According to techpowerup reports, Kevin Glynn, the developer of popular software such as ThrottleStop, discovered a strange phenomenon that Microsoft Windows 11/10’s Windows Defender will affect the performance of Intel processors.
JOIN US ON TELEGRAM
During the development of ThrottleStop, Kevin discovered that HWiNFO would report a reduction in frequency when the CPU was fully loaded. The bigger problem is that when Windows Defender is affected by a bug, processor performance is significantly reduced.
For example, a Core i9-10850K running all cores at 5.00 GHz will have a Cinebench score around 1000 points lower, a loss of roughly 6% performance. Users of Intel Core 8th, 9th, 10th, and 11th Gen (desktop and mobile processors) on Windows 10 and Windows 11 have reported this performance loss, while AMD processors do not.
The reason for this is that Windows Defender randomly uses all seven hardware performance counters provided by Intel Core processors, including three fixed-function counters. Each of these counters can be programmed in one of four modes to configure the privilege level at which it counts – Disabled, OS (ring-0), User (ring>0), and All-Ring levels. Since these counters share resources, multiple programs may wish to access these counters simultaneously.
Typical software sets these counters to “mode 3” or “All-Ring level”. Since they all have the same mode set, there is no problem with multiple programs using the same counter. However, Windows Defender will set these counters to “mode 2”, multiple programs will be constantly fighting, and the counter control register will be constantly changing between 0x222 and 0x332.
According to reports, this problem can happen when the computer first starts up, or at any time after that. While Windows Defender is running in the background, it will start and stop or keep trying to change these counters to “mode 2” at any time.
However, if the user manually overrides these counters, Windows Defender will detect this and immediately stop whatever it is doing and performance will return to normal without affecting normal virus protection, so we can find a workaround.
The temporary method is to use the Reset Counters button in the Counter Control tool, which can reset the counter with one click. When Windows Defender detects the manual setting, it will stop the operation.
A better solution is to use the ThrottleStop tool, there is a feature in the Options window called “Windows Defender Boost”, when checked activates one of the programmable timers, which constantly tells Windows Defender that the counter is being used, thus maintaining peak performance for a long time.
