BRAND NEW system with MSMPENG.exe issues RRS feed

  • Question

  • Hello, So i've read about all of the issues, I've read Microsoft's position "The problem isn't with OneCare, it's with a CONFLICT one-care has with another process..."  Okay, well I am a newbie, i just built my first-ever computer, I've noticed msmpeng causing problems on my 2yr old laptop, so I figured I'd be FINE to choose OneCare as my firewall as i was building a new system from scratch and KNEW what i'd be installing initially. 

    I've had my system running for about six days now. I've got NOTHING on my machine.  I lied.  I've installed Microsft Zune and MagicJack,  i've disabled both in my sysconfig, where I can disable startup or services or etc and so those two things aren't running,  I can SEE that they're stopped.  So given all of that,  I've got a FRESH NEW MACHINE with only Zune and Magic Jack installed but disabled,     HOW CAN I BE HAVING ISSUES WITH MSMPENG.EXE?  Did i make a poor choice in firewall software? 

    It does EXACTLY what my old broken laptop did,  it runs my ram at exaclty 51%  all day long.  What do you reccommend to someone like me?  What can I do to fix this.  I have already disabled the service of Magic Jack and Zune.     Thank you Microsoft.  I've been extremely impressed with you and your support thus-far.  But I'm scared that this issues is unfixable and I'm just going to end up dropping one-care when my subscription expires in like two months...  Please help me, i'd love to fix this issue.

    Wednesday, August 5, 2009 1:26 AM


All replies

  • From your post it doesn't appear likely that there is a software conflict. I don't know if it will help or not but you might try uninstalling One Care, run the install cleanup tool - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/399071e2-49dc-4767-932d-d261e3965943 and reinstall One Care. If MsMpEng.exe continues to have high CPU usage I suggest contacting support for help. How to reach support - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90
    Jim - MVP Windows Live - Forum Moderator - Live One Care - Live Mesh - Microsoft Security Essentials
    Wednesday, August 5, 2009 3:45 AM
  • wow thanks for a fast response, i've never posted in a forum before.  Well it isn't CPU it's RAM that it's eating.  It did it on my laptop, ALWAYS ran at 28% and like 31-33% when busy, but then msmpeng would kick in and my RAM would always stop at 51%.  Crazy  .  Then in my resource monitor i could see that there are MULTIPLE instances of msmpeng running in the memory area NOT the cpu area and they are casuing the RAM to run over 50% when normally ran below 30%
    Wednesday, August 5, 2009 4:32 AM
  • When idle MsMpEng.exe should use about 55-60-mb of ram. The multiple instances of MsMpEng.exe is surprising. Do you have Windows Defender turned on? If so disabling Defender should resolve this issue.
    Jim - MVP Windows Live - Forum Moderator - Live One Care - Live Mesh - Microsoft Security Essentials
    Wednesday, August 5, 2009 4:50 AM
  • okay i just went and checked, and windows defender has been disabled.  It apparently has been disabled this whole time,  but it for sure is now, and i'm idling at50% right now with no other applications open. I know it's the msmpeng it's running   wait HOLY COW i just went and checked my system resource monitor again, and BOY it's never been so hi!!! there are like maybe ONE HUNDRED instances of MSMPENG running in my "Disk" tab NOT under ram, it IS running under ram, and at 177,276 kb/sec read/write (the highest on the RAM list) but NOW i'm noticing under DISK not RAM it's running hundreds of instances, and the graph is going crazy, and it's scaring me, i just bought all new components from scratch off tiger and newegg and built my first computer and haven't had any issues like this till now..

    Okay right now, i'm idling at %55 ram and have over a hundred instances of msmpeng open under "disk"

    Wednesday, August 5, 2009 5:08 AM
  • It is normal to see a lot of entries on disc activity since One Care uses the paging file and scans every file on access. In Task Manager how much ram is MsMpEng.exe using? To be able to see MsMpEng.exe you will have to select "Show processes from all users" on the processes tab.
    Jim - MVP Windows Live - Forum Moderator - Live One Care - Live Mesh - Microsoft Security Essentials
    Wednesday, August 5, 2009 5:27 AM
  • Well i've clicked all users, and then I go into the resource monitor, and I'm holding steady at 55% right now on my Ram monitor on my windows sidebar. 

    I have 4 gb of 1333 ram synced and linked to my 1333 fsb so i should not be running fifty percent at idle.  It's weird,  becuase it only came after I installed one-care.  And I was using Norton on my laptop. and then Directly after instlaling onecare and removing norton from my laptop, my ram ALWAYS ran at 50% and they always used to run closer to 25 on my laptop. 

    And then after installing onecare here on this new system ,  my ram idle runs fity. This is annoying.    I'm going to try and uninstall one care,  and then run that system cleaner,  and then i'm going to see if my ram runs lower than 50.  it's running 55 right now, and has been for about two days straight.  THe last three hours straight through that i've had this computer on.

    No I can't see percentages or anything like on my cpu/ram monitor,  but i  can see that it's using 177,000 Kb/sec  or something to that effect.

    So I should uninstall and run system remover, and then report back as to whether my RAM returns to normal..?  Kay i'll update you

    Wednesday, August 5, 2009 5:49 AM
  • I read through the thread and I'm a bit confused. Are you referring to 50% CPU or 50% of your RAM in use. In either case, that's a bit unsual, but not unheard of.
    I'm running 64 bit Vista on the laptop here with OneCare and the machine has 3 gigs of RAM in it. CPU is at about 10 to 20% most of the time, with quite a few processes running. RAM usage is well above 50% - 1800 Mb right now - with IE, Outlook, Messenger, Feed Demon, Live mesh, Live Sync, and numerous driver and tray applets along with the sidebar.
    I'm not sure that there is a problem on your system.
    MSMPENG problems are reflected in CPU utilization. It can conflict with programs and drivers, causing a lock condition and CPU utilization of near 100% for long periods.
    If you believe that MSMPENG is causing you issues, then I'd suggest removing OneCare to see if things go back to what you expect on that machine. If so, reinstall OneCare and contact support to determine if you have a driver conflict.
    If you are seeing 50% of your RAM in use, that's not abnormal at all. The only time you should be concerned about RAM usage is if it nears 100% because that means that Windows needs to start swapping to the pagefile on disk and that will impact performance.

    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Wednesday, August 5, 2009 12:22 PM
  • well my ram idles at near 30%  always had until onecare.  And on this new machine,  my RAM ran it like 27%   the first few days (4 gigs with zune and magic jack installed), then on like day four or five i installed onecare, and my ram opens up at 30, just like it used to, but the second I open ANY program, whether IE or word or zune or media player,  my ram will instantly shoot up to and run much higher than without one care.  T

    THank you steve for reading through ,  I'm going to uninstall onecare now, and then see if I feel like my RAM is running normal or lower.  When I said last time that i was going to uninstall it, i simply powered down, and cooled off and booted up again,  and it runs around 30 until i open any program , then it's MUCH higher than normal
    Wednesday, August 5, 2009 3:07 PM
  • I'll be interested in your results.
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Wednesday, August 5, 2009 6:18 PM
  • Hi guys. well so this, it's not cpu it's ram, sorry.  But my cpu runs at zero more than one, most of the time.  0-1, but when it's idling it's at zero more than one.  I am used to that on both my broken laptop and this machine,  I delete everything and disable thingls like "AddFltr" and "Adobe" because I like running at zero / idling really low, makes me feel clean and like my machine is in it's best shape.

    And when idling at zero to one i'm used to the ram being 27 sometimes 28 and I have noticed that it's after onecare that my RAM is running much higher always,  and if I'm not idling like doing something simple like listen to music or browse the internet it's at fifty , maybe doing one or two small things.

    Yes sir i'm going to uninstall it and reinstall it.  and see how my system is without it and then notice any changes...  thanks for your patience..!

    Wednesday, August 5, 2009 10:54 PM
  • Okay Hello guys, I've unistalled OneCare and now i'm running at 25% idle all the time,  now here with the internet open and me typing to you, i'mcurrently a tthis instant at 29%. I'm openning up my zune music player right now...  just shot up to 34%  i'm running 34 playing music and browing the internet whereas with onecare i'm doing those two things simultaneously at 50% 54%  
    Wednesday, August 5, 2009 11:22 PM
  • My cpu runs at zero, one when idling,  right now typing this to you with zune open i'm at 1 2 4 2 1 2 2 percent staying really low,  and my ram is at 35% right now with the zune and internet open.  I'm going to install onecare now and see if it goes up, slightly is okay.  but taking me from 35 to 50 is really annoying, especially if it's supposed to be running 50 to 60 mb of ram
    Wednesday, August 5, 2009 11:24 PM
  • Just a thought - when you open the Zune software with OneCare installed, if the Zune software is scanning your library and updating DRM licenses or tags, this will cause MSMPENG to scan all of that activity, using more RAM and CPU.
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Thursday, August 6, 2009 12:45 AM
  • hello i can't see anyone's responses anymore, i can see that the last reply was fifty three minutes ago, but I can't see it my last resply on the string is two hours and thiry seven minutes ago,  i can't see MY posts i write and i can't see anyones responses.   the last post on my screen is from stephen boots, left "two hours and thirty six minutes ago" or something i just scrolled down to check
    Thursday, August 6, 2009 1:48 AM
  • kay i',m back i can see, yeah okay but with the zune software disabled as a service, and as a startup, and then i went into the sys config and found that even though windows defender is disabled, it is a startup service that was still enabled, so i disabled it as a startup service.

    Any reason why, idle, without zune openned and with it disabled, that my RAM would be running almost ten percent higher at idle simply by having onecare installed.  That's what i want to get to the bottom of.

    so i've gone through the cycle of completely removing from my machine, and then looking at my system, and i can see that idle my system ram runs higher with oncare installed, AND with any number of programs running it's MUCH higher than normal
    Thursday, August 6, 2009 5:21 AM
  • I think that your experience may well be normal. Although OneCare is a light program from a resource perspective, it still uses resources as available. Without knowing the guts of your system and poring over all of the details of services and programs and drivers, I can't begin to speculate what exactly you are seeing. Personally, I would not be concerned. If it bothers you, I'd seek an alternative security package.
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Thursday, August 6, 2009 11:36 AM
  • Well I've been trying to just live with this knowledge of what's eating my RAM.

    I've left it alone for a few days now,  and I idle,  i IDLE with NOTHING running at all,  above 40%.

    Around 42%.   When I get into Zune and Iexplorer or any other application, I'm up to 50%  and then no matter what I open , like multiple Iexplorers, or word and excel and zune and iexplorere, it stays at around 50%. 

    This i noticed on my laptop after intalling onecare, that it idled much higher and I was always hovering around 50 when doing ANYTYHING.

    Stephen et all - when I am idling I idle above 40.  (this according to my sidebar cpu/ram monitor.)

    When onecare is not installed,  i'm always BELOW thirty,  ie 27 -28 quite common, and when I had 8gb installed of RAM i was around 17% at idle. 

    So YES it bothers me that after ignoring the problem for a few days,  I just CAN"T ignore it because I NOTICE that my machine is running at 43% idle instead of 27% idle.

    What is Searchindexer.exe.  I am noticing all of the sudden now this in my ram resource monitor... and it is always right below the highest running  msmpeng, near the top of the list.
    Sunday, August 9, 2009 2:46 AM
  • Searchindexer is the Vista indexing service. The indexing service allows you to find things quickly when searching your computer. This is an explanation of how Vista uses ram - http://mintywhite.com/tech/vista/why-does-vista-use-so-much-ram-an-explanation-of-superfetch/#comment-10690
    Jim - MVP Windows Live - Forum Moderator - Live One Care - Live Mesh - Microsoft Security Essentials
    Sunday, August 9, 2009 4:35 AM
  • Wow  Thank you for the article.

    That was very eye openning and i liked it.

    I value and validate what the article says, 

    I notice that vista only uses 27 % when idle without onecare, and idles at 42% WITH it now,  that's after letting everything settle in for the last few days.    ,  i mean, i feel specifially onecare is responsible for such high ram usage,  At this instant I'm only got IE open with this one tab, and i'm at 44.  when i close it i drop down to forty two.   Am I kicking a dead horse here

    But when onecare is uninstalled,  I SWEAR it i run 27%.  ALL the time idling.  Even here with this ie open i'd be running at 29 maybe 30%. 

    THese numbers are like this and i'm so sure, becuase I just built this computer with all new components on Jul 31.  It's brand new and clean,  and i'm monitoring my sysetm as I add on,    and to go from 27  to 42   at idle with one program is bothersome.  Is it fixable?
    Sunday, August 9, 2009 6:23 AM
  • Apparently you still don't understand the true purpose behind SuperFetch.

    The reason that SuperFetch pre-loads commonly used applications into RAM memory is to avoid the delays caused by reading these programs from much slower hard disk when they are requested (clicked).  Since disk is 100's to 1000s of times slower than RAM, this is what usually causes the long lags that occur when you first start a program on a freshly booted PC.

    Windows Live OneCare is a fairly large application that includes several modules to support not only anti-malware, but also firewall, backup, the Hub/Circle ability and even WiFi security.  All of these modules plus the additional malware detections and other support could easily use much of the memory you've indicated is now being used.  However, it's also possible that other programs not directly related to OneCare are using some of this too, such as the SearchIndexer or other background support applications that you may have unknowingly added.

    The key point here is that unused memory is simply wasted, so worrying about having 50% in use when there is around 2GB RAM still available makes no sense.  The entire idea behind SuperFetch is to place some of this otherwise wasted memory in use with things you are likely to use based on past usage patterns.  It doesn't just stuff the RAM with anything available, rather it looks for things you have often used in the past and pre-loads these.

    However, once it begins to run out of available RAM it will also begin to scale back what is loaded and prioritize them based on which are used the most.  In other words, if you being using a program like Word regularly, but almost never open the main OneCare GUI, it might pre-load a portion of Word and not Onecare.  This isn't likely since most portions of Onecare are normally being heavily used in the background, but just a possible example.

    So the idea that you must try to keep the percentage of RAM used low is outmoded and exists from past operating system designs.  In fact, one of the true wastes of RAM in your PC is the program you use to monitor these numbers, since it adds absolutely nothing to the true performance of tha PC and instead simply takes some amount of available RAM away from something else it might be used for to display these numbers to you.

    This is one of the paradoxes of a well designed modern operating system, since the user is really much too slow and often unable to truly understand what is actually best for the operation of the PC.  The operating systems have moved so far beyond what most users understand that they are instead often trying to disable the very functions that make the PC oprate more effectively.

    Sunday, August 9, 2009 4:37 PM
  • I think I understand how superfetch helps load programs.  Can you please explain to me WHY that explains to YOU why I run at 27% without onecare and 42%  WITH onecare.

    From what i understand, superfetch uses RAM to load the most commonly used programs more quickly.

    I don't understand how that would make my RAM run at 27% with NO onecare and 42%  WITH onecare,  especially given I just build this machin last week and have nothing installed. 

    (i enjoy this feeling of having a new, "fresh" powerful machine)

    WAIT WHOOOAAAA.... Wait now.   I just finished Re-REading the above post.

    Thank you.

    Good to hear,  yeah what you say makes sense about vista and a good operating system.  My experience has been that vista takes care of everything and is the ultimate.  I enjoy the security and intuitiveness of Vista.  Thank you for putting me in my place

    Okay lets start over.   IF my RAM on my MONITOR on the Windows sidebar (i don't use any third party monitoring i'm only using control panel resource monitor  and my CPU/Ram gauge on my sidebar)  So if My RAM there is running between thirty and 50 percent,   but at ALL IDLE TIMES (i'm talking EVERY IDLE SECOND)  my CPU  runs at ZERO,  zero to one,  and then back to ZERO,  then I"m in good shape..? 

    I mean, part of monitoring my new fresh system is also monitoring what background and updaters and reporting services are running  and MINIMIZING and OBLITERATING those, to a point where I am always idling at zero to one percent CPU,   So THAT CLEARLY MEANS I AM NOT RUNNING STUFF ALL THE TIME AND MY SYSTEM ISN'T BEING BOGGED DOWN,  AS THOUGH TO SAY THAT I'VE DONE A GOOD JOB AT MAINTAINING A CLEAN SYSTEM.  So running 42% ram with onecare open versus 27% with no onecare is just the cost of having onecare monitor my system  AND that coupled with my CPU always running at zero (it's at zero right now as i'm typing this, it's my first computer with my first overclock, q9550 and 4gb ram,  all linked and synced at 1600mhz)

    JUst from reading my posts and gauging where my comprehension is at, is there anything else you can tell me along the lines of "since the user si really much too slow and often unable to truly understand what is actually best for the operation of the PC."  I mean is there anything that YOU"VE learned that just jumps out at you as something you can tell I don't know but could help me...?

    Thanks again for your above post.  Makes sense i appreciate that. 

    Sunday, August 9, 2009 7:08 PM
  • OK, to avoid the longest post I've ever written and try to keep this somewhat close to the original 'issue' of memory usage by OneCare, I'm going to make just a few basic points.

    First, you actually pointed out something I wasn't aware of, the CPU Meter Gadget in the Vista Sidebar.  However, the reason I had no idea it was there is that I immediately turned off the Sidebar on my own Vista the moment I finished installation, simply because to me it's nothing but 'noise' and uses valuable screen space.  I also noted when I turned it on to find the gadget you were describing that it was using about 33MB of RAM, which I consider fairly costly for so much 'eye candy'.

    Second, I understand your interest in keeping your new PC 'clean' and wanting to keep the extra junk that's running to a minimum.  However, you take that to far more of an extreme than I do, though there's really nothing wrong with it as long as you don't disable anything critical.  Your interests in overclocking and RAM/BUS speeds approach what I'd call 'tweaking', but again, that's just today's version of someone fiddling with their car trying to get the maximum performance for the least cost.  Again, nothing wrong as long as you don't burn up components trying to get the last 2% of speed out of it, since it's much cheaper to just buy a faster CPU/RAM/MB/DISK whatever.

    The core discussion here centers around what is actually sitting 'idle' in your RAM, since that's what the CPU Meter really isn't telling you.  It just so happens that Windows Vista itself (Sidebar is an MS 'third-party' add-on, not part of Windows itself, just included with it) has a much more effective tool called 'Resource Monitor'.  The way I access this is to open 'Task Manager' by right-clicking on the Task Bar and then click the button on the lower right of that dialog.  Resource Monitor is much more complete and deatailed than that little gadget and allows you to determine exactly what's using CPU, RAM, Network, or Disk.

    With the amount of raw power you appear to have in that PC, I wouldn't be too worried about the little things, though keeping a handle on what is installed and running is always a good thing.  You simply need to learn how Windows Vista really works, which as I mentioned earlier is something very few today really understand.  Most just go by hearsay from friends or even worse the many urban legends that have grown into what can almost be considered a religion of the 'techies' today.

    As for the actual RAM use by Onecare itself, yes it is fairly large.  The best way to reduce it might be to look at things like the new Microsoft Security Essentials (MSE) anti-malware product which is currently in beta and planned to replace OneCare starting later this year.  Since it contains none of the add-ons like backup, firewall, Hub/Circle or WiFi protection, it has a much smaller footprint and so uses much less RAM.  Of course, you'll need to find other packages to perform backup, but most of the other parts of OneCare were added for Windows XP or special situations which many users don't require.

    Sunday, August 9, 2009 8:43 PM