This has been driving me up the wall for some time, but I think I may have finally caught (one of) the instigator(s) in the act.
Solutions already tried with no effect:
- I have run chkdsk
- I do not have KB2976978 installed
- I have disabled superfetch
- Upgrading to Windows 8.1
- Upgrading to Windows 10
Occasionally my Windows desktop (previously 8, then 8.1, now running 10) would suffer bouts of near unusability. Investigation would lead to Windows Defender MsMpEng.exe being reported as the cause of 100% disk active time in Resource Monitor. Presumably this resulted in an extremely unresponsive system because the system had to compete for I/O to read the page file. Looking at the disk activity details in Resource Monitor I see MsMpEng.exe reading what looked like every file on the system over the course of 5-10 minutes. There was no scan running in Defender that would explain such behavior. Disabling active protection stops the reads, but doing so isn't a viable solution in my mind.
Operating under the assumption that Defender must be responding to apparent changes in the file system (since the active protection feature presumably reads every file as its created or edited) I've been running SysInternals Process Monitor during these slowdowns to see if I could catch whatever was triggering Defender, and I think I got lucky this time.
This is a subset of events captured by process monitor during a run where I also saw the Autodesk directory in the disk activity section of Resource Monitor. We see that rundll32.exe is calling CreateFile on an existing file, and then Defender comes in and reads the same file (into the page file no less if my understanding of CreateFileMapping is correct). Inspecting the stack for the rundll32.exe's call to CreateFile we see the following
invagent.dll/aeinv.dll appear to be the root cause here, but what I could find about disabling them was to uninstall KB2976978, which my system does not have.
What's my next step to try to fix this?
