What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Antivirus activity is usually the immediate cause of a slowdown only when its process and an active scan or file-access event rise at the same time. Confirm that connection first, then update the engine and security definitions, identify the files or workload being scanned, and tune scan timing before changing protection settings. For Microsoft Defender, the process commonly appears as Antimalware Service Executable (MsMpEng.exe).
The safest fixes preserve real-time protection: schedule intensive scans for idle periods, apply scan throttling where policy permits, and move unnecessary scan-heavy data out of constantly synchronized locations. Use a narrowly scoped exclusion only after diagnostics prove that a trusted path or process is responsible; Microsoft says exclusions should be a last resort because excluded content is no longer checked by real-time protection.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why is my antivirus using 100% CPU or disk?
High usage generally comes from one of five workloads: real-time protection inspecting files as applications open or create them, a scheduled full or quick scan, a catch-up scan after a missed schedule, scanning immediately after new security-intelligence definitions arrive, or repeated access to unusually expensive files. The percentage shown in Task Manager is not itself proof of a fault. A full scan can legitimately consume substantial CPU, memory and disk I/O, while a scan of a large archive may show modest CPU but sustained disk activity.
Defender and other endpoint products can also inspect the same files as another antivirus, endpoint-detection, data-loss-prevention, VPN or security agent. Mutual scanning increases reads and can make both products appear responsible. Network shares and synchronized folders add latency: the antivirus may wait for remote data, local cache updates or OneDrive synchronization while the disk remains busy.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Do not treat a generic “antivirus is slow” symptom as a reason to disable protection. First establish which operation is occurring and which files or processes trigger it.
How can I confirm that antivirus is the trigger?
Use a short, repeatable observation rather than guessing from one CPU spike. Record the process name, resource pattern and timing while reproducing the slowdown.
Recommended Free Tools
Check Task Manager while the slowdown occurs
- Press
Ctrl+Shift+Escto open Task Manager and select Processes. Sort by CPU and then by Disk. Note whether Antimalware Service Executable, a third-party antivirus process or another security agent is at the top. - Open the Details tab if you need the executable name. For Defender,
MsMpEng.exeis the usual process associated with scanning. - Write down the start time, approximate CPU percentage, disk active time, read/write rate and the application or task you were using. A timestamp makes later trace data useful to support staff.
- Reproduce the problem briefly. If usage rises when a particular folder, build, archive or virtual machine starts and falls when it stops, that workload is a stronger suspect than a random background spike.
Check Windows Security for scan status
Open Windows Security, choose Virus & threat protection, and review the last scan details. Look for a scan currently in progress, its duration and the number of files scanned. Compare those times with the Task Manager observations.
A security-intelligence update can prompt Defender to scan, and a missed scheduled scan can lead to a catch-up run. If the slowdown appears directly after an update or when the computer has been idle, record that relationship rather than assuming the update itself is defective.
Separate real-time access from a scheduled scan
Close the application that appears to trigger the spike and wait briefly. If usage falls immediately, real-time inspection of that application’s files is likely involved. If the process continues scanning a broad set of files without an application open, check scheduled-scan timing and the Windows Defender task history in Task Scheduler.
Have you installed current definitions and removed obvious conflicts?
Updating is the lowest-risk intervention and should precede exclusions or policy changes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install the latest security intelligence and engine updates
In Windows Security > Virus & threat protection, select Protection updates and choose Check for updates. Also install pending Windows updates and any update offered by a third-party antivirus vendor. Restart if the product or update process requests it, then repeat the same workload to see whether the behavior changed.
Keep the product’s normal protection mode unless you have evidence that a hardened or aggressive mode is responsible. If a recently downloaded file or development tool is repeatedly detected, treat it as a possible false positive and submit it through the vendor’s support or false-positive channel instead of excluding the whole directory.
Look for overlapping security software
List every product that can inspect files: antivirus, endpoint detection and response, data-loss prevention, VPN web filtering and security components bundled with other software. A partially removed product can leave drivers or services active. Check the vendor’s documented compatibility guidance and use the vendor’s official removal tool when a normal uninstall leaves components behind.
Do not install a second real-time antivirus simply to test whether it is faster. Two products can scan each other’s files, multiply I/O and obscure the original cause. If an organization manages the computer, ask its administrator before changing any security agent or policy.
Which files and workloads are expensive for antivirus to scan?
Once you know that scanning is involved, identify the workload rather than excluding an entire disk. The following patterns commonly create disproportionate work.
| Workload or location | Why it can be expensive | Safer first response |
|---|---|---|
| ISO, VHD, VHDX and other container files | The scanner may inspect many objects inside one container, so one apparent file access expands into numerous reads. | Close the image when it is not needed and move archival images out of an actively scanned or synchronized profile location when operationally safe. |
| Obfuscated or heavily compressed scripts | Content may require decompression or additional inspection before a verdict is possible. | Confirm the source and signature, update definitions, and investigate a false positive before considering a narrowly scoped exception. |
| Development and build trees | Compilers and package managers create, modify and delete thousands of small files, causing repeated real-time checks. | Use the Performance Analyzer to find the exact path or process; change build output or cache placement only when your tooling remains reliable. |
| Virtual-machine images | A guest operating system can change a large disk-image file continuously, producing repeated host-side scans. | Stop or pause the VM to confirm the relationship, then evaluate a vendor-supported, process- or path-specific policy under administrative control. |
| Network shares | Network latency and reconnects extend scan time and can make a local disk appear busy while the scanner waits for remote data. | Repeat the test with a local copy and consult the storage or security administrator before changing network scanning policy. |
| OneDrive-synchronized folders | Synchronization and local cache activity can cause the same files to be opened or changed repeatedly. | Keep large, rarely used images or archives outside the actively synchronized profile when the workflow allows it. |
Moving data is not a security bypass by itself: the destination still needs appropriate protection and backup. The purpose is to prevent unnecessary repeated work, not to hide active software from inspection.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
How do I use Microsoft Defender Performance Analyzer?
Performance Analyzer is the most useful next step when Task Manager shows a Defender process but not the file or operation responsible. Run it while the problem reproduces, then review the recorded hot paths, files, processes, extensions and scan types.
- Open Windows PowerShell as an administrator. Create a folder that administrators can access, such as
C:TempDefenderTrace. - Start a recording with
New-MpPerformanceRecording -RecordTo C:TempDefenderTracedefender.etl. - Reproduce the slowdown using the smallest repeatable workload. Continue only long enough to capture the trigger; a short, focused recording is easier to interpret.
- Stop the recording by allowing the command to complete according to the Defender cmdlet prompt, or by ending the recording in the PowerShell session.
- Generate a report with
Get-MpPerformanceReport -Path C:TempDefenderTracedefender.etl. Review the top paths, files, processes, extensions and scans rather than looking only at total duration. - Save the report with the exact reproduction time, Defender version, security-intelligence version and workload description.
The report can show that one extension, process or directory accounts for most scan time. That evidence supports a targeted configuration change or a vendor case; it is not a reason to exclude every file with the same extension.
When should I collect Process Monitor or WPR data?
Use a trace when Performance Analyzer does not identify a clear hot path, or when the slowdown involves several security and storage components. Microsoft guidance favors a limited capture rather than an all-day log.
Process Monitor for file and registry activity
- Open Process Monitor with administrative rights and clear existing events.
- Set filters for the suspected antivirus process, the affected application and the relevant path. Avoid capturing every process if the system is busy.
- Start capture, reproduce the issue for about 5–10 minutes, then stop immediately.
- Save the native log and record the exact start and stop times, workload and observed CPU or disk peak.
Process Monitor can reveal repeated opens, retries, sharing violations and access to a path that was not obvious from Task Manager.
Windows Performance Recorder or WPRUI for system-wide contention
- Use Windows Performance Recorder (WPR) or the WPRUI interface when CPU scheduling, storage latency or several security drivers may be interacting.
- Select a focused CPU or disk profile, begin recording, reproduce the trigger for approximately 3–5 minutes, and stop the capture.
- Keep the trace limited to the incident window. Large, unfocused traces are harder to transfer and analyze.
Preserve the trace alongside the Performance Analyzer output. A vendor can correlate timestamps with definition updates, scan events and driver activity.
How can I reduce scan impact without disabling protection?
Prefer timing and throttling controls because they retain more coverage than an exclusion or a real-time-protection shutdown.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Schedule intensive scans for idle periods
Open Task Scheduler > Task Scheduler Library > Microsoft > Windows > Windows Defender and review the Defender scheduled tasks. Where organizational policy permits, place full scans outside build, backup, gaming or presentation hours. Keep the computer available during the selected window so the scan can finish instead of repeatedly missing its schedule.
Use scan throttling deliberately
Microsoft documents AvgCPULoadFactor for limiting the average CPU load of scans. Its scan guidance lists a default average CPU load factor of 50 for full scans, while noting that actual usage varies with processor cores, I/O and memory pressure. A lower value can make the computer more responsive but lengthens scan completion.
On a managed Windows installation, an administrator can review the policy or use the Defender preference cmdlet, for example:
Set-MpPreference -ScanAvgCPULoadFactor 30Choose a value through your organization’s policy process, test it during the real workload and document the resulting scan duration. This setting affects scan behavior; it does not eliminate real-time checks when applications access files.
Review scan-after-update behavior
If every definition update is followed by a disruptive scan, capture the timing and check whether the product exposes a supported policy for update-triggered scanning. Do not block security-intelligence updates merely to avoid the follow-up work; stale definitions reduce detection quality.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should I disable real-time protection or add an exclusion?
Both actions reduce protection and should come after updates, conflict checks and diagnostics. Microsoft states: “Adding antivirus exclusions should always be the last resort if no other option is feasible.”
| Remedy | Protection retained | Diagnostic value | Main trade-off |
|---|---|---|---|
| Schedule scans for idle time | High | Shows whether timing, rather than a file, caused the disruption | Work may move to another period if the computer is asleep or unavailable. |
| Lower average scan CPU load | High | Confirms whether CPU contention is the limiting factor | Scans take longer and may overlap with later scheduled work. |
| Move unnecessary archives or images | High when the destination remains protected | Tests whether sync or repeated access caused the load | Applications, links or backup jobs may need path changes. |
| Temporary real-time-protection shutdown | Low during the shutdown | Can confirm causality in a tightly controlled test | Files opened or changed during the test lose real-time inspection; protection must be restored immediately. |
| Single full-path or process exclusion | Reduced for the selected object | Hides the symptom rather than explaining it | Malware or an exploited trusted process can operate in the excluded scope. |
| File-type or broad-folder exclusion | Much lower for all matching content | Poor, because the scope is too broad | Unrelated files receive no real-time check and the security gap is difficult to audit. |
Scheduled scans or third-party scanners may still inspect excluded content. An exclusion therefore does not guarantee that disk activity will disappear.
How do I create the narrowest possible exclusion?
Only use an exclusion when diagnostics identify a trusted, high-churn path or process, the software vendor supports it and an administrator accepts the risk. Exclude the smallest full path or process required; do not begin with an extension or an entire user profile.
- Open Windows Security > Virus & threat protection > Manage settings.
- Scroll to Exclusions, choose Add or remove exclusions, and approve the administrator prompt.
- Select Add an exclusion, then choose the appropriate type: File, Folder, File type or Process.
- Enter the exact path or executable identified by the Performance Analyzer. For a process, use the complete path rather than a generic name when the interface allows it.
- Record who approved it, why it was needed, the date and the planned removal date. Reproduce the workload and confirm that the performance change corresponds to the identified trigger.
- Return to the same page, select the entry and choose Remove as soon as testing or the exceptional workload ends.
Never exclude a downloaded-files folder, an entire drive, an extension used by many applications or a path that ordinary users can modify unless a formal security review specifically requires it.
What should I do if high usage continues after tuning?
Escalate with evidence instead of repeatedly changing settings. A complete case lets the vendor distinguish a scan-design issue, a false positive, a damaged installation, a storage problem or a conflict with another agent.
- Product name and exact version.
- Windows edition and build, if your support process requests it.
- Security-intelligence or definition version and the time it was installed.
- The process name, scan type and whether the event followed an update or missed schedule.
- Reproduction steps, affected path or application and timestamps in local time.
- Defender Performance Analyzer report, or the limited Process Monitor or WPR trace.
- List of other antivirus, EDR, DLP, VPN and endpoint-security components installed.
- Any false-positive detection name and the file’s publisher or signature information.
Submit suspected false positives through the appropriate vendor channel. If a third-party product is involved, contact that vendor with the trace rather than applying a Defender exclusion that masks the interaction.
Which troubleshooting choice fits the symptom?
- Spike occurs only during a known full scan: move the scan to idle time and review the average CPU load factor.
- Spike follows a definition update: record the update and scan timestamps, install all current product updates and review supported scan-after-update policy.
- Spike follows opening one archive, image or build tree: use Performance Analyzer to identify the exact path, then change the workload’s location or configuration before considering an exception.
- Two security products are active: investigate mutual scanning and incomplete uninstalls with the vendors or administrator.
- No clear trigger appears: capture a focused Process Monitor or WPR trace and escalate with timestamps.
- A temporary test requires real-time protection to be off: disconnect untrusted inputs, keep the test brief, restore protection immediately and do not use the result as a permanent fix.
Frequently Asked Questions
How can I tell whether MsMpEng.exe is a genuine Windows process?
In Task Manager, right-click the process and choose Open file location, then inspect the file’s Properties and its Digital Signatures tab. A Microsoft signature and the expected Defender installation location are reassuring; an unsigned copy in a user-writable folder should be isolated and investigated rather than excluded.
Will occasional antivirus scans wear out my SSD?
A normal scan is predominantly read activity and is not, by itself, evidence of harmful drive wear. If Task Manager shows sustained writes, unusual temperatures, storage errors or repeated paging, investigate the underlying application, memory pressure and drive health separately from antivirus policy.
Can I stop a scan when I need the computer immediately?
You can cancel a user-started scan from Windows Security, but cancellation leaves that scan incomplete and does not replace scheduled protection. Let real-time protection remain enabled, then run the deferred scan during an idle period rather than repeatedly canceling every scheduled run.
Why does the slowdown return after I remove an exclusion?
Removing the exclusion restores normal inspection, so the original high-churn path will be scanned again whenever it is accessed. Use the recorded path or process to change the workload, scan schedule or compatibility configuration instead of treating the exclusion as the root-cause fix.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
