Antimalware Service Executable Slowing Down My PC

[eWizard]

Has anyone seen a spike in resource usage from Antimalware Service Executable lately? It takes over 5 seconds to open apps from a cold boot and takes a hefty chunk of my CPU's power when I first boot and it has been like this since the last update. I've never had any malware on my PC, so I'm unsure why I now have to wait 5 seconds+ for ASE to check every single file, folder, and app I open when this was not the case before. Does this have anything to do with Windows trying to protect against malware like Spectre? On that same note, I have a Ryzen 5 1600, could there be a bug that's causing these issues?

[SImoHayha]

Probably turn off anti-malware and use as needed. Honestly most anti-malware takes or eats up CPU to scan and stuff like that. assuming you're using windows 10 go to task manager and start up and turn off the anti malware at start up. All this will do is prevent the anti malware from booting when you login to windows for the 1st time but you can turn it on afterward.

7 minutes ago, eWizard said:

snip?

 

[eWizard]

3 minutes ago, Ramamataz said:

Probably turn off anti-malware and use as needed. Honestly most anti-malware takes or eats up CPU to scan and stuff like that. assuming you're using windows 10 go to task manager and start up and turn off the anti malware at start up. All this will do is prevent the anti malware from booting when you login to windows for the 1st time but you can turn it on afterward.

 

Yeah that's definitely an option but it's one of my last resorts. Like, I'd probably be fine but still. How do you run your anti-malware?

[wONKEyeYEs]

9 minutes ago, eWizard said:

ASE

Seems like an ongoing problem.

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning/antimalware-service-executable-and-excessive-cpu/370c594a-06af-4ece-af1d-ae4663f6211a

 

Switch to MWB, paid version.

https://www.malwarebytes.com/

[eWizard]

2 minutes ago, wONKEyeYEs said:

Seems like an ongoing problem.

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning/antimalware-service-executable-and-excessive-cpu/370c594a-06af-4ece-af1d-ae4663f6211a

 

Switch to MWB, paid version.

https://www.malwarebytes.com/

From 2016? That doesn't seem promising. MWB is another option, but again, last resort. Thanks, though!

[2FA]

If you have a very slow hard drive, then yeah it will slow it down. It's not an issue with the software so much as it is being poor hardware.

[Tabs]

@eWizard

 

If you have any kind of SSD it shouldn't be an issue whatsoever. If you have a hard drive, it will be an issue, in which case you could exclude folders you are experiencing problems with. Of note that MSE is one of the least resource intensive antimalware solutions (because it's very un-invasive), so you're likely to experience an issue like this with any antimalware application you run.

 

If this has become an issue recently, I would check for any recently installed software. You could use a utility like VMMap from Microsoft SysInternals to see if there's anything unusual being loaded into every process; the on-access scanner will scan every module being loaded into a running process, so if there are any large or complex modules being loaded into each process, they could take a while to scan.

 

 

[eWizard]

1 hour ago, 2FA said:

If you have a very slow hard drive, then yeah it will slow it down. It's not an issue with the software so much as it is being poor hardware.

I've got an 860 EVO. I'm good.

[Tabs]

1 minute ago, eWizard said:

I've got an 860 EVO. I'm good.

In this case, you shouldn't be experiencing any slowdown with Windows Defender. Did you have a chance to use VMMap to check the loaded modules in your problematic processes?

 

Alternatively, you can use Procmon from Sysinternals, filter by the program you're opening and see if there's any particular part of the execution that's taking longer than expected.

[eWizard]

1 hour ago, Tabs said:

@eWizard

 

If you have any kind of SSD it shouldn't be an issue whatsoever. If you have a hard drive, it will be an issue, in which case you could exclude folders you are experiencing problems with. Of note that MSE is one of the least resource intensive antimalware solutions (because it's very un-invasive), so you're likely to experience an issue like this with any antimalware application you run.

 

If this has become an issue recently, I would check for any recently installed software. You could use a utility like VMMap from Microsoft SysInternals to see if there's anything unusual being loaded into every process; the on-access scanner will scan every module being loaded into a running process, so if there are any large or complex modules being loaded into each process, they could take a while to scan.

 

 

The only recent install has been the July update. I'll check VMMap. 

[eWizard]

13 minutes ago, Tabs said:

In this case, you shouldn't be experiencing any slowdown with Windows Defender. Did you have a chance to use VMMap to check the loaded modules in your problematic processes?

 

Alternatively, you can use Procmon from Sysinternals, filter by the program you're opening and see if there's any particular part of the execution that's taking longer than expected.

I just ran VMMap and scanned MSASCuiL.exe, it has 93,024 K in VRAM and 9,660 K in physical. I'll keep an eye on that for a few days and post again if I find anything. Thanks!

[Tabs]

13 minutes ago, eWizard said:

I just ran VMMap and scanned MSASCuiL.exe, it has 93,024 K in VRAM and 9,660 K in physical. I'll keep an eye on that for a few days and post again if I find anything. Thanks!

With VMMap, you'll want to check the actual processes you're having launch issues with, not the windows antimalware service executable. The delay is in the program you're launching, regardless of where it's caused; if you find an operation (for example, access of a specific file/folder/registry key) that takes longer than it should, then it means that object is taking a long time to scan and is worthwhile excluding from MSE (or  removing, if possible).

 

Procmon, with a filter on both the antimalware service executable and the program you're launching, can give you an accurate timeline of system access from program launch to close; using this, you can sort by the longest running time per object and see where the delays are being caused.

 

Additionally, MSASCuiL.exe is just the UI component of the Windows antimalware service; it doesn't do any of the scanning. You'll wish to examine MsMPEng.exe (Microsoft malware protection engine executable) since that's the process that actually does the scanning. If you're having specific problems with MSASCuiL.exe using a lot of resources then it means something to do with the user interface is causing delays, in which case you can simply turn the UI off. That doesn't disable protection, and you can still check status manually using the Settings panel. You'll still get relevant notifications and still have all your normal level of protection without MSASCuiL.exe running.

[eWizard]

8 minutes ago, Tabs said:

With VMMap, you'll want to check the actual processes you're having launch issues with, not the windows antimalware service executable. The delay is in the program you're launching, regardless of where it's caused; if you find an operation (for example, access of a specific file/folder/registry key) that takes longer than it should, then it means that object is taking a long time to scan and is worthwhile excluding from MSE (or  removing, if possible).

 

Procmon, with a filter on both the antimalware service executable and the program you're launching, can give you an accurate timeline of system access from program launch to close; using this, you can sort by the longest running time per object and see where the delays are being caused.

 

Additionally, MSASCuiL.exe is just the UI component of the Windows antimalware service; it doesn't do any of the scanning. You'll wish to examine MsMPEng.exe (Microsoft malware protection engine executable) since that's the process that actually does the scanning. If you're having specific problems with MSASCuiL.exe using a lot of resources then it means something to do with the user interface is causing delays, in which case you can simply turn the UI off. That doesn't disable protection, and you can still check status manually using the Settings panel. You'll still get relevant notifications and still have all your normal level of protection without MSASCuiL.exe running.

Oh, gotcha, I'll check everything I launch instead. And I'll check out MsMPEng.exe when I get back to my PC. Thanks for letting me know the other process was just the UI! I'll also check out ProcMon. Thanks!