CPU C0 below 100%, but no higher C state registered?

[Martin]

Thanks. I'm working now on a more permanent solution, I found some more clues but Defender still tries to somehow fight back

 

[Martin]

Please try this build: www.hwinfo.com/beta/hwi64_801_5408.zip
Seems to work better for me, at least I don't see Defender attempting to claim the counters while HWiNFO is active.
However, Counter Control reports every 30 seconds that Defender is trying to clear the counters (0x000), though this is something I don't observe in HWiNFO.

 

[Timur Born]

Unfortunately still happening here:

2024-04-03 14:25:52 00:01:21 0x330 Normal
2024-04-03 14:25:53 00:00:01 0x222 Defender
2024-04-03 14:25:54 00:00:01 0x330 Normal
2024-04-03 14:25:54 00:00:00 0x222 Defender
2024-04-03 14:25:55 00:00:01 0x000 Not Used
2024-04-03 14:27:52 00:01:57 0x330 Normal
2024-04-03 14:27:53 00:00:01 0x222 Defender
2024-04-03 14:27:54 00:00:01 0x330 Normal
2024-04-03 14:27:55 00:00:01 0x000 Not Used

 

[Timur Born]

Maybe you can ask the TS/CC author what he is doing exactly? He specifically mentions HWinfo in the Readme, so maybe he is willing to help!?

 

[Martin]

Not sure if this is just coincidence, but for me this worked. Can you please try: www.hwinfo.com/beta/hwi64_801_5409.zip

 

[Timur Born]

09 keeps the counter set to 0x330 indefinitely now, even after quitting HWinfo.

On my first test I had the curious case of a Defender Full scan getting stuck until cancelled in its early (single-threaded) phase, but I cannot say for sure if that happened shortly before or after starting 09 for the first time. When I tried to reproduce this it didn't happen again.

 

[Martin]

That's good news finally I'm working on restoring the state after closing HWiNFO so that Defender will have a chance to get its tricks back.

 

[Timur Born]

Any new build to test for this?

 

[Martin]

The latest Beta should have all implemented.

 

[Timur Born]

Great, I will test it then.

 

[Timur Born]

I checked the Beta and it doesn't seem to return control to Defender after HWinfo is closed. I tested 8.0 non Beta first to reproduce the old behavior. Then I ran the Beta for the new behavior and finally switched back to the old non Beta. But the last non Beta step stays at full C0/frequency then, which suggests that the Beta changes still apply.

 

[Timur Born]

8.02 release also does not seem to return control to Defender after closing HWinfo. Did you give up on that or is this unexpected behavior?

 

[Martin]

More-less yes, it's tough to understand how Windows Defender handles those counters and exact conditions when it will refrain from using them.
Many assumptions I had weren't correct so it's probably better the way it is now rather than losing them to WD again

 

[Timur Born]

Thanks for the clarification!