locked
MsMpEng.exe memory problem RRS feed

  • Question

  • Hi,
    I have Windows Vista Ultimate 64-bit Edition.

    I just installed Windows Live OneCare and scanned my PC. PC not doing anything else but scanning, I returned to the PC hours later, apparently the scanned had finished and closed automatically.

    I saw a notification that there was not enough memory and that I should restart my OC so that the memory occupied by open programs could be released.

    I started task manager and found that all the processes were not utilizing any significant amount of memory, a few were utilizing in a range of 1-8 Mb.

    I clicked SHOW PROCESSES FROM ALL USERS, and then resrranged the list indescending order of memory occupation, and to my surprise, MsMpEng.exe was occupying 148,000 KB roughly.

    The memory keeps swinging back and forth to a maximum of 150,xxx KB to a minimum of 145,xxx KB.

    I read other forums and they said that its because the computer had been recently booted or turned on from standby and so its occupying memory and CPU.

    BUT in my case, its not recently booted or awaken from standby, its been constantly turned ON, and the important aspect is that the CPU usage is 0% or 1% ONLY, though the memory does swing back n forth as I mentioned and is not constant... a few KBs here and there.

    It appears as some sort of memory leak.

    FYI, I just downloaded the OneCare, so it must be the most recent version...

    I was happy to get OneCare, seemed impressive, but these issues severely apply a question mark on its usage any longer!

    Thank you!
    Awaiting reply...

    EDIT:
    Oh and its been an hour or more since Im on my desk using the PC and the memory is still occupied while CPU = 0% or 1% occasionally by the MsMpEng.exe
    Thanks!

    And my system is:

    DELL Latitude D820
    Intel Core 2 Duo T7200, 2.0 GHz, 4 MB L2 Cache
    2 GB RAM 667 MHz FSB, DDR-2
    256 + 256 MB NVidia Quadro NVS 120M
    Thats it!
    Monday, September 14, 2009 11:57 AM

Answers

  • That is the normal range for memory usage for MSMPENG.exe. This is the real time scanning engine for OneCare and it will be active as long as your PC is running. It scans all processes and all disc reads and writes.
    Had you also reported high CPU, I'd suspect a conflict, but I believe that what you are seeing is quite normal.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Monday, September 14, 2009 12:19 PM
    Moderator

All replies

  • That is the normal range for memory usage for MSMPENG.exe. This is the real time scanning engine for OneCare and it will be active as long as your PC is running. It scans all processes and all disc reads and writes.
    Had you also reported high CPU, I'd suspect a conflict, but I believe that what you are seeing is quite normal.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Monday, September 14, 2009 12:19 PM
    Moderator
  • Hi, thanks for the reply,

    But it had been long since it had scanned the PC and there was no activity whatsoever, the CPU usage as I already said was 0% or 1%, nothing more...

    I just checked again and now its 48,xxx KB, so it means that it had taken up the memory which it had utilized during the scanning process earlier and it DID NOT RELEASE the memory afterwards, so its sort of a memory LEAK!

    Moreover, if this program occupies 150 MB and you say its normal, Internet Explorer also every now and then occupied similar amount, then what else to expect? I'm out of memory... Im out of memory to run any other decent program... So I must have 8 Gb or so then...?

    Its not normal BTW to have 150 MB allocated to an IDLE process!!!!!!!!

    Monday, September 14, 2009 9:16 PM
  • That's a tiny percentage of your memory usage and perfectly normal. Windows manages the memory usage of applications and services. If you were to reach the absolute limit of your system memory, which is highly unlikely with most typical software, Windows would start swapping to disk.
    There is no memory leak with OneCare indicated by the numbers your presented. Once again, at absolute idle, with no activity whatsoever, I expect to see msmpeng consuming under 100K of RAM. It can consume 150K when it is actively looking at processes and disk reads. That's what active protection means. It can consume more when doing a full scan of the system, updating itself, etc. It releases RAM when it no longer needs it.
    -steve


    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Tuesday, September 15, 2009 1:31 PM
    Moderator
  • Thanks!
    And whats the difference between Windows Defender and LIVE OneCare? Both operate in accordance but...
    Tuesday, September 15, 2009 5:46 PM
  • They use the same engine and the definitions are supplied by the same antimalware group at Microsoft. Defender does not protect against viruses and trojans, nor does it have the additional OneCare features. OneCare expands on the protection offered by Defender.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Wednesday, September 16, 2009 1:09 PM
    Moderator
  • then of  what use is defender? i mean what does it really do?
    Wednesday, September 16, 2009 1:20 PM
  • Defender protects against spyware and malicious processes trying to make system changes like hijacks.
    http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
    It works in concert with antivirus protection. If you use MSE, it disables Defender since that protection is incorporated into MSE.

    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Wednesday, September 16, 2009 2:07 PM
    Moderator
  • Hello Stephen,

    I've noted a high memory usage during scan operations. Today my PC was using 1.86gb. I stopped the scheduled scan (which was running) and waited. MsmpEng was still using 30-50% of cpu.

    I decided to kill it. surprise! Last time i did it (vista 64) I recovered 500MB of ram (few days ago). Today I recovered 900MB! (I am now using windows 7 64)

    Task Manager don't show up which process was using the memory. It showed forefront using 150 or so MB of ram. So, something is hidden...

    Now, after a while, forefront reloaded. My memory usage /including this browser window which was not opened before) is 1.19MB.

    Is there an easy tool to track down process memory usage? Because I don't understand where my 900MB of RAM had gone...

    Regards,

    Jorge

    Yop
    Wednesday, November 18, 2009 6:46 PM
  • Hello, Jorge.
    I'm not sure that I'd call it easy, but you can use this: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    When you look as task manager for RAM usuage (and CPU) you need to show processes from all users in order to get a complete listing. However, many of the entries will be rather generic like svchost - which is a container for multiple processes and several instances can be running at once.
    MSMPENG using even 30-50% of CPU would indicate that it was still scanning/reading something. This can mean that some other process was actively accessing files and memory and MSMPENG was stepping in to check it out. It shouldn't last long, though. When that happens, it typically means that something is in conflict with the engine.
    Note that there is a set of forums on the Technet side for Forefront Client Security. MSMPENG is shared by ForeFront, OneCare(this forum), Defender and Microsoft Security Essentials.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Wednesday, November 18, 2009 7:47 PM
    Moderator
  • Hi Steve,

    With regards to the high CPU usage of MsMpEng.exe, I'm having the same problem and am wondering what I can do about it. I understand that it scans every time I turn my computer on -- so does that mean I need to wait 15-20 minutes each time before I can open anything? That's what I've noticed since I downloaded it a couple days ago... takes about that amount of time, and in the meantime, I can't do anything as my computer is completely frozen. Seems kinda weird, I've never had this lag with any other anti-malware.

    Thanks!
    Rachel
    Saturday, November 21, 2009 8:19 PM
  • Hello, Rachel.
    Are you using Windows Live OneCare, Windows Defender, or Microsoft Security Essentials? Are you running any other security software in addition to OneCare or MSE? If you are running MSE or OneCare, is Defender disabled?
    The most likely cause of high CPU for MSMPENG, even during a "quick scan" at start, is that something is conflicting with the scan process.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, November 23, 2009 2:24 PM
    Moderator
  • HI,

    got the same problem here with MSSE. On my stone-old notebook (512 MB RAM, very slow hard disk) i'm not really happy with the memory usage of this process. Sometimes (probably after signature updates, mostly first 10-20 minutes after boot) it takes 150m physical + up to 250 MB virtual memory. Because of the very slow hard disk, i've limited the swap file to 250 MB. Starting some programs in this phase causes often "not enough virtual memory" errors. Is there any way to limit the memory usage of this program? CPU usage is not an issue, the hard disk is the bottleneck swapping memory all the time. Unfortunately, there is no way to upgrade physical memory.

    Thanks in advance!

    Friday, May 14, 2010 2:02 PM
  • HI,

    got the same problem here with MSSE. On my stone-old notebook (512 MB RAM, very slow hard disk) i'm not really happy with the memory usage of this process. Sometimes (probably after signature updates, mostly first 10-20 minutes after boot) it takes 150m physical + up to 250 MB virtual memory. Because of the very slow hard disk, i've limited the swap file to 250 MB. Starting some programs in this phase causes often "not enough virtual memory" errors. Is there any way to limit the memory usage of this program? CPU usage is not an issue, the hard disk is the bottleneck swapping memory all the time. Unfortunately, there is no way to upgrade physical memory.

    Thanks in advance!


    Wrong forum, Nagy. This one is for OneCare. I'll paste the response that your post would get over in the MSE forums for our issue, though. While scanning, MSE will use a bit more memory as it loads files and scans them. At startup, real time protection can certainly run into issues as many services and programs are also starting up.

    Personally, with a slow hard drive and low memory, I'd *not* limit the swap file. Performance is going to suffer on a vintage machine anyway. You'd be better off managing your startup and removing programs from startup that you don't need and minimizing what runs all the time.

    Note also the link to the removal tools, which brings you to the correct forums for MSE.

    What operating system?

    Prior Security Software?

    Any security software still installed?

    A possible reason for this problem is that you have conflicting security software installed fully or partially on the PC. Remove all other security software from the PC.

    You may need to use a cleanup tool to remove your prior security software:

    http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91

     

    If that fails to resolve the problem, open an email support case:

     

    To open an email support case, start here:

    https://support.microsoftsecurityessentials.com/

     

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Friday, May 14, 2010 2:34 PM
    Moderator