Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
High CPU use by UtcSvc, Windows Driver Foundation (WUDFHost.exe), or Microsoft Defender does not by itself mean your PC is infected. These can be legitimate Windows components doing diagnostic, device-driver, or scanning work. First identify the exact process, its file location and signer, and what was happening when the CPU spike began. Then test the likely service, device, or scan without deleting system files or disabling security protections as a first resort.
In the case behind this topic, UtcSvc was reported using roughly 30–40% CPU, WUDFHost appeared intermittently, Defender scans had stopped or logged errors, and Memory integrity flagged ftdibus.sys. The available evidence did not establish a virus or other malware as the cause. The reported CPU symptom went away after Connected User Experiences and Telemetry was stopped and disabled, but that does not identify why the service was busy or prove that disabling it is the best permanent fix. The case discussion and its follow-up are useful examples, not a conclusive diagnosis.
What these processes do
| What you see | What it usually is | What to investigate |
|---|---|---|
UtcSvc or Connected User Experiences and Telemetry |
A Windows service associated with diagnostic and telemetry-related work. | Whether CPU use is a brief burst after startup, an update, or maintenance, or remains high while the PC is otherwise idle; whether a temporary stop changes it. |
WUDFHost.exe or Windows Driver Foundation |
A Windows host process for user-mode drivers. It can be active when a connected device’s driver is working. | Recently connected or updated hardware and its driver. Microsoft describes the UMDF driver host process and its role. |
MsMpEng.exe or Antimalware Service Executable |
Microsoft Defender Antivirus’ antimalware service. | Whether a scan, security-intelligence update, or inspection of many files is in progress. Defender can use substantial CPU during scheduled scans; see Microsoft’s scan troubleshooting guidance. |
A familiar name is not proof that a file is genuine: malware can imitate a Windows process name. Conversely, high CPU, an interrupted scan, a potentially unwanted modification detection, or an incompatible-driver warning is not by itself proof of infection. Judge the evidence together: process path, digital signer, timing, repeatability, security-tool results, and any unexpected persistence or system changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Identify the process before changing anything
- Restart Windows. Disconnect nonessential USB and Bluetooth devices, then let the PC settle without launching demanding apps. A spike immediately after boot, an update, or reconnecting a device may be temporary. Note whether it continues rather than relying on a universal idle-CPU threshold.
- Right-click Start and open Task Manager. On Processes, sort by CPU. If needed, open Details and look for
UtcSvc.exe,WUDFHost.exe, orMsMpEng.exe. - Right-click the relevant process and choose Open file location. In the file’s Properties, check Digital Signatures. A legitimate Windows component should be in an expected Windows location and have an appropriate Microsoft signature. A user-writable temporary or unrelated folder, missing or unexpected signer, or multiple oddly located copies warrants closer investigation.
- Record when the activity starts and stops. Note whether it follows a reboot, Windows Update, a Defender scan, or connection of a particular device. Check whether the same process is consistently responsible.
Do not end or delete WUDFHost.exe simply because it is busy: it hosts drivers, and terminating it does not repair the device or driver that may be causing the activity.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
If UtcSvc is using CPU
Connected User Experiences and Telemetry is a Windows service. Its activity may be related to diagnostics or telemetry; the name alone does not make it spyware, nor does it guarantee that every sustained CPU spike is harmless. A short-lived burst and persistent high use while idle deserve different responses.
To test whether the service is involved, without treating that as a root-cause fix:
- Press Windows + R, enter
services.msc, and press Enter. - Find Connected User Experiences and Telemetry. Record its current startup setting before making a change.
- Stop the service temporarily, then observe Task Manager. If CPU use drops, the service is involved in the symptom. That does not explain why it was busy: a stuck task, update, damaged component, or interaction with another subsystem may still be the underlying trigger.
- If useful, restart Windows and see whether the symptom returns. Restore the previous startup setting unless you have considered the effects: disabling the service changes diagnostic-data collection and may affect features that rely on related telemetry infrastructure.
A stop-and-restart test is more informative than immediately applying registry changes or permanently disabling telemetry. In the reported case, stopping and disabling the service coincided with the CPU problem going away, but the discussion did not establish a definitive cause or show that this is a universal remedy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
If Windows Driver Foundation (WUDFHost.exe) is using CPU
Think first about devices and driver changes, not malware. Possible investigation targets include a phone connected in MTP mode, USB hub or storage, printer, scanner, webcam, Bluetooth adapter, docking station, sensor, or specialty hardware. These are candidates to test, not proof that a particular device is responsible.
- Unplug nonessential devices one at a time, starting with the device most recently connected or updated. After each removal, wait and watch CPU. If it falls, reconnect devices individually to see whether the activity returns.
- Open Device Manager and inspect the implicated device. Try a driver from Windows Update or the computer or device manufacturer’s support site. If the problem began just after a driver update, the device’s Properties → Driver → Roll Back Driver option may be appropriate.
- Check Event Viewer → Windows Logs → System around the time the CPU spike began for repeated device-start, timeout, or driver-framework errors.
- For deeper device-installation troubleshooting, inspect
C:WindowsINFsetupapi.dev.log. Microsoft’s UMDF troubleshooting guidance explains the kinds of logs that help when a user-mode driver or device fails to load.
Prefer the PC maker or the actual hardware maker for drivers. A generic driver-updater utility can install the wrong or unnecessary package. Avoid removing a driver package unless you have identified which device owns it.
If Defender is using CPU or scans fail
MsMpEng.exe is normally associated with Defender’s Antimalware Service Executable. CPU use can rise during quick or full scans, security-intelligence updates, archive inspection, or scanning a large number of files—for example, in cloud-synced folders, mail stores, development trees, or virtual machines. A scan taking a long time does not prove infection. Repeatedly interrupted scans, inability to update, or real-time protection turning off unexpectedly do need attention.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
- Open Windows Security → Virus & threat protection. Review real-time protection, security-intelligence update status, Protection history, scan history, current threats, and whether another antivirus product is registered.
- Install pending Windows updates and update Defender’s security intelligence. Restart, then run a Quick scan.
- If the problem persists, run a Full scan while the PC is idle. Large or archive-heavy collections can take a long time; do not infer that a scan is frozen solely because it is taking longer than expected.
- If ordinary scans repeatedly fail or malware may be interfering, use Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan → Scan now. Labels can vary slightly across Windows releases. Save your work first: the PC restarts to run the offline scan. See Microsoft’s malware scan troubleshooting steps.
Multiple real-time security engines scanning at once can complicate diagnosis and add overhead. If Malwarebytes or another antivirus has real-time protection enabled, check how it interacts with Defender on that system. Do not simply turn Defender off unless another reputable, functioning antivirus is installed and registered; Microsoft’s Defender FAQ explains the risk of leaving a device without protection. An on-demand second-opinion scan is different from adding another always-on engine.
If Defender itself remains the top CPU user after scans and updates, Microsoft documents a Windows Performance Recorder/UI workflow and Defender performance analyzer for tracing AV performance issues: Troubleshoot antivirus performance issues with WPR and the performance analyzer.
What the ftdibus.sys Memory Integrity warning means
ftdibus.sys is associated with FTDI USB-to-serial hardware drivers. If it appears in Windows Security → Device security → Core isolation details → Incompatible drivers, Windows is reporting a compatibility problem with Memory integrity—not declaring the driver a virus. An older or vulnerable legitimate driver can fail the requirements for hardware-enforced code integrity.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
- Identify the physical device or software that installed the FTDI driver. Check the device label, Device Manager, and the computer or device manufacturer’s support information.
- Look for a compatible current driver through Windows Update or the device manufacturer. If the hardware or associated application is no longer used, remove it using normal Windows uninstall/device-removal methods.
- Restart and check the Core isolation page again. Microsoft’s guidance is to look for an updated driver or remove the device or app that installed the incompatible one; see “A driver can’t load on this device” and Device security in Windows Security.
Do not manually delete C:WindowsSystem32driversftdibus.sys. If you are comfortable with driver packages, pnputil /enum-drivers can inventory published drivers. Only after positively matching the package to the FTDI device should an administrator consider removing its exact published name, for example:
pnputil /delete-driver oem##.inf /uninstallReplace oem##.inf with the confirmed package name, not a guess. Removing the wrong package can disable hardware. Microsoft’s Q&A contains a community example for this driver; it is not a universal fix. Turning off Memory integrity may remove the warning, but reduces a security protection and is a fallback only when you understand and accept the trade-off.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When malware becomes more plausible
Escalate the malware investigation when several independent warning signs occur together, rather than relying on one CPU spike or scanner result:
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
- A Windows-like process runs from an abnormal path, lacks an expected signer, or appears in multiple unusual locations.
- Defender real-time protection repeatedly disables itself, security tools cannot update, or scans are terminated without an ordinary explanation.
- Unknown services, scheduled tasks, startup entries, browser extensions, administrator accounts, or persistence mechanisms appear.
- Proxy, browser, DNS, or network behavior changes unexpectedly.
- More than one reputable scanner identifies the same file or persistence mechanism.
A RogueKiller PUM.Proxy result, such as the one reported in this case, is a potentially unwanted modification detection. It can relate to proxy settings, browser configuration, policy changes, or unwanted software. It is not, by itself, proof of an active infection; inspect what setting was flagged and why it changed. A clean result from one scanner also does not certify that a system is clean.
If you need a second opinion, prefer reputable on-demand scanners and avoid running overlapping real-time products just to test CPU. Advanced users can use Microsoft’s free Sysinternals Autoruns to inspect startup locations, services, tasks, and drivers, but disabling an entry without identifying it can break Windows or an application. Do not apply random Farbar Recovery Scan Tool fix lists: fixes should be prepared for the specific machine by a qualified malware analyst.
Repair Windows components if problems continue
If Defender errors, service failures, or broader instability persist, Windows component or system-file corruption is one possibility. From Command Prompt (Run as administrator), run DISM first and then System File Checker:
DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannowAllow each command to finish, then restart. These commands repair Windows component or system-file problems; they are not malware scanners and cannot prove the PC is infection-free.
How to read this particular case
The original support thread brings together distinct clues: reported UtcSvc CPU use around 30–40%, intermittent WUDFHost activity, a negative Malwarebytes result, a RogueKiller PUM.Proxy finding, interrupted Defender scans and historical update errors, and three ftdibus.sys entries blocking Memory integrity. These details do not combine into a confirmed malware diagnosis. The report that stopping and disabling Connected User Experiences and Telemetry removed the UtcSvc symptom supports that the service was involved, but leaves the trigger and best long-term configuration unresolved. The thread does not document a definitive WUDFHost diagnosis, a fix for the FTDI driver warning, or proof that Defender was fully restored.
The practical conclusion is to treat this as a set of symptoms to separate: test the service for UtcSvc, isolate devices and drivers for WUDFHost, and check Defender’s status and scan history for MsMpEng. Investigate malware when process identity or multiple independent indicators support it—not because a legitimate Windows component used CPU.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
