Windows defender scan took 3 days to complete - Throttled?

[DaveLembke]

Was wondering if anyone knew if Windows Defender throttles itself when performing a full system scan. I performed a scan which consisted of a 1.5TB SATA HDD, and 256GB Intel S545 SSD with HDD almost completely full at 90GB free and SSD with 140GB free, and the scan was taking forever. I left the computer on for 3 days and it finally completed.

Oddly the system was pretty much idle most of that time with 2% to 5% CPU use at idle. I brought up task manager and then had the performance graph up for the CPU to see whats going on with it as well as what was going on with the drives which also show a graph and the drives were acting like they were idle and every once in a while a small graph blip of activity which may or may not have been Windows Defender drive traffic.

System is AMD A8-5545m 1.7Ghz with 2.7Ghz Turbo Quadcore APU with 8GB DDR3 1333Mhz RAM running Windows 10 64-bit Home, and the systems clock runs between 1.2Ghz and 2.7Ghz as Cool'n Quiet is enabled to underclock when processing power isn't needed to reduce power consumption, but when there is any task that requires the CPU to do something the CPU is quick to run full tilt and get done whatever I throw at it for a task as well as games run fine on it.

Looking online I have seen some other people complaining about the same thing but no solution to it, so figured I'd check here to see if anyone knows the cause of this to take forever.

I also looked at the hard drive health and all reports good according to crystaldiskinfo and this system runs fast when doing everything that I do on it so I don't believe this issue is an issue with the system itself.

I have the system set up to never go to sleep as well, so its not a matter of scan on hold while a sleep state and then picking back up when I am at it. The only thing I have set to sleep is the display after 30 minutes but everything else is always running when powered on and ready to run full tilt if needed.

The only thing that comes to mind as to why its taking forever is that Windows Defender is throttled back somehow to take forever to complete. But not sure exactly why and if this can be fixed. I installed AVG Antivirus on it and ran that for a full scan and it was complete in 5 hours and no problems found. I was hoping to just get by with Windows Defender but I don't have trust in a product that wont complete a full system scan during an 8 hour window of operation, because will it cancel and start over again at next boot or continue where it left off to maybe perform a full scan in a weeks time of 8 hours a day of use.

[Salmon Trout]

Of course you don't have AVG running alongside Windows Defender, do you? Classic cause of long scan times is either that, or else a previously installed 3rd party antivirus product not completely removed. Some remarks here, including how to disable archive scanning (zip, cab, pst etc) (of course you may have done all the things mentioned):

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/windows-defender-full-scan/bbe94c12-b550-4ff4-b2c2-66242740561f

[DaveLembke]

Hi Salmon ... the build was clean build of 10 Home and no other malware or antivirus programs/scans going on when I observed this. The reason for installing AVG to scan it was to get a reference as to was it really my system to which AVG would act the same as Defender or AVG would be different and how much of a difference to which AVG completed the same full scan much quicker than Defender.

The 1.5TB hard drive has data migrated over as a slave drive from a prior Windows 7 build, but I don't believe that should make any difference in time required to scan a drive. Just wanted to share this detail as for I stated its a clean build yet the 1.5TB drive only has 90GB free may have looked odd, so that's why the HDD is so full of data on a clean build.

Thanks for the link you provided, was looking through the info saw something that was rather interesting:

Running Quick Scans or Custom Scans will help build up Defender’s cache of trusted files and shorten up your Full Scans when the cache is reset by an OS Update:

I should run a full scan again and see if its much faster now that its built a "Cache of Trusted Files" .... Never knew of this feature of it. I always assumed a full scan is a full scan with no exclusion list of what to skip because it tested as clean in a prior scan.

However this is also suggestive of a cache reset each OS update, to where the first scan a rediscovery is needed to rebuild the cache again.

[Salmon Trout]

I just started Windows Defender doing a full scan on my system drive, a 120 GB Samsung Evo 840 SSD, with about 75 GB of files, and it says it will complete in a little over 35 hours! I found this article:

https://answers.microsoft.com/en-us/protect/forum/all/how-can-i-speed-up-windows-defender/56f6b432-957c-46cb-b1dd-f95a7667a04f?auth=1

Microsoft says

" initial Windows Defender Full Scan will always take extra time because Defender will be preoccupied with checking the “reputation” of files as it builds up a cache of trusted files that don’t need to be scanned. And of course there are also some error states that will result in excessively long scan times; most notably, the presence of a real-time third-party AV app, or remnants thereof."

It also says that Defender scans run with their CPU utilization capped at 50%, but that you can set the CPU utilization percentage with a command in an elevated (Adminstrator) PowerShell prompt:

Set-MpPreference -ScanAvgCPULoadFactor 100

Having done that, the predicted time to completion for a new scan is now 8 hours. But the CPU temp (i7 4790, stock cooler) is up to 75 C which is warm, but OK, and the fan is louder than normal (usually you can't really hear it). My CPU idles at around 35 C and a Defender scan capped at 50% runs my CPU temp up to around 48-52 C.

When I did a scan with the CPU usage set to 100%, it took a minute or two before the CPU ramped up.

I set it back to 50 using the same PS command, and the scan time is back to 35 hours.

[DaveLembke]

Thanks for checking this out at your end and seeing exactly the issue I have, and digging up the info on this.

Good to know that this powershell option exists to set it greater than 50%. Oddly though my CPU was idle most of the time and nowhere near 50% utilization.

When I get home from work today I am going to scan again and see if with everything added to the "Defender Cache" if it will process much faster now.

[DaveLembke]

Ran the full scan again and it looks like that cache feature works. It showed file count climbing with time remaining at 00:00:00 and then when it started scanning after skipping about 900,000 files it then said 8 hours as seen in pic. I guess its just the nature of Windows Defender to take a while for full scans. 

I didnt end up messing with greater than 50% CPU use for it because I am using my computer right now and dont want any lag, but its good to know that that option to set it to 100% exists if I ever needed to use that.

Thanks for the help salmon