Microsoft fixes 5-year-old Defender bug that slows down Firefox

[German]A few days ago, Microsoft fixed a bug in Defender that had been known for five years. The bug caused Defender to create a high CPU load on Windows when the Firefox browser was running. Users had to create an exception for Firefox in Defender to work around the problem. That is no longer necessary.

The issue came to my attention last week at ghacks.net because Martin Brinkmann had picked it up in the following tweet and in the article Microsoft fixes 5 year old Windows Defender bug that affected Firefox's performance.

In May 2018, there was a thread in the Firefox Bugzilla section titled Antimalware Service Executable (Windows Defender) very active / high CPU when using Firefox with the following description:

I noticed that for some time now most of the time Firefox is active, the Windows 10 built in `Antimalware Service Executable` is using well above *30% of my CPU*, and is reading and writing random files in `Windows/Temp`, all starting with `etilqs_`.

This is considerably slowing me down and makes Firefox feel really slow.

I reproduced this in a new profile, and so far the only thing that helped is excluding the Firefox process from Windows Defender Antivirus. (something most of our users will probably not do)[…}

I am on Windowns 10 on Surface Pro 4, running the current Nightly[…}

The post was referring to nightly builds of Firefox – but it turned out after testing by Mozilla developers that Defender in Windows 10 (and also in Windows 11) was responsible for the CPU load. The antimalware service, Msmpeng.exe (Microsoft Malware Protection Engine) caused the problem because it accessed sechost.dll to run a ProcessTrace. This caused too many ETW events to run as normal. This consumed five times more CPU power with Firefox than with Chrome and other browsers. Many users reported that performance was so poor that their PCs stalled when using the browser.

Windows Defender's real-time protection – according to research – called VirtualProtect several times, which triggered the load. Mozilla developers cooperated with Microsoft and found that disabling the JIT compiler (via about:config) mitigated the problem, but did not completely fix the CPU load.

Users had to define an exception in Defender that prevented Defender from scanning Firefox files. The bug was later fixed by Microsoft, and then tested with the beta version of the Defender engine (1.1.20200.2). The fix has now been included in the stable channel of antivirus definitions and rolled out widely. According to Ghacks.net, this update was rolled out broadly on April 4, 2023 with version 1.1.20200.4. Those who want to check whether the update is installed can find it in the path:

C:\ProgramData\Microsoft\Windows Defender\Definition Updates

There migt be a subfolder with a long alphanumeric name. The properties of the mpengine.dll stored there should show version 1.1.20200.4.