0

This has been driving me up the wall for some time, but I think I may have finally caught (one of) the instigator(s) in the act.

Solutions already tried with no effect:

Occasionally my Windows desktop (previously 8, then 8.1, now running 10) would suffer bouts of near unusability. Investigation would lead to Windows Defender MsMpEng.exe being reported as the cause of 100% disk active time in Resource Monitor. Presumably this resulted in an extremely unresponsive system because the system had to compete for I/O to read the page file. Looking at the disk activity details in Resource Monitor I see MsMpEng.exe reading what looked like every file on the system over the course of 5-10 minutes. There was no scan running in Defender that would explain such behavior. Disabling active protection stops the reads, but doing so isn't a viable solution in my mind.

Operating under the assumption that Defender must be responding to apparent changes in the file system (since the active protection feature presumably reads every file as its created or edited) I've been running SysInternals Process Monitor during these slowdowns to see if I could catch whatever was triggering Defender, and I think I got lucky this time.

A clue! A Clue!

This is a subset of events captured by process monitor during a run where I also saw the Autodesk directory in the disk activity section of Resource Monitor. We see that rundll32.exe is calling CreateFile on an existing file, and then Defender comes in and reads the same file (into the page file no less if my understanding of CreateFileMapping is correct). Inspecting the stack for the rundll32.exe's call to CreateFile we see the following

Stack Trace

invagent.dll/aeinv.dll appear to be the root cause here, but what I could find about disabling them was to uninstall KB2976978, which my system does not have.

What's my next step to try to fix this?

8
  • i would suspect you could , get into the task scheduler taskschd.msc /s and disable 2 things carefully and have some of the insanity stopped. The occasion for some of this is probably when the system is deemed idle, the updater ran out of the scheduler. Using the "autoruns" program instead might be a easier way to disable scheduled tasks , and save changes to compare to, re-enableing and testing easily. Disabling in task scehduler does not require a re-boot (unlike messing with the registry) , and it can be turned off and on or even time/delay adjusted to suit the user.
    – Psycogeek
    Aug 20 '15 at 17:48
  • Defender sucks, so use a different Av suite which is not that extremely slow. Aug 21 '15 at 4:24
  • @Moab I have double-checked for that hotfix using your suggestion and reconfirmed that that KB is not installed in my system.
    – Bjartr
    Aug 21 '15 at 14:43
  • @magicandre1981 The same problem occurs with any other AV that scans files when CreateFile is called, which so far is any that provides an active protection of some kind.
    – Bjartr
    Aug 24 '15 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.