High Windows anti-malware CPU usage and hourglass after adjusting mouse pointer

Quartz · 28 May 2022 at 22:51

Here's a wierd one for you all. I was messing with the mouse pointer settings and started to get an hourglass by the pointer - the 'Working in Background' pointer.

I let it run for a while in case there was an update going on but the hourglass stayed there. Task Manager shows that the Antimalware Service Executable is using most of one CPU core.
So I put the mouse pointer back. No change. Change to default then to Extra Large. No change.
I uninstalled Malwarebytes. No change.
After consulting Google I've put MsMpEng as an exclusion, both process and file, in Windows Security. No change.
I've also changed the process priority in Task Scheduler with no effect.
I've done a scan and found nothing.
Trying to roll back definitions fails with error 0x80070005.
SFC /Scannow gives a clean bill of health.
dism.exe /online /cleanup-image /scanhealth reports 'No component store corruption detected' and dism.exe /online /cleanup-image /restorehealth also failed to improve matters.
Turning off Antimalware solves the problem of high CPU usage but does not remove the hourglass.
Closing all programs does not remove the hourglass.

Rebooted every time.

Windows 10 Pro, 64 bit, fully patched.

Any suggestions?

Rroff · 30 May 2022 at 04:42

I can't really tell you how to fix it because the steps aren't necessarily the same each time (removing software distribution folder or resetting all definitions, etc.) but I've seen it a few times where the malware protection engine in Windows 10/11 gets itself in a loop trying to do a heuristic update or something and just sits there forever eating CPU and disc IO until you manually reset it.

Might be worth using Process Explorer to see what is going on as often with 10/11 the actual root of the problem isn't what it looks like.

Quartz · 31 May 2022 at 00:03

It's interesting. Process Explorer gives very different results to Task Manager. Task Manager is saying that the Antimalware executable is using 9% but Process Explorer says it's using 2%. Task Manager says that CPU usage is 27% and Process Explorer puts it at about 7%. I'm using 9 GB out of 16 GB (though the Committed figure is 20 GB) so the M.2 drive isn't being touched.

Process Explorer:

Quartz · 1 Jun 2022 at 21:21

Just on the off-chance it was RAM, I switched in my 64 GB kit and it's made no difference.

Rroff · 1 Jun 2022 at 21:55

Process Explorer should show what process is using CPU the most and a break down via process properties->threads of what system calls that process is making - which may or may not be useful in narrowing down the problem.

Quartz · 1 Jun 2022 at 22:29

Process Explorer shows System Idle at 84%, MsMpEng at 2%, Process Explorer itself at 1.5%, and the rest as odds and sods.

Ah, found it! It was the Asus Framework Service. I noticed it was in red in Process Explorer. It must have updated itself and messing with Malwarebytes and the MS Antivirus must have been an unfortunate coincidence and red herring. I uninstalled it and the hourglass and high CPU usage have gone.