We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you a podcast all about Citrix Workspace, moving to the cloud, and analytics & intelligence. Episode 2 coming soon!Listen Now


MsMpEng.exe-what is it?  How to prevent it from loading?

raymm asked
Medium Priority
Last Modified: 2011-08-18
MsMpEng.exe-what is it?  How to prevent it from loading?
I end it using Task Manager, it pops right back up.
Watch Question

Sounds like you may have some version of spyware.

Do a full scan with Ewido, then Ad-Aware, then Spybot, and finish it off with Microsoft Anti-Spyware.

Also, use Mike Lin's startup control panel (www.mlin.net) to make sure that it's not loading at bootup.

Finally, have you tried to end the process tree in Task Manager?
Whoops...spoke too soon. It looks like that is part of the new Microsoft Anti-Spyware (http://www.spyany.com/files/MsMpEng_exe.html)

From the site:

MsMpEng.exe is the Windows Defender Auto-Protect Service that is the core engine of Windows Defender, which is originally Microsoft AntiSpyware software. At the time of writing, Windows Defender is still in beta 2 phase, so do not be too surprised when you encounter a few errors.

So if you're trying to get rid of it, you may want to uninstall Windows Defender, and try Mike's control panel program if you really don't want it.

Yes, suspect that you have a virus or malware. Suggest you download and run HijackThis.

Create a folder where you would like the HijackThis file to reside, and run it from there, not from the Desktop or a temp folder. It is important that you download this file to its own folder as this folder will be used when HijackThis makes backups. Temp folders get deleted, taking with them HJT's 'backups' of items that were 'fixed'.

Run Hijackthis scan, save the log file, then copy and paste the logfile to the site below and select 'analyze'.  
Wait a minute or so for the analysis, then scroll to the bottom of that page and you'll see "save analysis".  Click it, and the address we are after is in your top Address bar.  If you wish us to view it, copy and post that address here, *not* the log.   Thanks.
Top Expert 2012

Well, it is part of "Windows Defender":

"MsMpEng.exe is the Windows Defender Auto-Protect Service that is the core engine of Windows Defender, which is originally Microsoft AntiSpyware software. At the time of writing, Windows Defender is still in beta 2 phase, so do not be too surprised when you encounter a few errors."

Yes, i too may have fallen for that one >> MsMpEng.exe.     Will investigate some more.
use this little tool it may help you pin down the program..

Startup Inspector for Windows is a Windows platform software that helps Windows user to manage Windows startup applications. On <link removed by AnnieMod as now it contains problematic stuff>, there are more than 4,300 known programs in the database.Startup Inspector for Windows can thus provide a consultative information on the programs that are running at your Windows startup process. Whether a program is necessary to the system, or is the program a spyware.

Scans all programs that are in the Windows Startup Folder, Registry and provide you with a background information of the program.
Remove harmful programs like spyware, virus, dialers, make your system healthier.
Remove unnecessary programs like reminders, monitors, improve your systems performance.

<this link has been removed> - DarthMod, CS Moderator


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

As other users have said it IS Windows Defender, I found this other solution on the web which allows you to keep using defender and stops this high processor usage.

Run Windows Defender from the start menu. Click on Tools then Options. Scroll down to Advanced Options. Where is says "Do not scan these files or locations" click on the Add button. Browse to the folder where Windows Defender is installed (c:\program files\windows defender) and click OK. The path c:\program files\windows defender should now be shown in the field. Click on the Save button. Thats it.

Since the link to the app above was removed... maybe this solution is as good as any:

summarized from:

Exclude directory for scanning
Apparently, the service scans its self and therefore eats up all the CPU. Open Windows Defender, click on Tools and then Options. Now scroll down to the Advanced Options section:
Now click on the add button under the Do not scan these files or locations section. Now type in the path for the Windows Defender directory:

c:\program files\windows defender

Click OK and now make sure to click the Save button.


Turn off Windows Defender
To turn off Windows Defender, open the program and click on Options. Now go to Administrator options and uncheck the Use Windows Defender box. Make sure to click Save.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.