Apr 06, 2023 19:00:00

Bug reported that Microsoft Defender abnormally jumps CPU usage in Firefox and Chrome

In

Bugzilla , a bug management system operated by the Mozilla Foundation that develops Firefox for web browsers, there is a bug that ``When browsing the web with Firefox, Microsoft Defender (Windows Defender), a genuine Microsoft antivirus software, jumps up the CPU usage rate''. reported.

1441918 - Antimalware Service Executable (Windows Defender) very active / high CPU when using Firefox
https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c82

When using Windows Performance Recorder (WPR), which checks system and application behavior and resource usage, if the CPU usage rate of 'MsMpEng.exe', which is the Microsoft Defender execution process file in Firefox or Chrome, jumps abnormally, Yannis Juglaret , who works as a Senior Software Engineer at the Mozilla Foundation, reports.

On Windows devices where Microsoft Defender's real-time protection function is enabled,

VirtualProtect calls seem to be unreasonably high (MsMpEng.exe CPU usage is abnormally high).

The information that 'VirtualProtect calls are unreasonably high' is said to be information provided by Microsoft. Note that most of the VirtualProtect calls are caused by the JIT engine, so disabling the JIT in both Firefox and Chrome seems to make MsMpEng.exe behave more rationally.

Version 1.1.20200.3 of 'mpengine.dll', part of the Microsoft Malware Protection Engine files with bug fixes based on this, has been released. By applying this, the CPU usage of MsMpEng.exe is said to decrease by up to 75%.

1441918 - Antimalware Service Executable (Windows Defender) very active / high CPU when using Firefox
https://bugzilla.mozilla.org/show_bug.cgi?id=1441918#c91

Below is a graph of CPU usage of Firefox (green) and MsMpEng.exe (red) measured by WPR. The upper graph is before the bug fix, and the lower graph is after the bug fix. The CPU usage of MsMpEng.exe is clearly reduced after fixing the bug.

To install version 1.1.20200.3 of mpengine.dll Launch a Powershell terminal with admin privileges, type 'Set-MpPreference -EngineUpdatesChannel Beta', open Windows Update and browse for updates, check if the new update is Install it when it appears.

The method to check the version information of mpengine.dll is as follows.

In Windows Explorer, go to 'C:\ProgramData\Microsoft\Windows Defender\Definition Updates\;' and open the folder name because there is a list of numbers and letters.

Since there is a file called mpengine.dll in this, right click on it and click 'Properties'.

You can check the version information of mpengine.dll by checking 'Product version' on the 'Details' tab.