locked
MsMpEng.exe Resource Usage RRS feed

  • Question

  • It has been quite a while since Windows Live One Care came out, yet the problem with MsMpEng.exe is still evident. I am sure there must be thousands of posts on this by now. When can we finally expect to see this resolved? The amount of resources it takes are far more than necessary. There should be an option for it to be disabled during times when it is not necessary, such as attempting to view large folders containing pictures or playing a game, it is nearly impossible to do either one, the resources jump to over seventy percent when either one is attempted, not to mention on line 3D chat services and games where is causes them to run at this level.

    Wednesday, December 5, 2007 10:31 PM

Answers

  • What you are experiencing is not a universal issue, it is specific to certian configurations and or combinations of programs. This is why it has lasted so long, since there is simply no one 'fix' because there isn't just one problem.

     

    As for disabling, this should theoretically occur when the Virus and spyware monitoring is turned Off in Change settings, though that would be a workaround, not a solution. In general, utilization problems occur when the viewer associated with a particular file type is not operating efficiently. Though the real time scanner will interact and add to the overhead it shouldn't be excessive in most cases, so I'd suspect an issue with either the viewer or some other application interacting with the MsMpEng process.

     

    The real problem is determining what's creating the issue in your case. Remnants of another old antivirus or an issue with the viewer are the first things I'd check for, though OneCare Support should be able to help if you ask them.

     

    OneCareBear

    Thursday, December 6, 2007 4:24 AM
    Moderator
  • I'm sorry if you are still seeing the msmpeng high CPU utilization problem. This *was* a big issue for quite some time, but most of the causes were identified and corrected. The root cause is the interaction with the antimalware engine and something else on the PC.

    Please contact support to have your logs reviewed for known causes of the problem and if they are unable to identify anything, please request that the problem be escalated for further review.

    How to reach support - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

    -steve

    Tuesday, January 8, 2008 1:28 AM
    Moderator

All replies

  • What you are experiencing is not a universal issue, it is specific to certian configurations and or combinations of programs. This is why it has lasted so long, since there is simply no one 'fix' because there isn't just one problem.

     

    As for disabling, this should theoretically occur when the Virus and spyware monitoring is turned Off in Change settings, though that would be a workaround, not a solution. In general, utilization problems occur when the viewer associated with a particular file type is not operating efficiently. Though the real time scanner will interact and add to the overhead it shouldn't be excessive in most cases, so I'd suspect an issue with either the viewer or some other application interacting with the MsMpEng process.

     

    The real problem is determining what's creating the issue in your case. Remnants of another old antivirus or an issue with the viewer are the first things I'd check for, though OneCare Support should be able to help if you ask them.

     

    OneCareBear

    Thursday, December 6, 2007 4:24 AM
    Moderator
  • Marvelous political dodge answer, perhaps it is as I thought, my suggestions are ignored , oh well, I will know better what to do when my expiration date arives, thanks anyway. Sad

    Thursday, December 6, 2007 4:29 AM
  • Not at all a dodge, the answer simply isn't as simple as you think, since as most today you have no point of reference for the complexity of a modern computer system. If there was a simple fix it would have happened months ago as you suggested.

     

    Since all of these issues are really specific to a group of systems, whether small or large, the only real way to determine and fix them is for you to submit the issue to OneCare Support. If you don't it can't be fixed, because the actual problem can't be determined. It's that simple.

     

    My guess is that there have been literally hundreds of such specific problems found and fixed based on the few dozen I've seen here and in the Defender forums myself. I'd also venture a guess that there may be hundreds more still existing, some of which may never be resolved because only a few people have the specific issue.

     

    The problem is that to a non-programmer, these all look the same, since the symptoms of lagging operation will still occur no matter what the root cause in a particular case.

     

    OneCareBear

    Thursday, December 6, 2007 4:59 AM
    Moderator
  •  carywinton wrote:

    Marvelous political dodge answer, perhaps it is as I thought, my suggestions are ignored , oh well, I will know better what to do when my expiration date arives, thanks anyway.

    In addition to moving this thread into the Antispyware topic folder, I'll add that the problem with MSMPENG resource usage has been constantly worked on over the last year and strides have indeed been made. Many causes of this problem were identified and addressed by the antimalware team responsible for this engine which is used by OneCare, Defender and Forefront Client security. Clearly  there is more work to be done. However, allowing the process to be shut down would negate the protection that it affords, so that isn't a solution at all.

     

    -steve

    Thursday, December 6, 2007 4:51 PM
    Moderator
  • I am unable to find any further discussion on this topic.

     

    My solution to msmpeng bogging my system was to restrict affinity to only one processor, at which point my system became useable again. 

     

    FWIW.

     

    Is that a safe solution?

    Saturday, January 5, 2008 6:38 PM
  • Ah, cary, no so easy as you think!  Wait until you try to cancel.  You will be run all over cyberspace, told you never had a subscription in the first place, the system will refuse to allow you to sign on, and a series of brilliantly designed distraction techniques will continue to run you in circles until you forget what you wanted to do in the first place.  A pity Bill and his people won't spend half as much energy soliving the - STILL UNRESOLVED - MsMpEng issue.

    Monday, January 7, 2008 11:14 PM
  • I'm sorry if you are still seeing the msmpeng high CPU utilization problem. This *was* a big issue for quite some time, but most of the causes were identified and corrected. The root cause is the interaction with the antimalware engine and something else on the PC.

    Please contact support to have your logs reviewed for known causes of the problem and if they are unable to identify anything, please request that the problem be escalated for further review.

    How to reach support - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

    -steve

    Tuesday, January 8, 2008 1:28 AM
    Moderator
  • As usual, the automatically generated post doesn't address the issue.  When I follow the link given, it takes me to  a discussion of how to use the automated support.  When I follow that support link, I get sent to a discussion of installing and activating, which is, of course, not the problem.  If I then go to "contact support" I get sent to a Wizard" which takes a bunch of info, and refers me to you, and the cycle starts over.   If I go to the discussion board, I find a long, long catalog of frustration, and  a few suggestions, all of which are unhelpful, because I've already done them all.  Meantime, onecare keeps flashing orange, and telling me I need to back up my disc, even when I've done it two hours ago, or telling me there are CRITICAL WINDOWS UPDATES! I need to install.  I go to the check for missing updates  site, my computer goes into "check for missing updates" cycle, and stays there until it's time for me to go to bed.  This issue, of course, appears nowhere on your website, at least, nowhere that a person who needed to find it could do so.  And MsMpEng continues to interrupt what I'm doing every few minutes to check some issue of system operation, effectively closing down the system. 

     

    Let me offer a simple concept: If the time the system spends keeping itself "secure" is greater than the time the system is available for use, there's a problem.

     

    The problem is that each and every fix Microsoft recommends has implicit in it the the assumption that the person making the request is operating at the same level of familiarity with the software as the person writing the canned response.  Thus, while "The root cause is the interaction with the antimalware engine and something else on the PC.

    Please contact support to have your logs reviewed for known causes of the problem" seems like a reasonable response to you "antimalware engine" has no meaning to most of us, and "have your logs reviewed" is useless advice if it doesn't include a "how to" that works.   Might i also politely suggest that before you recommend a link, you actually try it?  If, for examble, you go to the fancy new one care support site, and enter "MsMpEng", it tells you it doesn't understand the question.  Well, that makes us about even.

    Tuesday, January 8, 2008 10:44 PM
  • catman1950, if you go to the link I provided for contacting support, I did not tell you to enter msmpeng.

    In that FAQ post, I explain *in detail* how to reach your support options. You are correct that the post also explains that you should try the automated support options first. Perhaps I need to rethink that.

    What I am suggesting is that you submit an email support case, a chat case, or a phone support case to have your specific situation investigated. Once you contact support, they will work with you to gather what information may be needed to investigate what is causing your problem.

    I agree that not all of the help is helpful and I even agree that my responses are not always very good - using terms as you noted - that may not be meaningful.

    This thread is about msmpeng high CPU usage. msmpeng.exe is the antimalware engine of OneCare. This was a huge problem with 1.6 last year, but the bulk of the reasons for the problem have been resolved. The team responsible for this component was looking to find and resolve any remaining causes, but you'll only get that information to them via support.

    Based on your post, your system has multiple issues that need to be addressed and I commend you for putting up with the frustration that this has caused while you attempt to get it resolved. Please contact support and ask for the case to be escalated if the front line tech starts looking at having you reinstall OneCare without looking at all of your running processes, logs, and system information.

    -steve

     

     

     

     

     

    Wednesday, January 9, 2008 2:44 AM
    Moderator
  • This is what worked for me. My problem was high cpu usage (about an average of 60%) after updating to Live Onecare 2.0
    After reading a few recommendation on Web forums this is what worked for me even after a reboot.
    I have windows XP. Go to:
    Control Panel/administrative tools/services
    Right click on "peer networking identity manager" ... Then
    (select to "stop" the service & take the "disable" options and the select apply and OK).

    after a few seconds you will see cpu usage going back to normal.

    This can be an interim solution while we get a permanent solution from live Onecare.

     

    Wednesday, January 23, 2008 5:42 PM
  • Thanks, Alex. The full description of the services issue and the fix is here - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2707364&SiteID=2

     

    -steve

    Thursday, January 24, 2008 1:09 PM
    Moderator
  •  

    I remember this problem, I worked on my problem via email with one of the beta testers back when version 1.5, this would hog a lot of my processor,

     

    1.73Ghz Centrino (single)

    512mb ram

    XP

     

    After a while, I was told to uninstall many programs that I almost never use. And bunch of other cleans, since then I haven’t had that problem, my computer ran smooth, and this was a big help from the beta tester support team,

     

    There were many programs running on my computer that I wouldn’t use or didn’t need at most times, things like acrobat reader updater, QuickTime, iTunes (I don’t even use it) a dead AVG spyware and many other things would just be floating about in my processors, I used to have about 65-75 processors running in the background, now after removing them and preventing them from running, I’m down to as little as 35 to 45 depending on what I am doing, as for games I used to play World of Warcraft and it would run quite good, even on my 64mb shared graphics.

     

    Since then I have upgraded my laptop ram to 2GB and OS to vista premium, its running smooth, as regards to the MsMpEng.exe, this hasn’t been a problem over a year now.

     

    So I must say it depends on people’s computer setup.

     

    Tuesday, February 5, 2008 10:59 AM
  • My analysis of the problem indicates that the symptom (100% CPU usage) is caused by two event types:
    • Something happens that causes Defender to re-run a scan.  Hard drive and CPU usage will skyrocket.  I haven't figured out why loss of a wireless connection on my laptop causes this, but have to assume Defender thinks whatever triggered that disconnect was a suspicious behavior.  ...and after 10-15 minutes, eventually it finishes the scan and goes back to normal.  Very annoying when I'm in the middle of a Microsoft PowerPoint presentation trying to show a video or animation, but I'll accept (grudgingly) that Microsoft has determined that keeping me safe is more important than helping me get work done.  fine.
    • The application hangs in an infinite loop, with no end event.  Since these loops can be large, set off by hard drive data that comes in at an inconvenient time, HDD activity may be part of this.  Or it can be a tight loop, involving max processor usage only. 
    Wednesday, March 5, 2008 10:35 PM
  • Did you ever have any other antivirus software installed, aka Norton... I always find this a pain to remove from your computer and can cause all sorts of problems, reason why I ask, Norton was preinstalled on my laptop and after I removed it I had to use a few other programs to clear it off my laptop since it didn’t really get rid of it completely through the normal Norton uninstall.

    Wednesday, March 5, 2008 10:45 PM
  • Perhaps MsMpEng.exe could occasionally,

    as I can do via taskmanager, or otherwise,

    evaluate its impact on the user,

    alter its priority to mitigate that impact, and

    much as error reporting re unresponsive programs is done,

    cause diagnostically useful info to be sent to Microsoft. 

     

    If MsMpEng.exe could, so could other .exes. 

     

    -- Steve (too)

    Thursday, March 13, 2008 5:40 PM
  • This program does not work with ITunes well at all.. I started having this problem only two days ago. I deleted ITunes and have not had this problem. I do have an IPod, so this does pose as a problem for me.. and potentially others who use Windows and Apple products on interfacing applications. I do wish that Apple and Windows would work together an solve their issues.
    Sunday, April 13, 2008 5:31 PM
  • OneCare and iTunes should work fine together. Have you reinstalled iTunes to see if the problem returns?

    -steve

    Monday, April 14, 2008 6:20 AM
    Moderator
  • Hey OneCareBear,

     

    I know modern systems are complex, I have been a systems programmer for forty years (probably since before you were born!)

     

    But when you write "it is specific to certain configurations and or combinations of programs." it really is a cop-out.  Every problem that is not a pure software code bug is one of those two, or both.

     

    I have been running WinXP SP2 with LOC for ages with no problems at all.  I have just put SP3 on.  Now when I boot I get 90 minutes or so of dfrgntfs.exe hogging my discs.  When this finishes MsMpENG.exe comes up and runs 30-60% cpu utilization for ever (well at least twelve hours.)  I mean no way to stop it except to kill the process.  I've tried many of the bizarre fixes people have posted about this problem.  None of them work.

     

    This is straight from a cold start.  No other programs or user software running.  Only the stuff from Microsoft.  So if MS really want to maintain that this is due to a "combinations of programs" then you have to face the fact that it is MS programs.  I cannot even conceive that this problem could be related to device drivers, and those are the only other items "running" at the time.

     

    Other than going back to SP2 do you have any suggestions?

    Tuesday, May 27, 2008 9:58 PM
  •  Mike Castelberg wrote:

    Hey OneCareBear,

     

    I know modern systems are complex, I have been a systems programmer for forty years (probably since before you were born!)

     

    But when you write "it is specific to certain configurations and or combinations of programs." it really is a cop-out.  Every problem that is not a pure software code bug is one of those two, or both.

     

    I have been running WinXP SP2 with LOC for ages with no problems at all.  I have just put SP3 on.  Now when I boot I get 90 minutes or so of dfrgntfs.exe hogging my discs.  When this finishes MsMpENG.exe comes up and runs 30-60% cpu utilization for ever (well at least twelve hours.)  I mean no way to stop it except to kill the process.  I've tried many of the bizarre fixes people have posted about this problem.  None of them work.

     

    This is straight from a cold start.  No other programs or user software running.  Only the stuff from Microsoft.  So if MS really want to maintain that this is due to a "combinations of programs" then you have to face the fact that it is MS programs.  I cannot even conceive that this problem could be related to device drivers, and those are the only other items "running" at the time.

     

    Other than going back to SP2 do you have any suggestions?

    I think you may need to rethink the "before you were born" bit. :-)

    Sorry to read about the problem. Why is defrag running for 90 minutes at boot on startup? That's the service for defrag, as far as I know.

    -steve

    Tuesday, May 27, 2008 11:44 PM
    Moderator
  • I encountered this problem when I first replaced NortonIS with OneCare.  Particularly soon after starting my machine, it drains my resources hugely for the first 10 minutes or so, so I go get coffee.  I have heard from OneCare telephone support and I'm reading here that this is a case of individual configuration or conflict with other security software, but the report frequency of the problem suggests otherwise.

    The OneCare support person offered to provide me with an extensive protocol to go look for the offending conflicting software, but put simply it seems Microsoft has the cart before the horse.  Evidently the thing conflicting with MsMpEng.exe is the applications I am running.  The whole point of such security software is to reduce the interference of viruses and worms on the end-user, but it seems to me MsMpEng is a much bigger source of interference than any virus I've encountered.  Going through an extensive protocol to improve things is a cure worse than the complaint. 

    Simple question Q1: Why does MsMpEng.exe have to go "hell for leather" when it runs.   We can turn off the firewall standard minimum of 15 minutes, so this timing cannot be so critical that it needs to run flat out at startup.  i.e. why cannot it be run at a lower priority so that it provides much less interference?  Q2:  If the other aspects like backups can be set to run at a time convenient for the user, why not MsMpEng too? 

    Monday, June 9, 2008 9:52 AM
  • When MSMPENG spike the CPU during a scan it means that some other process or program is in conflict with it. In essence, as a scan takes place, another process is running that is causing the engine to need to scan memory or the files being accessed. You would need to determine what that process might be, per the instructions from support. I recommend that you continue the dialog with support.

    -steve

     

    Tuesday, June 10, 2008 9:08 PM
    Moderator
  • Here's a thought; since LOC knows what it is scanning, because its job, afterall, is to aid in the protection from nefarious program activity, it should allow the user to view what executables it is actively scanning and the associated files being scanned.  This is a simple solution that would alleviate some LOC support, aid the LOC user in solving his own problem if need be, and help the community to identify and discuss offending programs.  This essential feature should have been included in 1.0.  Not including this capability is almost as bad as if LOC indicated it stopped something bad and gave no indication as to what it was. 

     

    A primary functional criteria of security programs (firewalls, anti-virus, etc.) is to be transparent to the end-user.  Imagine if Cisco produced a firewall that when it detected a bad packet decided that it should reduce traffic throughput by a factor of 90-100% for 10-20 minutes, virtually shutting down a network or possibly the net access for an entire company.  Aside from the litigation issues, it would prove to be, quite simply, bad business. 

     

    This issue moves beyond isolated instances and happenstance as these problem can be substantiated in search results on Google with many reports in recent months.  The LOC team has done a great job of getting this under control but cannot classify this problem as comfortably "solved", and should be concerned about the precarious nature of the current state of the software in which the potential for one small LOC software change that could exacerbate the MsMpEng.exe problem to include other programs and drivers.

     

    Though it may sound as if I'm dissing LOC and/or MS, I am quite pleased with LOC and have moved all my development and household machines to it, along with recommending it to many friends, neighbors, relatives, and business associates.  The MsMpEng.exe CPU hogging is my one complaint.  Please, give us eyes into the scanning so you may help us help you.

     

    Wednesday, June 25, 2008 4:42 AM
  • I am having the 100% CPU utilization problem with Windows Backup and msmpeng.exe on Windows Server 2003 SP2. Backup eventually fails, but msmpeng goes on it's merry way, chewing up whatever CPU it can get its greedy little bytes around until I kill it - twice - via task manager. Is this a known issue? Is there a way to get it to ignore the (huge) backup files? 

     

    Thanks

    Monday, July 7, 2008 6:44 AM
  •  Another Stephen Moore wrote:

    I am having the 100% CPU utilization problem with Windows Backup and msmpeng.exe on Windows Server 2003 SP2. Backup eventually fails, but msmpeng goes on it's merry way, chewing up whatever CPU it can get its greedy little bytes around until I kill it - twice - via task manager. Is this a known issue? Is there a way to get it to ignore the (huge) backup files? 

     

    Thanks

    You're off topic for this forum, which is dedicated to Windows Live OneCare. You may want to try the Microsoft Public newsgroups here: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx for Windows Server. MSMPENG is the engine for OneCare, Defender, and Forefront.

    When this process sucks up all available CPU, it is usually due to a conflict with some other process that is causing it to go into overdrive to attempt to scan loading files and processes.

    -steve

    Tuesday, July 8, 2008 4:35 PM
    Moderator
  • It would seem that the engine should check how much of the CPU % it is using and lower its task priority ... I'm getting hammered it is making my machine unuseable.... kind of like what a virus does:). You guys shouldn't ship a program that consumes so much of the processor %. I've been writing server code for a longtime and it is fairly easy to monitor your processor time.
    Tuesday, February 10, 2009 12:51 AM
  • Shyster said:

    It would seem that the engine should check how much of the CPU % it is using and lower its task priority ... I'm getting hammered it is making my machine unuseable.... kind of like what a virus does:). You guys shouldn't ship a program that consumes so much of the processor %. I've been writing server code for a longtime and it is fairly easy to monitor your processor time.



    MSMPENG.EXE consuming excessive CPU is indicative of a conflict with other software or services on the PC. In normal usage, MSMPENG.EXE does not chew up CPU cycles. If, however, another program or service is in conflict with the "scan" engine, causing the engine to be unable to grab and scan the file, you will see the issue.

    If you are unable to identify other active security software that may be causing the conflict, please contact support.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, February 10, 2009 2:28 PM
    Moderator
  •  

    Shyster’s suggestion for an auto-throttling feedback mechanism got me wondering if there wasn’t some third-party application that could be used to throttle back MsMpEng.exe’s CPU usage as a stopgap measure for this issue. I found a program that I think might help: ThreadMaster by Soren M. Pedersen. This “great tool” is recommended by the SETI@home project for throttling down the CPU usage of the SETI client, which reportedly has an insatiable appetite for CPU time. That kind of endorsement was more than enough to convince a stargazer like me, so I went ahead and tried the program on my old IBM T43 (Windows XP) notebook, where MsMpEng.exe consistently peaks at 100% CPU usage during on-demand scans. I was really impressed by this program’s ability to pull the reins in on MsMpEng.exe. Of course I’m not sure how well this will work in a situation where the on-access scanner is causing the excessive CPU consumption, but it certainly looks like it might be worth a try. Here’s the original ThreadMaster with an added GUI courtesy of Timothy L. Wells: http://timwells.net/index.php?option=com_content&task=view&id=55&Itemid=72

     

    GreginMich

    Thursday, February 19, 2009 1:43 AM
  • Interesting possibility, Greg. Thanks!
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Thursday, February 19, 2009 3:59 PM
    Moderator
  • Automated throttling is an excellent suggestion, and something I would think would be a very obvious approach for a company always bragging about how "innovative" it is. How hard would it be for Msmpeng.exe to check the system clock periodically and realize it's been trying to read a file for 45 minutes? I suppose the innovation that will ultimately solve this problem is a 4-core CPU. That way while MS, Adobe, Apple, HP, etc. background apps are running there may be enough cycles on that 4th core to let me read my e-mail. Jim (My first post to the forum and I have to overcome the "Body must be 4 to 60000 characters" error to do it! Good way to keep down the complaints.)
    Wednesday, April 15, 2009 2:28 AM
  • Hello,

    i have lenovo T61 + Vista SP1 + Access Connections 5 + Microsoft forefront Client Security

    And i also had msmpeng problems draining CPU.

    I used FileMon (http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx) to see what is msmpeng.exe doing.

    I found out that msmpeng is checking "AccConnAdvanced.html" file in  "C:\Users\Public\Documents" and after putting that folder to Exclusions, my problem was solved !

    Best Regards

    Nikola
    • Proposed as answer by maleko Tuesday, September 29, 2009 6:23 AM
    Wednesday, April 22, 2009 8:50 AM
  • Hi, confirming Nikola's post; I had the same problem after reinstalling Live Onecare. I used FileMon as she suggested and found the identical problem which was immediately solved by excluding the file.

    Eric
    Wednesday, August 12, 2009 6:59 PM
  • I just got the MSMPENG problem resolved thr registry as follow

    Press Start+R
    Type Regedit in the box press enter
     In the registry go to  HKLM/Microsoft/Onecarepprotection/Explosioms /Process

    on right side of screen , create a new entry
    MSMPENG.exe under type put  'REG_DWORD
    on data enter 0x00000000{0},

    the msmpemg.exe will no longer be a memory eater
    Thursday, August 27, 2009 8:38 PM
  • I just got the MSMPENG problem resolved thr registry as follow

    Press Start+R
    Type Regedit in the box press enter
     In the registry go to  HKLM/Microsoft/Onecarepprotection/Explosioms /Process

    on right side of screen , create a new entry
    MSMPENG.exe under type put  'REG_DWORD
    on data enter 0x00000000{0},

    the msmpemg.exe will no longer be a memory eater

    Interesting workaround, but what exactly does that registry edit do?  I wouldn't want to do it and then discover three viruses later that I had inadvertantly disabled my anti-virus software.  Cleansing an infected computer is infinitely more bothersome, and usually more costly, than finding a software conflict.

    Users should rarely need to edit the registry directly, so if they do, they should know why.  Making registry tweaks is not the time for trial-and-error, particularly for the masses who don't know much about the registry.  Making an improper change in the registry can disable one or more programs, or the entire system.  And if you're actually trying to disable OneCare, why not just remove it altogether and take your chances getting infected.

    If there were such a thing as a simple fix, and if it were just as easy as adding one registry value, Microsoft would have done that long ago.  But, as has been already pointed out, programs interact differently depending on the individual system configurations.  So what fixes the problem for one user may prove useless for another.  In my own case, I know that MsMpEng spikes every time I open a particular web page, so I expect it.  I don't know what it is, but something on that page is a trigger that sets it off.

    Finding out what is causing the conflict is the first and best course of action. 
    Monday, September 28, 2009 3:17 AM
  • awgie dawgie made an important remark

    "Interesting workaround, but what exactly does that registry edit do?  I wouldn't want to do it and then discover three viruses later that I had inadvertantly disabled my anti-virus software.  Cleansing an infected computer is infinitely more bothersome, and usually more costly, than finding a software conflict.

    Users should rarely need to edit the registry directly, so if they do, they should know why."

    Mu input follows:

    WHERE is the documentation about HKLM/Microsoft/Onecarepprotection/Explosioms /Process? Is it available to the masses?

    Why do we need registry entries for LIVE?
    Why isn't it a a "portable application"?
    WHERE IS THE USER DOCUMENTQTION that allows us to control our machine?

    CPU eaters are one of the most serious problems to users. There is little or no excuse for such behaviour in any system.

    xxx



    Saturday, December 26, 2009 1:37 PM
  • Je cache, I'll re-post a previous reply after noting that you should *not* need to monkey around in the registry to resolve a resource problem with msmpeng,exe. There is no documentation that supports what was reported as a solution earlier in the thread with adding a registry key.
    OneCare is not a portable application and needs to be installed because it is a security program that monitors the system for malware at the file system and process level.
    Here's the repeated reply:

    MSMPENG.EXE consuming excessive CPU is indicative of a conflict with other software or services on the PC. In normal usage, MSMPENG.EXE does not chew up CPU cycles. If, however, another program or service is in conflict with the "scan" engine, causing the engine to be unable to grab and scan the file, you will see the issue.

    If you are unable to identify other active security software that may be causing the conflict, please contact support.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Saturday, December 26, 2009 11:31 PM
    Moderator
  • I had read that iTunes could cause conflicks with MSMPENG.EXE and excessive CPU processing. I recently installed iTunes and that is when I started to have problems so I disabled 'iPod service" under service tab msconfig and now everthing is back to normal.

    Larry
    Sunday, January 24, 2010 4:31 AM
  • I found a cure! I uninstalled Windows Live!
    Wednesday, February 3, 2010 7:03 PM
  • I found a cure! I uninstalled Windows Live!

    I assume that you mean "Windows Live OneCare"
    That is, of course, always an option as you are removing the other half of the conflict situation.

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Wednesday, February 3, 2010 7:56 PM
    Moderator
  • I am running Windows 7 and microsoft security essentials and also had problems with high CPU usage by MSMPENG.exe whenever I started a new program.  For me, it would spike to about 50-60% usage levels.


    I was able to fix the problem by adding DWM.exe to MSSE's list of excluded processes (Settings > Excluded Processes > C:\windows\system32\dwm.exe > Save Changes).   DWM is desktop windows manager, which I noticed was getting invoked every time I started a new program.  Voila problem solved, for me at least.  Hope it works for you.
    Sunday, February 7, 2010 1:27 PM
  • I found a cure! I uninstalled Windows Live!

    I assume that you mean "Windows Live OneCare"
    That is, of course, always an option as you are removing the other half of the conflict situation.

    Steve,

    Why is the burden placed on the user?  Perhaps, if LOC has this many problems with this many programs (this thread has been going since December of 2007), that the problem may actually be with LOC and not every other program?  Isn't LOC causing the same sort of behavior against which it designed to protect us?  If it is having a constant issue with a program (running a lot of CPU time on a given job, wouldn't it be prudent to have LOC point that out to the user so he/she could do what you suggest (remove some other program) which they would then know is the problem?

    In my case, my computer runs fine most of the time.  It is also loaded with many many programs.  But today, LOC goes wild.  I have seen it happen before, but then this behavior subsides for long periods of time.  So I Google "MSMPENG" and end up here, hoping to find that someone has given a cogent answer to this issue already, so I don't have to re-invent the wheel.

    But... the MVPs (yourself included) don't provide directions or link to directions on steps to carry out what you suggest.  Isn't that like getting something from Ikea with instructions which only say "NOW ASSEMBLE"?  This is true even if there are a myriad of programs which might cause this behavior -- the steps to finding out the culprit ought to be the same, or very similar, in all cases.  And if there isn't some reasonable common troubleshooting template for this, then LOC isn't fit for prime-time, as then Joe-regular-user can't deal with it.

    Yes, there have been other users in this thread who have pointed to annecdotal answers in their particular situations that they excluded, and even pointed to using Filemon as a means.  But when I run it, I get over 41-thousand events recorded in only 18 seconds.  Joe-regular-user isn't going to be using the tool anytime soon.

    And he shouldn't have to.

    Is it possible that the problem here is really MSMPENG, and not some untold number of other programs?  If it isn't, then how are you so sure?

     

    Pat

    Sunday, April 11, 2010 11:57 AM
  • pfurrie,

    I've just marked Steve's earlier answer where he directs how to reach OneCare Support, since this is the help you are searching for.  There is no simple answer to this as both this thread and the fact that no such answer has ever been provided should quite clearly prove, so it requires the aid of someone with such technical ability to determine on a particular PC.

    As mentioned throughout this thread, there used to be quite literally hundreds of such issues reported in the past and as your post and the dates of the two most recent before it show, they now occur quite rarely.  However, since the core reason behind this issue is that the MsMpEng.exe monitoring is going into overdrive monitoring something else on your system, the only real way to determine what is causing the situation is to contact OneCare Support for aid.

    Though this same issue occurs reqularly with any other similar real-time anti-malware application, in those cases the actual cause just isn't commonly recognized, since most of them have several different modules performing such duties and thus may not so clearly focus the issue.  In the case of the Microsoft security applications that use MsMpEng.exe (Windows Defender, OneCare, Forefront and now Microsoft Secuirty Essentials), they all use the same core engine(s), so the number of these issues are bound to be more visible.

    It's also true that for those using other anti-malware applications on their PC, as well as those using any other similar network or system monitoring application, this issue is bound to occur at some point as that third-party makes changes that Microsoft is initally unaware of.  The less common situation with MsMpEng.exe high utilization for more everyday applications can occur anytime changes are made to such an application, which in a case like your's may simply be due to a temporary situation such as an automatic update or other configuration changes to a third-party application.

    Though people such as Steve or myself are often capable of determining what might be causing this on our own PC, as you've discovered the tools and knowledge required aren't basic, so since we aren't here to be Support we send you to them instead.  We simply provide the common answers that are known to common questions, which though this question has occured quite a few times over long periods, there simply isn't any single answer that can be provided beyond, "Go to Support".

    Rob

    Sunday, April 11, 2010 6:12 PM
    Moderator
  • It is coming from Windows Defender I'm pretty sure it's a form of the old One Care,  now called 'Windows Defender"

    You can delete it all you, yet it will just keep coming back unless you terminate Windows Defender and I'm not sure you want to do that

    Sunday, April 18, 2010 2:20 AM
  • It is coming from Windows Defender I'm pretty sure it's a form of the old One Care,  now called 'Windows Defender"

    You can delete it all you, yet it will just keep coming back unless you terminate Windows Defender and I'm not sure you want to do that


    MSMPENG.EXE is the engine for OneCare, ForeFront, Security Essentials, and Defender. When it consumes excessive CPU, it is due to a conflict in most cases. Terminating it is not the solution.

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, April 19, 2010 1:04 AM
    Moderator
  • It appears that Windows Live One Care support is no longer operating.  I tried to sign up for a subscription and received a message that was no longer a valid option.  Is there an alternative to that?  I'm experiencing similar problems that are being reported in this forum about Microsoft Security Essentials consuming lots of the CPU at undesirable times and bringing my efficiency to a halt.  Is there a way to control when the updates are done?  I've scheduled the scan to run on Sunday while I'm sleeping but something is still running in the background because I frequently see MsMpEng.exe taking up anywhere from 20% to 80% or more of the computer resources . . . while I'm trying to work.  Is there a way to control when it's working? 
    Wednesday, July 21, 2010 5:38 PM
  • It appears that Windows Live One Care support is no longer operating.  I tried to sign up for a subscription and received a message that was no longer a valid option.  Is there an alternative to that?  I'm experiencing similar problems that are being reported in this forum about Microsoft Security Essentials consuming lots of the CPU at undesirable times and bringing my efficiency to a halt.  Is there a way to control when the updates are done?  I've scheduled the scan to run on Sunday while I'm sleeping but something is still running in the background because I frequently see MsMpEng.exe taking up anywhere from 20% to 80% or more of the computer resources . . . while I'm trying to work.  Is there a way to control when it's working? 


    MSE forums are here: http://social.answers.microsoft.com/Forums/en-US/category/mse

    A possible reason for this problem is that you have conflicting security software installed fully or partially on the PC. Remove all other security software from the PC.

    You may need to use a cleanup tool to remove your prior security software:

    http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91

    Be sure to review this post:

    Check list for installing Microsoft Security Essentials

     

    If that fails to resolve the problem, open an email support case:

     

    To open an email support case, start here:

    https://support.microsoftsecurityessentials.com/

     

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Wednesday, July 21, 2010 7:16 PM
    Moderator