CPU C0 below 100%, but no higher C state registered?

[Martin]

Thanks for your testing!
On a somewhat positive note, I finally got my hands on a system that's affected by this, so I can do a lot more trials and tests.
Unfortunately all my ideas so far don't seem to yield the desired result as Defender always takes over. I'm not even sure if tricking it into thinking the counters don't work is a good idea...

 

[Timur Born]

Unfortunately you cannot just check for the Defender process to know whether Realtime Protection is enabled or not, because the process always stays loaded. Maybe a warning popup would be useful. I knew about this problem already, but then completely forgot about it and practically started at zero in my investigation. An optional switch may could be a possible solution (defaults to off and let's Intel CPU users know on first run or so).

And before my clean reinstallation of Windows 11 I wasn't even affected by it, so somewhere the OS/Defender still used a setting based on the older AMD CPU installation. Based on that experience I am not sure how important that Defender "feature" really is, at least Microsoft does not claim Defender to be more secure on Intel CPUs, despite the "feature" missing on AMD.

On a side-note: a Windows "Reset" is not enough for a clean installation, it leaves various Registry entries (and maybe other things) intact.

 

[Martin]

Well, looks like I found something
Try this build: www.hwinfo.com/beta/hwi64_801_5406.zip

When starting HWiNFO you'll probably notice a short fight with Defender (Normal/Not Used) but it should stabilize and remain so while HWiNFO is active.
A while after closing HWiNFO you should notice renewed attempts by Defender to gain control (it will try to disable/reset the counters) and a few moments after that it should gain its control back.

 

[Timur Born]

Yep, that worked. Took about 2 minutes for Defender to take over again after closing HWinfo.

 

[Timur Born]

I will let HWinfo run for a few hours to watch how stable this is over prolonged runtime.

 

[Timur Born]

Unfortunately I celebrated too early:

2024-04-02  18:04:58  00:00:23  0x222  Defender
2024-04-02  18:04:59  00:00:01  0x332  Warning
2024-04-02  18:05:00  00:00:01  0x000  Not Used
2024-04-02  18:06:55  00:01:55  0x330  Normal
>2024-04-02  18:14:29  00:07:34  0x222  Defender<
2024-04-02  18:17:00  00:02:31  0x000  Not Used
2024-04-02  18:17:44  00:00:44  0x222  Defender
2024-04-02  18:17:45  00:00:01  0x332  Warning
2024-04-02  18:17:46  00:00:01  0x000  Not Used
2024-04-02  18:19:00  00:01:14  0x330  Normal
2024-04-02  18:19:00  00:00:00  0x222  Defender

 

[Martin]

So for 7 minutes while HWiNFO was active, only Defender was holding it? That's quite strange. Can you please double-check?

 

[Timur Born]

This single occurrence of prolonged Defender time is rather puzzling, because from what I can see otherwise Defender tries to use the counters exactly every 2 minutes just once and then is promptly - within a second or maybe polling rate? - reset by Hwinfo to take a step back for another 2 minutes. You can see this in the log snippet I posted earlier at 18:17 and 18:19.

At first I thought this might be a difference between running Hwinfo in the foreground vs. background, but that doesn't seem to be the case.

Then I thought it might be from running a manual full Defender scan (somewhat likely explanation), which might have lead to more aggressive Defender counters. If it is the latter then it didn't happen in consecutive runs yet, but that may have been Defender caches/hashes at work as the first run was the very first full scan ever on this 3-day fresh installation. I will try some more manual full scans, especially tomorrow (new date for Defender caches).

 

[Timur Born]

Is the 2 minutes interval expected for your implementation? This fits the 2 minutes it takes for Defender to take over again after Hwinfo has been quit.

2024-04-02 19:42:26 00:00:00 0x222 Defender
2024-04-02 19:42:27 00:00:01 0x332 Warning
2024-04-02 19:42:28 00:00:01 0x000 Not Used
2024-04-02 19:44:25 00:01:57 0x330 Normal
2024-04-02 19:44:26 00:00:01 0x222 Defender
2024-04-02 19:44:27 00:00:01 0x332 Warning
2024-04-02 19:44:28 00:00:01 0x000 Not Used
2024-04-02 19:46:25 00:01:57 0x330 Normal
2024-04-02 19:46:26 00:00:01 0x222 Defender
2024-04-02 19:46:27 00:00:01 0x332 Warning
2024-04-02 19:46:28 00:00:01 0x000 Not Used
2024-04-02 19:48:25 00:01:57 0x330 Normal
2024-04-02 19:48:26 00:00:01 0x222 Defender
2024-04-02 19:48:27 00:00:01 0x332 Warning
2024-04-02 19:48:28 00:00:01 0x000 Not Used

 

[Martin]

HWiNFO periodically checks if Defender tries to take over and will immediately reset the counters in such case.
So it doesn't matter what interval Defender uses to try again.

 

[Timur Born]

Maybe there is a conflict between HWinfo and Counter Control? Here HWinfo - running in the background - did not successfully reset the counters for 4 minutes until I brought the Counter Control app to the foreground (HWinfo still in background):

2024-04-02 20:40:29 00:00:02 0x000 Not Used
2024-04-02 20:42:25 00:01:56 0x330 Normal
2024-04-02 20:42:27 00:00:02 0x222 Defender
2024-04-02 20:42:27 00:00:00 0x332 Warning
2024-04-02 20:42:28 00:00:01 0x330 Normal
2024-04-02 20:42:28 00:00:00 0x332 Warning
2024-04-02 20:42:29 00:00:01 0x330 Normal
2024-04-02 20:42:29 00:00:00 0x332 Warning
2024-04-02 20:42:30 00:00:01 0x330 Normal
2024-04-02 20:42:30 00:00:00 0x332 Warning
2024-04-02 20:42:30 00:00:00 0x330 Normal
2024-04-02 20:42:31 00:00:01 0x332 Warning
..
2024-04-02 20:44:29 00:00:01 0x000 Not Used
2024-04-02 20:46:25 00:01:56 0x330 Normal
2024-04-02 20:46:27 00:00:02 0x222 Defender
2024-04-02 20:46:28 00:00:01 0x332 Warning
2024-04-02 20:46:29 00:00:01 0x000 Not Used

 

[Martin]

0x332 should still be OK. Problem is only if it's 0x222.

 

[Timur Born]

What I don't like about it is that the counters keep switching every second for two minutes when it happens (sometimes multiple times per second, sometimes a few seconds don't switch). So the counters seem to get a bit "bombarded". Does this have a detrimental effect?

 

[Martin]

Probably yes. What's your refresh period in HWiNFO? Try to reduce it to something like 500 ms, if you'll see a different behavior.

 

[Martin]

OK, here we go, just another build: www.hwinfo.com/beta/hwi64_801_5407.zip
Seems to work better for me.

 

[Timur Born]

I accidentally quit Counter Control, but as you can see in this log there is a time-span where Defender fought harder for control and thus caused multiple back and forth. This was during a full scan, though, so a bit of a different situation. Maybe starting Counter Control did cause, this, though, as afterwards it went back to the normal 2 minutes cycle.

2024-04-02 23:08:26 00:01:58 0x330 Normal
2024-04-02 23:08:26 00:00:00 0x222 Defender
2024-04-02 23:08:27 00:00:01 0x330 Normal
2024-04-02 23:08:28 00:00:01 0x000 Not Used
2024-04-02 23:09:08 00:00:40 0x330 Normal

2024-04-02 23:11:11 00:00:01 0x330 Normal
2024-04-02 23:11:11 00:00:00 0x222 Defender
2024-04-02 23:11:12 00:00:01 0x330 Normal
2024-04-02 23:11:13 00:00:01 0x222 Defender
2024-04-02 23:11:14 00:00:01 0x330 Normal
2024-04-02 23:11:15 00:00:01 0x222 Defender
2024-04-02 23:11:15 00:00:00 0x330 Normal
2024-04-02 23:11:17 00:00:02 0x000 Not Used
2024-04-02 23:12:25 00:01:08 0x330 Normal
2024-04-02 23:12:27 00:00:02 0x222 Defender
2024-04-02 23:12:28 00:00:01 0x330 Normal
2024-04-02 23:12:29 00:00:01 0x000 Not Used
2024-04-02 23:14:25 00:01:56 0x330 Normal
2024-04-02 23:14:26 00:00:01 0x222 Defender
2024-04-02 23:14:27 00:00:01 0x330 Normal
2024-04-02 23:14:28 00:00:01 0x000 Not Used

PS: If you wonder why I would even care about running HWinfo during a full Defender scan: Defender is one of the most taxing/fully multi-threaded non-rendering *realworld* CPU loads out there. ;-)

 

[Timur Born]

Ok, I think we can rule out that starting Counter Control was the reason for the back and forth. It's likely rather running a full scan that does that. So with that information gained, I will concentrate back more on the usual Realtime Protection combination.

2024-04-02 23:20:25 00:01:56 0x330 Normal
2024-04-02 23:20:27 00:00:02 0x222 Defender
2024-04-02 23:20:28 00:00:01 0x330 Normal
2024-04-02 23:20:29 00:00:01 0x000 Not Used
2024-04-02 23:22:27 00:01:58 0x330 Normal
2024-04-02 23:22:27 00:00:00 0x222 Defender
2024-04-02 23:22:29 00:00:02 0x330 Normal
2024-04-02 23:22:29 00:00:00 0x222 Defender
2024-04-02 23:22:30 00:00:01 0x330 Normal
2024-04-02 23:22:31 00:00:01 0x222 Defender
2024-04-02 23:22:32 00:00:01 0x330 Normal
2024-04-02 23:22:33 00:00:01 0x222 Defender
2024-04-02 23:22:35 00:00:02 0x330 Normal
2024-04-02 23:22:35 00:00:00 0x222 Defender
2024-04-02 23:22:36 00:00:01 0x330 Normal
2024-04-02 23:22:37 00:00:01 0x222 Defender
2024-04-02 23:22:39 00:00:02 0x330 Normal
2024-04-02 23:22:39 00:00:00 0x222 Defender
2024-04-02 23:22:41 00:00:02 0x330 Normal
2024-04-02 23:22:41 00:00:00 0x222 Defender
2024-04-02 23:22:42 00:00:01 0x330 Normal
2024-04-02 23:22:43 00:00:01 0x222 Defender
2024-04-02 23:22:44 00:00:01 0x330 Normal
2024-04-02 23:22:45 00:00:01 0x222 Defender
2024-04-02 23:22:46 00:00:01 0x330 Normal
2024-04-02 23:22:47 00:00:01 0x222 Defender
2024-04-02 23:22:49 00:00:02 0x330 Normal
2024-04-02 23:22:49 00:00:00 0x222 Defender
2024-04-02 23:22:50 00:00:01 0x330 Normal
2024-04-02 23:22:53 00:00:03 0x222 Defender
2024-04-02 23:22:55 00:00:02 0x330 Normal
2024-04-02 23:22:55 00:00:00 0x222 Defender
2024-04-02 23:22:56 00:00:01 0x330 Normal
2024-04-02 23:22:57 00:00:01 0x222 Defender
2024-04-02 23:22:58 00:00:01 0x330 Normal
2024-04-02 23:22:59 00:00:01 0x000 Not Used

 

[Martin]

That looks quite acceptable to me given the circumstances.

 

[Timur Born]

Comparing build 06 vs. 07 after 1 hour of various desktop load - aka not fully controlled - with all C- and P-states disabled ("Disable Idle"). All values below maximum are counters induced (2s polling).

vs.

 

[Timur Born]

Another day, another full virus scan. Build 07 after 12 minutes, 4:30 min of which where running the full scan. Comparing this to the last result seems to suggest that HWinfo is quite fine now with normal Realtime Protection running, full scans (especially the first scan of a day) will have more of an impact, though. I assume that regular Quick Scans automatically done by Defender may also have an impact. As long as I know about it, I can easily live with this. So this is FYI only: