This is surprising. I have seen slow quickscans, though--but that's pretty
significant. My guess is that there's some file type or set of files that
Windows Defender attempts opening and then retries, perhaps with a timeout
of some kind--30 seconds or the like, and that these files are never
allowing it in--but this is all just a guess.
If you watch the scan, can you see it pause for extended periods of time on
particular file names/locations?
This seems like something worth getting to the bottom of--either the design
of the scanner needs to be improved to provide better performance in these
situations--or there's something happening on your machine that may be worth
getting to the bottom of. But I'm not at all sure how to provide a nice
simple trace of what is happening without watching the thing.
Sysinternals has a bunch of tools that might help show just what files are
being touched at a given moment, but I don't know enough about them to see
whether they can provide a trace of some kind so you could just analyze it
later, rather than sit and watch to see what happens...
