High CPU load during Windows store game download

[jwsg]

I’m seeing high CPU load - on Antivirus and Antivirus Engine Server processes - during a Windows Store / Xbox app game download or update - specifically the game DOOM:The Dark Ages

Recent clean install of W11 24H2, Norton 25.7.10308, 9800x3D CPU

[SoulAsylum]

First off do you meet the required hardware specs or just minimums? CPU looks good what about GPU? Dedicated GPU or on chip CPU?

SA

[jwsg]

Its 9800x3D on B850M, 3080Ti GPU, 32GB RAM, downloading to P310 NVMe SSD, 300Mb/s internet - a recent build with clean install W11 24H2

Although there are sometimes posts about high CPU load, this situation seems very specific. I first noticed increased fan speed and saw high Norton AV process %ges in task manager. This wasn’t cured by restart - the high load continues until the end of the download.

I dont remember seeing this happen on a previous similar PC, or happening with other downloads, or at any other time. As it seems to relate to a particular download I wondered if the issue might be with Norton?

[bjm]

@jwsg

I dont remember seeing this happen on a previous similar PC, or happening with other downloads, or at any other time. As it seems to relate to a particular download I wondered if the issue might be with Norton?

Maybe, file is larger &or newer &or less frequently downloaded and Norton is chewing on the sample a while longer.

Download Intelligence
Detects and analyzes suspicious files when you attempt to run them or
download them from the internet.

• Download Intelligence: Helps protect your computer against unsafe files you download. Download Intelligence uses the reputation details of executable file you download using the browser to download the file first in the Sandbox environment. Based on the analysis performed in Sandbox, Download Intelligence decides whether the downloaded file is safe to install. In case the file is unsafe, Download Intelligence blocks the execution of the file and notifies you about the detected threat.

https://support.norton.com/sp/en/us/norton-360-deluxe/25.7/solutions/v20240108181736579

[jwsg]

I can understand that explanation if downloading a single, new, unusual, file, but this is a download of a well known game via the Windows Store / Xbox app (not via browser or when running the exe) - how Windows manages this in terms of individual files is unclear. The game was released 3 months ago and had 3 million players in the first week.

On pre-load of Game Pass games there can be higher CPU load during the unpack/install when first run after the release date passes but not in Norton AV processes - and this issue is during the entire download process which is not normally a demanding task.

This unusual high CPU load first happened during the full game download following W11 install, and then again during download of a title update, a much smaller download, but causing the same high load.

[SoulAsylum]

Guru bjm has the topic for you!!

SA

[bjm]

@jwsg

I can understand that explanation if downloading a single, new, unusual, file, but this is a download of a well known game via the Windows Store / Xbox app (not via browser or when running the exe) - how Windows manages this in terms of individual files is unclear. The game was released 3 months ago and had 3 million players in the first week.

@jwsg

This unusual high CPU load first happened during the full game download following W11 install, and then again during download of a title update, a much smaller download, but causing the same high load.

And how often has Norton seen this sample?
And how many Norton users?
Maybe, the sample characteristics/metadata caused Norton to chew on the sample &or sandbox the sample for analysis.
Maybe, the sample source was ripe for gathering telemetry.
Maybe, Norton wanted to gather telemetry from this sample &or from your machine.
Does Norton Security History report a related Download Intelligence event?
Can you reproduce your reported scenario…with this sample?
Maybe, record a performance issue.
$0.02

============================================

fwiw ~ my boiler plate

Norton LiveUpdate + Restart (not Shut down) machine

If your Norton is not working as expected and you’ve tried Troubleshooting → Reset to Default &or Repair Norton & clean re-install Norton 360…then…reach out to Norton support.
Note: Reset to Default resets Cloud Backup

Download and run the Norton 360 Remover tool for Windows here

Maybe, try Troubleshooting → Record a performance issue &or Enable/Send debug logs

May be best to Contact Norton Support

===========================

Caveat: I’m not familiar with Windows Store → game download nor Xbox app

[jwsg]

As its not a single file download via a web-browser, but a game download or patch via Windows Store / Xbox app I’ll try some tests first before contacting support.

Performing a Norton scan on a game folder stored on a SATA SSD there is increased CPU load to about 5% which is not really noticeable.

Performing a scan on the Gen 4 NVMe game drive (a change for this PC build) with a transfer rate up to 10 times higher, the CPU load reaches 50% - but takes only a few seconds even for a 70+ GB folder.

But, even at 300Mb/s download speed, a download takes many minutes and so any increased CPU load is sustained and noticeable.

Also, on the folder scan, the load is only seen on Norton Service, whereas during game download it’s also seen on Norton Antivirus Engine Server - perhaps due to how Norton scans an ongoing transfer.

So, the much higher transfer speed of the NVMe drive (6000 MB/s (bytes)) corresponds to a much higher CPU load on a scan than my previous PC - but what’s harder to understand is why that’s also true when the limiting factor (of the amount of new data to look at) ought to be the download speed (300Mb/s (bits)).

I now can’t be sure that it was only the one game doing this, that might have suggested it’s some particular file contents causing the issue, rather than something to do with PC config.

[bjm]

@jwsg

As its not a single file download via a web-browser, but a game download or patch via Windows Store / Xbox app I’ll try some tests first before contacting support.
[…]
I now can’t be sure that it was only the one game doing this, that might have suggested it’s some particular file contents causing the issue, rather than something to do with PC config.

Well, you certainly sound like you’re (more than me) knowledgeable. I’m not aware of CPU load. When my entry level machine slows down. I wait. I imagine as a gamer…you’re “performance” aware. I’ve had Norton chew on downloads/installs…so, that came to mind.

[jwsg]

It’s also that as a new build I’m looking out for anything different than before.

It could be an unexpected consequence of a much faster SSD drive that Norton processes files that much quicker and that shows up as a higher CPU load = how busy the CPU is (as its not being kept waiting for data to look at).

But during a download the amount of new data arriving ought to be limited by internet speed rather than PC speed - so seeing the same high load while downloading as when scanning the files afterwards is a mystery I might need to raise with support.

[bjm]

@jwsg

It’s also that as a new build I’m looking out for anything different than before.

It could be an unexpected consequence of a much faster SSD drive that Norton processes files that much quicker and that shows up as a higher CPU load = how busy the CPU is (as its not being kept waiting for data to look at).
But during a download the amount of new data arriving ought to be limited by internet speed rather than PC speed - so seeing the same high load while downloading as when scanning the files afterwards is a mystery I might need to raise with support.

Hello @jwsg
Well, I imagine the heavy lifting is done in the cloud vs your machine. I imagine the sandbox is in the cloud and not local…but, I should inquire whether sandbox analysis is cloud or local. I imagine as much heavy lifting as possible is done in the cloud. The entire sample (hundreds of MB) is/may not be uploaded for analysis. Bits n’ Pieces may be uploaded for analysis. But, as you write…this download is thru Xbox…which I’ve never touched. So, I’m thinking based on my experience - downloads from a website and program internal download/updates. Are downloads from “Windows store” server…different from downloads from a “program” server…different from a “website” server?
Caveat: I imagine Norton proprietary information will remain proprietary.

[bjm]

@jwsg

It’s also that as a new build I’m looking out for anything different than before.

It could be an unexpected consequence of a much faster SSD drive that Norton processes files that much quicker and that shows up as a higher CPU load = how busy the CPU is (as its not being kept waiting for data to look at).
But during a download the amount of new data arriving ought to be limited by internet speed rather than PC speed - so seeing the same high load while downloading as when scanning the files afterwards is a mystery I might need to raise with support.

Hello @jwsg
fwiw ~ Chat session condensed:
Download Intelligence - is Sandbox analysis performed in the cloud or local. I know Norton 360 has a Sandbox feature. But, that’s not the sandbox Norton uses for Download Intelligence. Correct?
Meaning…Download Intelligence uses the reputation details of executable file you download using the browser to download the file first in the Sandbox environment. Based on the analysis performed in Sandbox, Download Intelligence decides whether the downloaded file is safe to install. In case the file is unsafe, Download Intelligence blocks the execution of the file and notifies you about the detected threat.
Where is the Sandbox environment?
Is the Sandbox environment local or in the cloud? I imagine as much heavy lifting as possible is done in the cloud. But, maybe Download Intelligence sandbox is local. That’s what I’d like to know.
Where is the sandbox. Cloud or Local?
Where is Download Intelligence sandbox analysis performed. Cloud or Local?

Chat agent:
Norton uses of combination of local and cloud-based technologies, but the sandbox analysis itself is performed in the cloud.
If you’re seeing high CPU usage when Norton is “chewing” on a download, it’s likely due to local processing tasks, not the cloud sandboxing itself. Here’s what might be happening.
Real-time scanning Norton scans the file immediately upon download using local antivirus engines…and that’s after cloud sandbox analysis.
The reason some download or install events cause high CPU load while others don’t comes down to a mix of file complexity, system activity, and software behavior.

Does an entire sample (100s MB) get into the sandbox for analysis or just bits and pieces.

Chat agent:
Norton focuses on the executable portions of the file—code that will actually run. It doesn’t need to analyze every embedded image, document, or resource unless those components are suspicious. If certain parts of the file trigger behavioral flags (e.g. attempts to modify system files, access the registry, or contact external servers), those parts are prioritized for deeper sandbox analysis. Also Large files may be partially loaded or analyzed in stages, especially if the file is compressed or packed. Norton may unpack only what’s needed to simulate execution. I need to inform you that high CPU load doesn’t always mean something’s wrong—it’s often just your system doing its job.

So my personal data is not in the sandbox. My aunt sally recipes are not analyzed/read in the sandbox.

Chat agent:
Exactly, your personal data is not sent into the sandbox.

Note: Norton 360 v24+
Download Intelligence reports on suspicious.
Download Intelligence does not report on safe.