereignisanzeige) I found thousands of errors that read: Dienst "QService" wurde unerwartet beendet. Dies ist bereits 16927 Mal passiert. ("service ended prematurely"). QService is a Service installed by Quectel driver and (at least for me) located at "C:\Windows\Firmware\Quectel\Service". In that folder I found around 260.000 (!) dump files. Apparently, the service failed repeatedly (about once per second, I would say) and wrote a dump file to that directory. Windows Defender then scanned that dump file and therefore needed CPU ressources.
In addition, I don't wanna know how much that ruined my SSD with two weeks of constant writing. Indeed, I saw in Task Manager that something was permanently writing to storage, but I couldn't figure out what it was.

What I finally did:
Disabled QService
Disabled ModemAuthService (which apparently, after disabling QService, started to have some problems, it is also from Quectel).

C:\Windows\Firmware\Quectel>dir /O:D /P Service (in order to look at which date the first dump files were written and if it coincided with the problem appearing)
C:\Windows\Firmware\Quectel>del Service\*.dmp (in order to free up the dump file space)

I occasionally need the WWAN device, so I will have to figure out how to solve this issue completely and not only deactivating the Service. (Mabye reinstalling drivers, whatever.) But for now I am happy that at least now I can work again in peace.

One more note: During my research, I found out that restarting the service UserManager (Benutzer-Manager) would solve the issue for some minutes or sometimes even until restart. But some other things in Windows did not work anymore (even though it was restarted, not stopped). Never figured out how that was actually related to QService.

 

[Kletoss]

So it sounds like one individually had to find out what the symptoms are caused by as they might be caused by very different programs, services obviously, or whatever.