3 ms·
One issue with all antivirus on windows, including defender, is the performance impact. It seems to be dreadfully single-threaded, or at least make single-threa
by the8472 7y ago
One issue with all antivirus on windows, including defender, is the performance impact. It seems to be dreadfully single-threaded, or at least make single-threaded workloads even worse. Monitoring CPU use during updates easily shows this, there are periods where a single core is busy with the defender service and nothing else is happening.
Another issue that while microsoft's incentives may be better aligned it still fundamentally is an antivirus and thus an increase in attacksurface. There have been exploits against it[0] and it turned out that it did things with SYSTEM privileges and no sandboxing.
[0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=msmpeng https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
- BlueTemplar 7y agoIf only one core is busy, then it shouldn't have much of a performance impact?
- the8472 7y agoIt's only one core pegged at 100%, practically nothing else, which means it's a sequential workload entirely blocked on defender.
- BlueTemplar 7y agoOh, you mean that Defender locks your thread?
- the8472 7y agoI don't recall seeing significant locking in the stack samples, just that the scanning happens synchronously during some IO (e.g. closing file handles) and >90% of the CPU cycles are spent on defender. Which effectively boils down to a task that should be IO-bound becoming bottlenecked by waiting on defender.