locked
MsMpEng.exe

    Question

  • I know I am the thousandth person with this problem.  Everybody talks, but is there a quick fix?  I have two computers with OneCare and both are tied up with this process!  Thanks for any pointers.
    Friday, January 18, 2008 2:30 PM

Answers

  • If MSMPENG.EXE is constantly consuming excessive memory and CPU, there is a conflict on your PC with another process or service. I would recommend disabling all startup items via MSCONFIG. If the problem goes away, enable startup items one at a time until the conflict is identified. You can also contact support for assistance.

    There has been no single item identified that causes the MSMPENG CPU problem. This problem was very high in v1.5, but was mostly resolved in v1.6 and v2.0. There may still be some lingering conflicts that need to be identified.

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

    -steve
    Friday, January 18, 2008 4:01 PM

All replies

  • If MSMPENG.EXE is constantly consuming excessive memory and CPU, there is a conflict on your PC with another process or service. I would recommend disabling all startup items via MSCONFIG. If the problem goes away, enable startup items one at a time until the conflict is identified. You can also contact support for assistance.

    There has been no single item identified that causes the MSMPENG CPU problem. This problem was very high in v1.5, but was mostly resolved in v1.6 and v2.0. There may still be some lingering conflicts that need to be identified.

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

    -steve
    Friday, January 18, 2008 4:01 PM
  • Hello Stephen - you helped me out a while ago when OneCare was launched after the Beta, but not in the UK

     

    I have had the MsMpEng.exe problem again after upgrading Office to 2007 on one PC. 

    There was a cure which had previously worked for me on 3 PC's - (Dell Dimension Celeron with XP Home, and Dell Laptop and Toshiba laptops with XP Pro) which was posted at:

    http://forums.microsoft.com/windowsonecare/showpost.aspx?postid=1247403&siteid=2&sb=0&d=1&at=7&ft=11&tf=0&pageid=0

     

    Searching today, I could not find this on the Forum.  Fortunately I had saved this much of it last time (to my suprise):

    "MsMpEng.exe It has been a few months since I installed Windows Live OneCare and results are mixed. For the most part it runs quietly in the background providing, at least I think, real-time protection. The problem the last few starts has been MsMpEng.exe (Windows Defender) crippling my machine with heavy CPU utilization. I've Googled, Live- Searched, MS-Knowledge Base searched and found basically the same thing... High CPU... but no resolution.

    I dug through OneCare help and still didn't find anything. Therefore I decided to look in the registry and found: HKLM | One Care Protection | Exclusions. Under Exclusions I found three folders: Extensions, Paths, and Processes. I know through the One Care GUI I can designate folders and files for exclusion. I have excluded a few folders and found these in Paths. On a whim, I decided to add MsMpEng.exe in Processes. I was initially blocked lacking permission. I added full control and then added the DWORD: MsMpEng.exe having a data value of 0. I restored the permissions and restarted. After the restart, MsMpEng.exe has not consumed more than 50% CPU at startup (for only a brief time) and then occasionally 7-10% when browsing or starting other applications. For the most part it runs quietly at 0% I'm only guessing, but MsMpEng.exe may have been monitoring MsMpEng.exe. So far so good..."

    I hope it may help.

     

    I appreciate mucking about with Regedit.exe can be risky.  And that there can be so many variables.  But it has worked for me four times now.  Perhaps I should have sent some feedback earlier.

     

    Was MpMsEng.exe chasing its tail? 

     

    All the best

     

    Friday, February 01, 2008 10:18 PM
  • Thanks, James.

     I don't know about tail chasing, but I do know - "Life's always an adventure with computers."

     

     

    -steve

    Saturday, February 02, 2008 4:00 AM
  • That's a useful tip:- one should always check for this sort of issue: but we never do.

     

    Unfortunately for me it wasn't in the registry. My problem seems to occur after standby, I haven't really noticed it on a reboot. It eventually goes away after 2 or 3 minutes thus nearly negating one of the advantages of going to standby.

     

    Is there some reason why coming out of standby would contribute to the program guzzling my computer's CPU

     

    My system freezes until MsMPEng is no longer busy. Would a dual cpu system still freeze? Has anyone with a dual cpu been heavily effected by this problem?

     

    I have checked the proirity setting of this process and it is normal.

     

    The only? conclusion that explains thus behaviour is that it is locking out other processes and it is "eating" CPU.

     

    What locks is this process making that could be causing this and why?

     

    Thursday, April 03, 2008 8:37 AM
  • MSMPENG is the antimalware detection engine shared by OneCare and Windows Defender. It is watching processes and other real time activity as things load into memory. So, when booting the PC or resuming from Standby, lots of processes are access RAM and swapping memory from disk, etc. MSMPENG is going to be "Scanning" all of that activity. If it really drags down the system, it usually means that something else is also trying to grab the processes or that something is acting in a way that MSMPENG has to keep scanning. I won't go as far as to call it an endless loop, since it stops after a 2 to 3 minute period in your case, but it could still be a repetitious loop that MSMPENG is finding itself in during those 2 or 3 minutes.

    -steve

     

    Thursday, April 03, 2008 4:08 PM
  • My computer also experiences a 3-4 min periods of CPU "suckage" after a startup. Well to be more precise, whenever I start up my pc in a new day. For instance, I put my pc to sleep before midnight. I turn it on in the morning and notice MSMPENG working away. After some time, my CPU usage is nearly nil. Are you seeing what I'm going with this? It's doing a windows update if it's setup for automatic update on a daily basis. Just for verification, you can open up ONECARE and check when it was last updated. As for today, I turned on my pc, waited for a few minutes for things to calm down. If I open up ONECARE, it says that my "virus and spyware definition" are "up-to-date as of 21/04/2008". Which is good right? I decide to put my pc to sleep once again. I wake it up and don't experience any CPU drainage whatsoever, well not for minutes. I sure it's watching processes and other real time activities like you mentioned above. Nevertheless, it will want to update your virus definitions and whatnot. 

     

    So know your ONECARE settings and be patient. It's doing what its designed and setup to do.

     

    P.S. People should mention what they are running and on what they are running it. It's relevant in many cases.

     

    MB:        ASUS – A8N SLI Deluxe

    CPU:      AMD Athlon 64

    RAM:     OCZ 1024 MB – Platinum Dual Channel PC3200

    VC:         NVIDIA XFX GeForce 7600 GT 256 MB

    HD:         WD 40 GB, Maxtor 160 GB, Maxtor SATA 320 GB

    PSU:       OCZ GameXstream 600 W

    Mon:       Acer AL2223W

    OS:         Win XP Pro 5.1 SP 2

    AV/F:     ONECARE V 2.0.2500.22

     

    @ Startup: onecare, Win Live Messenger, Wincustomise, Brother Controlcenter3, DLINK WDA

     

    SAS

     

    Monday, April 21, 2008 4:23 PM
  • MsMpEng.exe, which is the scanner of Windows Defender, indeed consume some volumes of CPU, but this is not always, this only happnes when Windows Defender is scanning your PC.
    You will discover this because you will se activity in the HDD of your machine.
    On the other side this scanning is not done over the whole machine, just the most important files (generally system files) and it's called Quck Scan, then it do not take long time to end.
    When this scanning is ended your machine wont have this MsMpEng.exe running, waiting for the next Quick Scan.
    You can do the following:
    a) immediatly stop the scan by calling Windows Defender and stopping it.
    b) remove schedule scan form Windows Defender in Options. Recomedation is to keep it on schedule.
    c) change hour of this scheduled scanning to a more convenient for your activities, for instance during your lunch times.
    Anyway always will be present on-line protectcion that Windows Defender suppose to give.


    Tuesday, May 27, 2008 1:14 PM
  • Daremo:

    Note that msmpeng is also active with Windows Live OneCare, which is the subject of this forum. OneCare disables the Defender interface and incorporates (and adds to) Defender's protection. You are correct in that the process will consume the most CPU during a scan. However, when OneCare is installed, this process will remain active at all times, albeit using very little CPU and RAM. The rest of your advice does not apply to this process when OneCare is installed, only when one is using Defender alone.

    -steve 

     

    Tuesday, May 27, 2008 1:40 PM
  • when you say "little" do you mean 50MB of RAM? My msmpeng is not utilising any CPU but is constantly utilising 50MB of RAM? I have 512MB so that is 10% of my available RAM.

    Kevin.

    Sunday, June 01, 2008 2:24 PM
  • My Vista machine currently shows that it is using 61,228 K of RAM.

    -steve

     

    Monday, June 02, 2008 1:42 AM
  • I assume that you are looking the "use of memory" that is shown in Windows Task Manager, that's virtual memory which resides in HDD and used by the system when it's needed. If you look at the rest of process shown in the same Task Manager screen, the sum will over pass largerly 512 mb.
    When a process is in that list and has a value of 00 in CPU means that the process is ready but not active or not comsumening resources of the system.
    Monday, June 02, 2008 2:33 PM
  • Thanks for the response Daremo. However it still doesn't quite sit right with me. This is why:

     

    When I click on the "Performance" tab of the "Task Manager", it shows the following:

    Physical Memory (K)

    Total 515,568

    Available 85,856

    System Cache 169,288

     

    My point being, if the process with 00 in CPU (of which there are loads) is not consuming the "RAM" resources, then shouldn't the available physical memore be higher?

     

    BTW, the CPU is at 10% when I was doing these tests.

     

    Kevin,

     

     

     

    Sunday, June 08, 2008 1:46 AM
  • In the same screen you have to two measures: the one you mentioned (10% of CPU use) which is real memory and another which is PF (Page File) use. This last one shows more or less the total of process which are displayed in process detailed screen. This are the process in HDD which arent using physical or real memory... but this is not so exactly as each process needs to have some sort of pointer, flag or alarm that will trigger the loading from PF to real memory.
    I think that this small pieces of sotware have to consume small parts of real memory, that are in the difference between 515.568 - 85.856 is the real memory actually in use and are marked as 00 in CPU.
    Sunday, June 08, 2008 5:09 PM
  • Much has been added to the thread since.

     

    Coleman's .Net Nuggets

     

    Cheers.

    Coleman
    Friday, June 20, 2008 6:16 AM
  • Quick fix solution for msmpeng.exe.

     

    This is a nasty one.  The more you try to shut it down the worse it gets!  Mine was bundled with 5 Trojan spyware programs which Live OneCare didn't find, but that's ok b/c you can't manually remove them without making the problem worse.  These programs get into everything. EASY SOLUTION:

     

    1. Find any viruses with Love OneCare.

    2. Delete or quarentine viruses.

    3. Do a system restore to the day you got the problem.

    Saturday, June 28, 2008 5:50 PM

  • Thanks, James.

     I don't know about tail chasing, but I do know - "Life's always an adventure with computers."

     

    -steve


    Don't you mean: "Life's always an adventure with Windows?"
    Thursday, July 24, 2008 11:25 AM
  •  

    After reviewing information on the Internet regarding MSMPENG.EXE and high CPU utilization I found many references to peer networking being the problem. I did not have peer networking enabled on my WinXP Home computer so I continued looking at what I could see on my computer.

     

    What I found was that it seemed directly related to Windows Live Mail. I could not pinpoint exactly what was happening but imagined that it had something to do with my large archive of old messages that I keep (I'm a pack rat and have a hard time throwing away anything, although it has saved my *** many times).

     

    So I decided to export all of my messages and clear my active store in the hopes that minimizing the data footprint that I could eliminate the MSMPENG.EXE problem.

     

    What I found was that while exporting my CPU utilization peaked when I hit my active rss feeds. Many of which I do not view. The one that was problematic was a FLICKR feed that I established some time ago but never viewed. I had 41,000 unread messages in that feed.

     

    After deleting that feed and performing other general pruning of my feeds I set my feed update to one week.

     

    I then re-exported my Windows Live Folder and did not see MSMPENG.EXE peak CPU utilization again. I have not deleted my online mail store and as yet have not seen the CPU spike again.

     

    Just another area to look at in trying to resolve MSMPENG.EXE misbehavior.

     

     

    Monday, August 25, 2008 3:32 PM
  • Thanks for sharing that information, JoeBlow. Did your RSS feed from Flickr bring down the photos every time it updated? I recall that there were issues with large quantities of photo files, well - actually the thumbnails, with msmpeng many versions ago...

    -steve

     

    Monday, August 25, 2008 6:15 PM
  • Unfortunately, I couldn't tell you whether it actually brought down the photos or just contained http references to them. Looking back, it does seem that the bog down may have been related to the 15 min updates on web feeds that was set, although I can't be sure.

     

    Monday, August 25, 2008 11:41 PM
  • I have that problem on three computers.  Using msconfig the culprit appears to be Webroot's Spysweeper.  I have had the same problem in the past with Spyware Doctor.  It is safe to assume that most spyware programs are going to conflict with MsMpENG.exe?  Unfortunately OneCare does not give any indication that it is removing spyware, keyloggers, or trojans.  My current subscription is running out.  I am tempted to ditch OneCare for Zonealarm Security.  Comments would be appreciated.

    Friday, September 19, 2008 2:36 AM
  •  GroKenHaMMer wrote:

     It is safe to assume that most spyware programs are going to conflict with MsMpENG.exe?  Unfortunately OneCare does not give any indication that it is removing spyware, keyloggers, or trojans.  My current subscription is running out.  I am tempted to ditch OneCare for Zonealarm Security.  Comments would be appreciated.

    It's not really a direct conflict, since this would cause something to fail, it's simply one anti-malware product monitoring another's activity as suspicious, which is fundamentally true if you think about it. Trying to design any product to avoid this for all other potentially valid products which might be installed is a pointless effort and simply creates useless overhead.

     

    In order to judge what choice to make, you need to fully understand what each product does and what you personally prefer and expect from your security products. OneCare concentrates on detecting 'real' malware, so most non-malware related keyloggers, adware and cookies are simply ignored, since these are not considered malicious. It also attempts to be very quiet, with few alerts unless it's necessary to inform and protect the PC and/or the user.

     

    If you prefer a more agressive product that notifies you of the existence of any keylogger or cookies, even when these aren't necessarily malicious, or you like to be notified of every little thing it does, then OneCare may not be for you. It's also not really appropriate for those (usually techie types) who ascribe to the 'anti-malware of the month club', always changing the product they use for the next 'best' new product. OneCare is designed for the 'set it and forget it' crowd that just wants their security to protect them, not run their life.

     

    OneCareBear

    Saturday, September 20, 2008 3:27 AM
  • I have been running Live Onecare omn my computer for several month with no problem!

    About 5 days ago, my laptop started to be vevy slow and the MsMpENG.exe take between 90 and 99 % of the CPU.

    Nothing as been changed on the machine (maybe the latest windows updates).

    Is Microsoft going to find a quick solution to this!

    I was testing this on my PC, and we where planning to have it installed on our about 200 PC network.

    I cannot imagine what it would be, if a migrated all my PC's to Live Onecare and such a problem occurs!!!!!

    Those kind of problems should be resolved in 1 day by Microosft, and an automatic update release.

     

    This problem will make me wait and see what Microsft does about it before I migrate to Live Onecare from symantec.

     

    Serge

     

    Saturday, September 20, 2008 7:51 AM
  •  SMion wrote:

    I have been running Live Onecare omn my computer for several month with no problem!

    About 5 days ago, my laptop started to be vevy slow and the MsMpENG.exe take between 90 and 99 % of the CPU.

    Nothing as been changed on the machine (maybe the latest windows updates).

    Is Microsoft going to find a quick solution to this!

    I was testing this on my PC, and we where planning to have it installed on our about 200 PC network.

    I cannot imagine what it would be, if a migrated all my PC's to Live Onecare and such a problem occurs!!!!!

    Those kind of problems should be resolved in 1 day by Microosft, and an automatic update release.

     

    This problem will make me wait and see what Microsft does about it before I migrate to Live Onecare from symantec.

     

    Serge

     

    Serge, the only reason that I'm aware of for a CPU spike like that with MSMPENG is a conflict. If nothing has changed on your PC, I recommend that you contact support.

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

    -steve

    Tuesday, September 23, 2008 3:19 PM
  • There were two CPU hogs on my AMD 64 - 3000 one was Google Desktop which was consuming about 98 to 99 percent of the CPU process, upon removal the system freed up and was again high speed and functional.  However the MSMPEng.exe process was grabbing 50 to 80% of the CPU, but upon further checking it was performing a scheduled Full System Scan.  Upon completion of the scan the system resumed normal operations.  Additionally the Windows Defender Scan from MSMPEng.exe was executing over a period of several days but in a very reduced background mode because of the running of Google Desktop.

    Wednesday, October 29, 2008 7:29 PM
  •  SMion wrote:

    I have been running Live Onecare omn my computer for several month with no problem!

    About 5 days ago, my laptop started to be vevy slow and the MsMpENG.exe take between 90 and 99 % of the CPU.

    Nothing as been changed on the machine (maybe the latest windows updates).

    Is Microsoft going to find a quick solution to this!

    I was testing this on my PC, and we where planning to have it installed on our about 200 PC network.

    I cannot imagine what it would be, if a migrated all my PC's to Live Onecare and such a problem occurs!!!!!

    Those kind of problems should be resolved in 1 day by Microosft, and an automatic update release.

     

    This problem will make me wait and see what Microsft does about it before I migrate to Live Onecare from symantec.

     

    Serge

     



    Serge, I will say that the issue is not a great one to run into, but a 200 PC network... if you truely manage such a network, you are better off going with a corporate virus scan solution. One Care is not designed for use in such a large environment. There are many far better solutions including Ones from Microsoft, Trend Micro, Symantec, McAfee, and Computer Associates.

    OneCare is simply not designed with a network of that size in mind.

    Dave
    Thursday, October 30, 2008 7:20 PM

  • I see a lot of posts here, but NO answer to the problem.
    I just cured mine with the MSMpeng.exe

    click START
    RUN
    type in services.msc
    go to the MsMpEng.exe service, right click it
    Then left click PROPERTIES
    STOP the service, then DISABLE it.

    If you're running Windows Defender, you'll have to go back and ENABLE the service when you actually DO a scan.
    I tried Installing Live One Care on my computer and it kept crashing on installation, over and over and over.
    I tried like a Dozen times, and it never would install.
    I do have Defender, though.

    Hope this helps.

    Take care,

    Frank
    a.k.a.  talon1812@ the hot mail dot com

    Friday, November 14, 2008 9:19 AM
  • Frank, your PC has a problem is msmpeng is hogging the CPU and if OneCare would not run. By turning off the service, you have stopped Defender's real time protection.

    -steve

    Friday, November 14, 2008 2:15 PM
  • My computer was just using 100% CPU and 50% memory running MsMpEng.exe for over an hour. When I opened Windows Defender it was running a full computer scan, when the scan had finished I changed the scan settings to weekly and a later time at night.
    Monday, December 01, 2008 11:24 AM
  • Okay, this sounds like a doable fix, but how do you set permissons to full control? I tried giving full control to my account, to the administrators group to no avail. I ran regedit in admin mode - no help. so whats the trick? I am an admin on my machine.

    -jbb
    Wednesday, December 03, 2008 12:06 AM
  • Right click the shortcut or executable and select "run as administrator" to grant full control to a program or process.

    -steve

     

    Wednesday, December 03, 2008 3:23 AM
  • I recently reinstall vistaX64, reinstall windows live onecare ( i did my backup using it so i have to put it back), installed my new black friday bought Office 2007 and Adobe Photoshop/Premiere Elements.

    Now i'm having issues with MsMPeng.exe cpu 25% on idle, spike up more when i open other apps and worse when surfing the web.

    I want to make a clean install of office 2007 and adobe pse/pre intead of uninstalling the trials. MsMPeng.exe cpu usage was during start-up with svchost and very little afterwards on my vistax64. That was ok with me, wait few minutes then my pc is ok.

    I need help to control / solve this MsMPeng.exe cpu problem without me reformatting again. I need more details on how to regedit the one care protection ( wont let me even though i have full control and admin.

    I would never use Windows live onecare as a backup, will not but new windows os untill its black friday price ( remember vista bsod) office 2009>  maybe if its black friday price, other microsoft software NO MORE!

    Sunday, December 14, 2008 8:02 PM
  • It is not uncommon for msmpeng to spring into action when the PC is first started and also when you launch applications. Have you updated the Adobe product to the latest versions available from Adobe? I seem to recall that an older Adobe Updater was a factor in many reports of the CPU spikes.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Monday, December 15, 2008 2:46 AM
  • Here's a new angle on this problem that perhaps someone can help with. With expired anti spyware and anti virus software on Vista sp1 desktop, I downloaded and installed OneCare. Once up and running, I have noticed that Windows defender is continually disabled. I get that it is now part of onecare. The problem is that it triggers the security alerts in vista for being shut off. Any ideas?
    Sunday, January 04, 2009 7:01 PM
  • tvan999999 said:

    Here's a new angle on this problem that perhaps someone can help with. With expired anti spyware and anti virus software on Vista sp1 desktop, I downloaded and installed OneCare. Once up and running, I have noticed that Windows defender is continually disabled. I get that it is now part of onecare. The problem is that it triggers the security alerts in vista for being shut off. Any ideas?



    Have a look at the fix in this post:
    http://social.microsoft.com/forums/en-US/onecarefirewall/thread/c0ca9eb2-14b0-4591-be85-4b7fd1700191/

    -steve
    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Monday, January 05, 2009 4:31 PM
  • talon1812 said:


    I see a lot of posts here, but NO answer to the problem.
    I just cured mine with the MSMpeng.exe

    click START
    RUN
    type in services.msc
    go to the MsMpEng.exe service, right click it
    Then left click PROPERTIES
    STOP the service, then DISABLE it.

    If you're running Windows Defender, you'll have to go back and ENABLE the service when you actually DO a scan.
    I tried Installing Live One Care on my computer and it kept crashing on installation, over and over and over.
    I tried like a Dozen times, and it never would install.
    I do have Defender, though.

    Hope this helps.

    Take care,

    Frank
    a.k.a.  talon1812@ the hot mail dot com

    Thanks, Frank.  This makes a big difference in CPU demand.  I'm running OneCare, but MsMpEng has been hogging 90 -- 98% of my CPU a lot of the time, particularly when I do some web browsing or anything that affects a file on my PC.

     Defender or MsMpEng doesn't show, per se, in the Services list -- which it shouldn't, as I understand it, since OneCare substitutes for Defender.  What I did was to find the OneCare AntiSpyware and Antivirus service, stop it, and disable it, as you suggested for MsMpEng.

     Before I stopped OC Antivirus service, I had downloaded the free trial of AVG Antivirus 8.0; I had OC AV running during the download, which took about 27 minutes for some strange reason (didn't seem to be OC -- maybe lots of others downloading?).  Then, I started the installation.  Like a good antivirus program should do, it recognized that another antivirus program was running, and raised a warning about installing two at the same time.  So, then I stopped the OC AV service and proceeded with the AVG installation.

    Everything proceeded just fine.  Windows Security Center (XP Home, SP 3, Pentium 4, 2.8GHz, 1.5 GB RAM) is happy, reporting the OC Firewall, and the AVG antivirus protection.

     It is so WONDERFUL to sit here, seeing my CPU usage indicators oscillating in the lower range of 0 to 25%, instead of flashing red in the high 80s to 100% with MsMpEng.exe taking most of the capacity so often (77 processes running currently)!

     I have been a user of OC since it first became available.  I bought three or four of the packages.  I won't recount all the troubles I have had with the versions, etc.  Suffice it to say that I have spent literally many full days trying to fix the problems, and posting to this forum.  I was literally on the phone for hours with support last year, or maybe it was in 2007, and even let the tech take over my PC.  The best tech couldn't get OC to stay installed and working on one PC and I finally gave up -- on my HP laptop, and now also on my Lenovo dual CPU desktop running Vista.  The worst techs were horrible, and I now will not go to OC tech support after so many frustrating experiences.  I have OC running on four PCs now, with the main problem being the CPU hog MsMpEng.  This work around may be enough to continue until my subscriptions run out.

    OC promised a lot of good features.  Unfortunately, it has disappointed in a lot of ways. 

    I particularly want to express my appreciation (as I have done previously) to Steve Boots for his constantly courteous and helpful responses in this forum, and for acknowledging that even he is ignored by the OC Team!

    Pat

     

     

     




    Saturday, January 24, 2009 7:10 PM
  • I'm  sorry to report that MsMpEng refuses to stay disabled!  After making the changes yesterday I reported, and seeing the greatly improved CPU demand w/o MsMpEng, turning off the virus monitoring in OC control interface, and adding AVG to take care of the virus protection, I shut down for the night.  After restarting today, I'm happy that I am not seeing the maxing out of CPU as was occurring previously, but I noticed in TaskManager that MsMpEng is shown in the processes, and when I checked Services, I find that the @#$% thing has loaded and started even though I had set it as disabled!  The Virus setting in OC control panel is still showing as off, and the CPU is staying in the lower range instead of the upper range.  

    But now, in the OC control interface, there is a new red warning -- "Urgent -- Remove Interfering programs . . ." with a button for viewing a  list -- when clicked, it brings up a dialogue, "OneCare is maintaining your PC making the following programs unnecessary.  Keeping these programs installed may affect the operatio of OneCare and cause severe performance problems for your computer."  Then it lists AVG 8.0 with a button to "Uninstall Now."

    This would be rather laughable, because it is OneCare which has been causing all the performance problems with my computer and now wants to insist being allowed to continue to do so, were it not for all the problems and time that OneCare has already cost me!

    Since there is a terrific improvement in my PC performance with OneCare Virus monitoring turned off, I'm going to stay with the changes I've made.  And every time I start up, if I see MsMpEng in the Process list, I'll just kill it!  AVG seems to be doing the job, at a much lesser impact on performance.  It doesn't seem to be taking any CPU time now, so maybe I can just ignore MsMpEng being loaded.

    Maybe I can keep it from loading by editing MsConfig.

    p.s. I just changed the Recovery tab settings in Services for OneCare AntiSpyware and AntiVirus Properties -- Changed First and Second Failure selections to Take No Action, and set the Reset Fail Count After to 90 days from 1 day.  Maybe that will prevent MsMpEng from restarting even though I have Disabled it.  Subsequent failures was already set at Take No Action.  These settings explain why, when I had previously killed MsMpEng in the TaskManager, it restarted two times, and then after being killed again, it didn't until the next time starting up the PC (or the next day).  Maybe now it will stay dead!!

    p.p.s.  I just discovered Steve's posting in the OC General area about the phasing out of OC -- which I hadn't heard of before.  So, maybe by July we will have something better for virus and spyware protection than OC, but OC will be discontinued, so some of it's virtues may disappear too -- like the automatic defraging, the monitoring across networks in the OneCare Circle, and even the backup capabilities (as inadequate as they are).  Ah well!

    Stephen BootsMVP, Moderator - Posted on Tue Nov 18 2008 21:13:50 GMT-0500 (Eastern Standard Time)

    You may have heard the news already:

    Microsoft Announces Plans for No-Cost Consumer Security Offering

     

    The more important details for subscribers can be found on the OneCare team blog:

    http://windowsonecare.spaces.live.com/blog/cns!C29701F38A601141!10418.entry

     

    "In order for us to focus on delivering this new security solution to millions of customers around the world, we have decided to phase out Windows Live OneCare and will discontinue retail sales of Windows Live OneCare subscription service beginning June 30, 2009.


    Pat

    Sunday, January 25, 2009 6:47 PM
  • Pat,

    If you are going to use AVG, you need to remove OneCare as they will not play nice together. Even with the virus protection off, there are other services that will potentially conflict. I recommend that you pick one or the other. Since OneCare has continually given you problems on this PC, I'd suggest uninstalling it completely and using AVG and the Windows firewall or going for the version of AVG that includes the rest of the protection.

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare Forum Moderator
    Monday, January 26, 2009 3:27 PM
  • Well, how about a simple answer to this problem?
    Disclaimer: (this is not a technically correct response but an allegorical one; before all the MVP's flame me :P)

    What is MsMpEng.exe?
    It is a part of two commonly installed applications.  Window's Live One Care and Windows Defender; they are 'active' file scanners, which means almost every time a file is opened, saved, changed, or moved, it is examined by MsMpEng.exe (one of the core parts of these two programs).

    What the MVP (Microsoft Professionals) in this group are saying is true, but you have to corner them to get actual plain English :D  If you have ANY OTHER Anti-virus or active, runs a program and watches what you do, scanner installed they will argue or fight with those previously mentioned programs.

    How do the conflicts or excessive CPU usage happen?
    Lets say you create a new text file... you open Notepad (poof it is scanned for virii by all scanners)  you start typing (anti-malware scanner kicks in looking for keyloggers, and then MsMpEng.exe scans the anti-malware program and its resources, your other anti-virus scans MsMpEng and all related dll's this goes round and round for a short while, meanwhile you type stuff wondering why your letters don't appear immediately on the screen...    You save your file, bang, it starts all over again in the He Scans She scans we all scan together... *hums a small tune*  Now, imagine if you run a game, or open a large program that has dozens of dll files or hundreds of resources, like a graphics program... O.o  The scanning may continue for quite awhile before all the parties are satisfied that each other and everything else is not actually virii, malware, hackers, or whatever attacking your system.

    The main problem is that whenever an active scanner scans something is has to “look at” the file, and all other scanners are like "Hey why is that unrelated program looking at that file?!" This of course happens BOTH ways, in an annoyingly circular manner.  Different scanners have different ways of verifying if files are clean or have been changed, but it all comes down to .. ONLY INSTALL ONE ACTIVE VIRUS SCANNER ON YOUR COMPUTER; Only install ONE FIREWALL, and ONE ACTIVE malware or spyware scanner.  Keep in mind that these days most security applications try to be everything at once so there is considerable overlap.

    Here's a security analogy: if you want to feel safe, and install five front doors on your house, it takes awhile to get throught them when you take out the trash.
    Here's another one? If you install bars on your windows, you see them just as much while looking out, as other people see them when they try to look in.

    And that, is your simple answer.  Remember that One Care and Windows Defender ARE 'active file scanners', your usage of resources is simply them doing their job.

    Computer software consultant for 28 years
    • Proposed as answer by hotmatrixx Thursday, July 02, 2009 7:27 AM
    Wednesday, February 04, 2009 7:36 AM
  • Kieseyhow said:

    Well, how about a simple answer to this problem?

    Disclaimer: (this is not a technically correct response but an allegorical one; before all the MVP's flame me :P)

    What is MsMpEng.exe?
    It is a part of two commonly installed applications.  Window's Live One Care and Windows Defender; they are 'active' file scanners, which means almost every time a file is opened, saved, changed, or moved, it is examined by MsMpEng.exe (one of the core parts of these two programs).


    I *love* it! Great explanation. :-)
    I can't imagine why we would want to flame you for that great post. Thanks for posting it.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    • Proposed as answer by KailuaBchGrl Thursday, July 23, 2009 10:51 AM
    Wednesday, February 04, 2009 4:33 PM
  • Pretty sick to discover that the old MsMpEng.exe problem is still here.

    I last experienced a problem with this when it was part of Windows Defender on my old PC which used to run XP.

    I have had my present PC for about 2 years and up till now have been very happy with Live Onecare.

    Then a couple of days ago I was instructed to download some updates from Microsoft which i did and ever since then my PC has been 'hanging' and going very slowly.  To start with I thought it was my internet connection, but today decided to open Task manager and see if anything was using large amounts of CPU.

    And there it was same application - different program.

    MsMgEng.exe using over 60% of my more than large enough CPU.

    I have to say I am not happy.  It is several years since this problem first manifested itself and there seems to be no official answer from Microsoft, yet there is ample evidence out there that there are many many people with the same problem.

    I have sent in a support request and wait with anticipation.  I am hoping that the support is much better than it was last time this happened to me, because previously I never found a solution except to get rid of it and uninstall Defender, which IMO is not a satisfactory answer to the problem.


    Wednesday, February 04, 2009 9:19 PM
  • Rallyline,

    You've completely missed the point of the entire thread. The answer is simple, you've got a conflict with something else on your PC, the complex part is to figure out what is causing the conflict. The reason there's no one 'answer' is that there isn't only one thing that can cause this but at least thousands if not more, since a combination of different things are often involved.

    In general, contacting Support is the best thing for most people, since they don't have the skills themselves to trouble-shoot, find and remove the conflict themselves. However, you've already identified a potential contributor to the issue in your post, since the problem seems related to the recent updates from Microsoft. The course of action I would personally take would be to manually remove those updates one by one in reverse until the problem went away. Though it's unlikely the update itself is the only cause of the problem or everyone else with OneCare would be having it too, at least this might possibly help identify something to investigate further.

    If you don't feel comfortable doing this without aid, that's where OneCare Support should help, though they will use a set of standard scripts to get there. That's why someone with their own technical abilities can sometimes solve the problem more quickly themselves, since they already know what they've tried or observed and thus what may not be useful to repeat.

    If you had the problem with Defender and never resolved it it's possible the original problem still remained, but just hadn't been triggered by the similar, but not quite identical components included in OneCare. A typical issue is remnants of another security suite, usually an antivirus scanner, that didn't get uninstalled completely before OneCare was installed. This isn't by any means the only potential conflict, just one of the most common.

    OneCareBear
    Windows OneCare Forum Moderator
    Thursday, February 05, 2009 4:43 AM
  • Help my computer has been slowing way down within the last 2 weeks and I don't know why I can't do anything on it without it hitting 100% all the time even when it's just sitting.I have ran scan after scan and nothing I have to run a full because and fast will not find anything if there is something. I don't know what to do when I start a program 2 of them run why is happening and how can I fix this?
    Thursday, February 05, 2009 8:49 AM
  • jimmynicolejimmy said:

    Help my computer has been slowing way down within the last 2 weeks and I don't know why I can't do anything on it without it hitting 100% all the time even when it's just sitting.I have ran scan after scan and nothing I have to run a full because and fast will not find anything if there is something. I don't know what to do when I start a program 2 of them run why is happening and how can I fix this?



    Are you using Windows Live OneCare? Are you seeing MSMPENG.EXE consuming excessive CPU in Task Manager? "2 of them run" means what? I think you mean that you click a shortcut for a program and two instances will start after a lengthy wait. That would happen if you clicked the shortcut twice. The first click was not acted on until the CPU had time to launch the program. Clicking again simply set up another instance and when the CPU was available, you get two instances running.
    If you are using OneCare, contact support.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90


    If you are not using OneCare, your problem can be due to conflicting programs, failing hardware, insufficient resources (memory, free disk space), and even malware. One common reason would be that multiple security programs are active at the same time. And, if you are not using OneCare, you are off topic for this forum.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Thursday, February 05, 2009 4:02 PM
  • Yes, I am using Windows Live OneCare, And no I was thinking that at first too and it will do it mainly with games it use to do it with IE8 all the time in fact with IE (Internet Explorer) at first when it started it would be with 2 run at the same time, than with in about 5-10 min there would be additional 4-8 of IE with out double clicking it,But I fix it by uninstalling IE8 and went back to IE7 and no more problem with IE but with games it will run 2 at the same time. And when I run the internet or Firefox or IE it will take up will 90% after about 30min and when I do and thing on the computer it will begin to have spikes in CPU usage, when it idles it fine I know it will take up all the CPU usage when idle back with anything it run even just writing a letter on the notebook program it will run high and even when saving it it will freeze up the computer.when watch movies online it freeze. I have a lot of free space on my computer and it not very old.
    All I'm always,always when done run a check. This is anther strange thing I have to always run a full scan with OneCare or it doesn't pick up anything,right after a quick scan not finding anything u run a full and it will find one virus not always. My computer stay very clean sens I'm very careful with what it down or what sites I view.
    Sorry it was so long just wanted to give u enough info, so u can understand and help if u can.
    I Thank You for your time and help,it greatly needed and welcomed with this very frustrating issue.
    Tuesday, February 10, 2009 3:49 AM
  • jimmynicolejimmy,
    It sounds like you may have other issues causing the CPU spikes and lockups. It can be a conflicting program, a hardware problem, or - most likely - a misbehaving driver or program.
    As for the virus found during a complete scan, but not a quick scan, that would mean that the infection is located in a file that is not active. If you open OneCare and click on Change Settings, then the logging tab and click Create Support Log, you get a report that opens in your web browser. Scroll down to the virus and spyware section to see the exact location of the infection so you can delete the file or email that contains the infection. If you need help with this, please contact OneCare support.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90


    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, February 10, 2009 2:53 PM
  • Why can they sell a product as defective as one care. This thing is worse than any virus. Any other company would be charged with fraud for selling a product like this.  It is like selling you a chain and a giant 500lbs  boat anchor to attache to the bumper of your car and then telling you it will save you gas. Onecare is a fraud. Why don't these people test this ____ BEFORE They sell it. It is not like I am running some exoctic system or expecting it to do miracles, just not lock up my computer 10 times a day would be nice. It should also come with a legal disclaimer that if your not already a programmer, don't expect this to work. I should not have to microsoft certified technician just to get your crappy program to run.  This should really be a class action law suit against these clowns. This is fraud.

    And this nonsense that this conflict comes from lots of different sources is a bunch of ____. The common factor in all this is windows live onecare. That is a defective product, it did not say you will need to spend ours online with technical support or be a prgrammer and rewrite the code on your computer to get it to just run.
    Wednesday, February 11, 2009 1:16 PM
  • Durmbum2112 said:

    Why can they sell a product as defective as one care. This thing is worse than any virus. Any other company would be charged with fraud for selling a product like this.  It is like selling you a chain and a giant 500lbs  boat anchor to attache to the bumper of your car and then telling you it will save you gas. Onecare is a fraud. Why don't these people test this ____ BEFORE They sell it. It is not like I am running some exoctic system or expecting it to do miracles, just not lock up my computer 10 times a day would be nice. It should also come with a legal disclaimer that if your not already a programmer, don't expect this to work. I should not have to microsoft certified technician just to get your crappy program to run.  This should really be a class action law suit against these clowns. This is fraud.

    And this nonsense that this conflict comes from lots of different sources is a bunch of ____. The common factor in all this is windows live onecare. That is a defective product, it did not say you will need to spend ours online with technical support or be a prgrammer and rewrite the code on your computer to get it to just run.



    You are, of course, entitled to your opinion.
    However, the fact is that MSMPENG consuming excessive CPU has *always* been found to be due to a conflict on the system. Some of those conflicts were the fault of MSMPENG and not the conflicting process. Most were not the fault of MSPENG, though.
    Another fact is that OneCare is and has always been tested extensively by thousands of internal and external users. That does not mean that it can be thoroughly tested in every one of the infinite configurations that it will be found in on computers in use throughout the world. And, it runs successfully on millions of computers without problems. If you are experiencing problems that you are unable to identify the case for other than the suspicion that OneCare lies at the center of them, please contact support to have the problem investigated. If you purchased within the last 30 days and wish to obtain a refund, inquire about the process through support.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Wednesday, February 11, 2009 1:33 PM
  • My computer is also hanging up at times and the msmpeng.exe is running and also ccsychst.exe (norton) Could this be my "conflict"?
    It seems to happen most when I am using IE8 or AOL.  
    Monday, February 16, 2009 1:56 PM
  • CallieFeathers said:

    My computer is also hanging up at times and the msmpeng.exe is running and also ccsychst.exe (norton) Could this be my "conflict"?
    It seems to happen most when I am using IE8 or AOL.  



    Yes, you will need to remove Norton as it is likely to be the cause of the slowdown.
     

    Norton Removal Tool - ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Monday, February 16, 2009 5:48 PM
  • I have Norton Internet and it seems to cover everything.  What do I use instead?
    Monday, February 16, 2009 9:05 PM
  • CallieFeathers said:

    I have Norton Internet and it seems to cover everything.  What do I use instead?



    Instead of what? If you are using NIS, you should not be using Windows Live OneCare (the topic of this forum). If you are using Windows Defender and NIS, I can't tell you if that is recommended by Norton or Microsoft, but suspect that you probably should let NIS handle the security and disable Defender.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, February 17, 2009 4:04 PM
  • You recommended uninstalling NIS.  I wanted to know what to use instead for protection.  I did not have problems until I installed One Care.  I just uninstalled One Care but not defender and will see if that corrects the problem.  Thank's.
    Tuesday, February 17, 2009 6:10 PM
  • CallieFeathers said:

    You recommended uninstalling NIS.  I wanted to know what to use instead for protection.  I did not have problems until I installed One Care.  I just uninstalled One Care but not defender and will see if that corrects the problem.  Thank's.



    In theory, Defender should not conflict with most other security suites, but some may recommend disabling Defender as there may be conflicts. Basically, you never want to have multiple security programs providing real time or active protection as this can cause deadlocks and excessive CPU usage. OneCare and NIS will most certainly conflict. Since MSMPENG is the engine used also by Defender, and NIS purports to be a full service security package, it stands to reason that there may be issues with both being active.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, February 17, 2009 7:16 PM
  • Makes sense about the conflict with both being active.   Have not had a problem since I uninstalled OneCare.  Thanks again.
    Wednesday, February 18, 2009 12:23 AM
  • Stephen Boots,

    I've been monitoring and observing serval thousand commments on this subject and I too am having this msmpeng.exe running my cpu at 50% cpu power  evertime I open my control panel  open my Nvidia display panel open ie8 you name it it attacks everything so much that I have time to ctr-alt-del and "end" the process and immediate what ever I'm trying to open works like it supposed to.   I've installed this on over 40 machines and I'm about to change because no one from windows Onecare is willing to take resposibility that its in the programing and its a problem with onecare not everyone else's computer or processes it may be in 1% of thise cases but on 40 machines its all the same on all of them and I hear complaints DAILY!!!  Explain why is it attacking  windows control panel??   thats nut the control panel is a windows function I've had report that is hangs the computer to lockup in some case "Just to open the control panel" the only thing I've found to fix this is reistall onecare and in a weeks time it back to same old taking over the system running in most cases worst than any  malware. I can't even disable the virus Spyware feature oh I take that back I can turn it off but msmpeng.exe still runs at 50%  cause anything I run to stop respoding until onecare is done taking up to several minutes.

    I would be happy to hook up with you and try to resolve this as I don't really want to unistall 1care and install a different virus program on 40 machines.

    wdfiles@cox.net

    The FurryDog
    Tuesday, March 10, 2009 7:16 AM
  • FurryDog said:

    Stephen Boots,

    I've been monitoring and observing serval thousand commments on this subject and I too am having this msmpeng.exe running my cpu at 50% cpu power  evertime I open my control panel  open my Nvidia display panel open ie8 you name it it attacks everything so much that I have time to ctr-alt-del and "end" the process and immediate what ever I'm trying to open works like it supposed to.   I've installed this on over 40 machines and I'm about to change because no one from windows Onecare is willing to take resposibility that its in the programing and its a problem with onecare not everyone else's computer or processes it may be in 1% of thise cases but on 40 machines its all the same on all of them and I hear complaints DAILY!!!  Explain why is it attacking  windows control panel??   thats nut the control panel is a windows function I've had report that is hangs the computer to lockup in some case "Just to open the control panel" the only thing I've found to fix this is reistall onecare and in a weeks time it back to same old taking over the system running in most cases worst than any  malware. I can't even disable the virus Spyware feature oh I take that back I can turn it off but msmpeng.exe still runs at 50%  cause anything I run to stop respoding until onecare is done taking up to several minutes.

    I would be happy to hook up with you and try to resolve this as I don't really want to unistall 1care and install a different virus program on 40 machines.

    wdfiles@cox.net

    The FurryDog


    MSMPENG.EXE is the engine used for scanning - both real time/active and scheduled malware scans - in OneCare, Defender, and Forefront. If you've followed the many threads on the topic you'll know that the most common cause for excessive CPU usage by MSMPENG.EXE is that it is in conflict with another program, service, or process that causes a "race" or "lock" condition when MSMPENG and another process both try to grab the bits loading into memory when a program starts or while a scan is taking place. If you are unable to identify the possible cause of the conflict with the core protection used by OneCare, your best bet is to contact OneCare support to have the problem investigated for your machine(s). If support cannot resolve it for you short of another reinstall, please ask for the problem to be escalated.
     

    How to reach support (FAQ) - http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/30400b52-7f26-4ba0-bc18-17e305329d90

    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Tuesday, March 10, 2009 2:15 PM
  • Stephen Boots said:

    MSMPENG.EXE is the engine used for scanning - both real time/active and scheduled malware scans - in OneCare, Defender, and Forefront. If you've followed the many threads on the topic you'll know that the most common cause for excessive CPU usage by MSMPENG.EXE is that it is in conflict with another program, service, or process that causes a "race" or "lock" condition when MSMPENG and another process both try to grab the bits loading into memory when a program starts or while a scan is taking place. If you are unable to identify the possible cause of the conflict with the core protection used by OneCare, your best bet is to contact OneCare support to have the problem investigated for your machine(s). If support cannot resolve it for you short of another reinstall, please ask for the problem to be escalated.
     
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator


    Fortunately, there is a better solution!  I have been happily running OneCare with the Virus/Spyware service, aka MsMpEng.exe, disabled since my prior post, and have installed Iolo AntiVirus to do the spyware and virus checking.  Iolo is very responsive, and includes an easy Snooze feature from the tray icon.  I no longer have those CPU max outs caused by OneCare.  And I still have the other services of OneCare which I find useful -- the tune up, and to a lesser extent, the backup, and particularly the ability to monitor my other computers, even those remote, running OneCare.  Of course, OneCare turns the tray icon red, and every so often jumps up to tell me that my computer is at risk, and to turn on the virus (MsMpEng.exe) checker, but I get a lot of satisfaction to tell it to go away!

    I had previously spent hours and days of time, with OneCare support, even the Level 2 support, trying to get OneCare to run at all on some computers.  I have searched and eliminated all other virus checking programs on this PC, without any apparent effect on the MsMpEng.exe problem.  The only thing that has given relief is to turn off virus checking, and to block MsMpEng.exe from starting in the Services application.  (If you want to really identify what components are using your CPU time, download and install the free Process Explorer from Microsoft at http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx -- then you can see if some "conflict with another program, service, or process that causes a "race" or "lock" condition when MSMPENG and another process both try to grab the bits loading into memory.")

    Let's face it, OneCare is a dead product, as of July.  OC support isn't going to do much good.  It's a shame, really, because OneCare has some nice features, and it could have been better, and it comes with the Microsoft name -- which was more promising than was delivered.  It's too bad that the Microsoft OneCare programmers wouldn't listen to the feedback that was given in this forum and elsewhere, such as that offered by The FurryDog above.  I hope that whatever Microsoft comes out with as the free replacement for OneCare isn't based on MsMpEng.exe, and will be a better experience than has been OneCare.

    Again, thanks Steve for all your helpful comments and time contributed to users in this forum. 

    CareBear, don't bother to tell us again that this product was designed for the ignorant dolts and the rest of us should go someplace else!  We don't want to hear it!  We will be doing exactly that when our subscriptions run out.

    Pat
    Tuesday, March 10, 2009 5:51 PM
  • Paddy48 said:



    CareBear, don't bother to tell us again that this product was designed for the ignorant dolts and the rest of us should go someplace else!  We don't want to hear it!  We will be doing exactly that when our subscriptions run out.

    Pat


    Pat,

    You're still wasting your breath rather than trying to actually solve your problems huh?  What I really can't understand is why you're still using OneCare at all, since almost everything else you're doing can either be done with a simple scheduled task or free utilities that are either provided with the operating system or are downloadable from Microsoft.  Only the remote monitoring and management would require a third-party application and I'd think that would be basically useless if OneCare is constantly flagging red.

    In any case, the problem with MSMpEng is and will always be a conflict or the existance of malware causing it to spike the processor, since it's simply the monitoring functions going into overdrive.  When a new cause is identified an exception would be written into the code to handle it, but unfortunetly there will always be new causes created by new software or malware.  Since MSMpEng is the core antimalware engine for all of the Microsoft anti-virus and anti-spyware products there's clearly no way it will be going away.

    In the case of the most recent poster, there's obviously something installed on all 40 systems that is creating the conflict, which is actually quite understandable in a business situation where every PC is set up like all the others. 

    Since I've never experienced these issues on any of the systems I support and the number of posts to these threads have remained relatively small and in fact declined over time, the remaining issues appear to be relatively rare.  Of course this doesn't help those few who still experience them, but then only working with Support and then getting escalated if required probably would.

    Even though OneCare will continue to operate through the end of subscriptions purchased through at least June 30th, 2009, thus up to mid-2010, I'd probably change to another product earlier if I couldn't resolve these problems.  At this point it's less likely that a large amount of effort will go into resolving them on the existing OneCare platform, since as stated it will eventually be going away.  Though such issues will still need to be investigated and resolved on the new Morro as well as the Defender and ForeFront products, the specifics of the overhead built into OneCare might also aggrevate the situation, so removing all but the anti-malware itself should help reduce this potential.

    OneCareBear
    Windows OneCare Forum Moderator
    • Proposed as answer by holonicjon Monday, April 20, 2009 4:43 AM
    Tuesday, March 10, 2009 7:02 PM
  • Does anyone else have an issue with MsMpEng when opening Outllook. With MsMpEng stopped, Outlook will launch on my machine in less than a second. When running, it takes Outlook 20+ seconds to open up.
    Wednesday, May 20, 2009 4:28 PM
  • Does anyone else have an issue with MsMpEng when opening Outllook. With MsMpEng stopped, Outlook will launch on my machine in less than a second. When running, it takes Outlook 20+ seconds to open up.

    Try adding the Outlook .pst or .ost file to the exclusion list in the Virus and Spyware settings in OneCare. If your .pst file is particularly large, it is possible that scanning it as it is being opened is causing the delay.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Wednesday, May 20, 2009 6:46 PM
  • I did exclude the pst and ost files, but it has no impact. MsMpEng will be running about 5-10% CPU until I start Outook. Then it jumps to 50%. I am guessing it might have something to do with the email in the inbox (there are quite a few). I also noticed that is seemed to get worse when I installed the Outlook Connector and linked Outlook to my Hotmail account.
    Wednesday, May 20, 2009 7:32 PM
  • The Outlook Connector also has its own PST file, did you also exclude that? How about the Outlook.exe file itself?
    By the way, I stopped using the Outlook Connector pretty quickly as it impacted Outlook startup time significantly on PCs without OneCare, too.
    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator
    Thursday, May 21, 2009 1:49 PM
  • The Outlook Connector also has its own PST file, did you also exclude that? How about the Outlook.exe file itself?
    By the way, I stopped using the Outlook Connector pretty quickly as it impacted Outlook startup time significantly on PCs without OneCare, too.
    -steve


    Microsoft MVP Windows Live / Windows Live OneCare & Live Mesh Forum Moderator

    I stopped using Connector too, because every time I tried to use it, it corrupted my mail files!  Outlook has always been a problem too, locking up randomly, etc.  Microsoft is substituting Windows Live Mail app for good ole Outlook Express, and the most recent version of that is worse than the previous one.

    Does anyone know of a really good email program?  Yeah, I know that is off topic, but this MsMpEng.exe topic is pretty well exhausted anyway, as has been remarked before. 

    Anyone know any more details of what Microsoft is going to do in July as a replacement for OneCare?  Like I said before, I hope it isn't based on MsMpEng.exe, but I won't be surprised if it is!

    Pat
    Saturday, May 23, 2009 3:54 AM
  • I have just had this problem and immediately I stopped Yahoo Messenger (version 9.0.0.2162 on my machine) the MsMpEng.exe went straight down to zero. I started Yahoo Messenger up again and everything is fine. I suspect that there is a conflict with these 2 applications starting up at the same time with a re-boot.
    Sunday, June 28, 2009 7:18 PM
  • I have just had this problem and immediately I stopped Yahoo Messenger (version 9.0.0.2162 on my machine) the MsMpEng.exe went straight down to zero. I started Yahoo Messenger up again and everything is fine. I suspect that there is a conflict with these 2 applications starting up at the same time with a re-boot.

    Thanks for sharing your experience.
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Monday, June 29, 2009 12:57 AM
  • Hey Buddy. I signed up all especially for an account, just so that I could say this:

    "perfect explanation"


    saved me some time investigating this any further.
    -1 to microsoft (again) = uninstall.

    thanks,

    hotmatrixx
    Thursday, July 02, 2009 7:29 AM
  • I'll be quite frank and honest.

    I've been thru PC-Cillin, Trend Micro, Symantec/Norton AV, AVG with countless other Malware being tried at one time or another, and thru WinXP and Vista systems no AV/malware has actually been more stable and less resource consuming in my expereince than OneCare.

    I turned away from most other AV/Malware solutions cause they specifically tried to do too much and would overburden my system and consume additional resources much more than One Care.

    While it does a good deal of work at startup, any other time its activity is minimal at best, and even still its work does not hinder any other current load or work even when I launch apps prior to all startup events being loaded.

    I think i've tried enough solutions over the years to be able to recommend OneCare to any user, as its been the best solution I've worked with.

    I believe many try to do too much, install to many apps and they conflict, or they easily forget just how intense the other 2-3 apps they used to run chugged their machine and hop on the -itch @ Microsoft bandwagon.

    My personal browsing habits include gaming, dowloading torrents, game cheats, hacks, mp3, videos with a machine online and running 24/7. Any questionable event OneCare has addressed, which includes the occasional trojan found in bad downloads.

    As I sit here typing this, 0-1% cpu, total 19% memory usage with all the perty Vista addins running, HD sounds like its a sleeping baby and net utilization can hardly be metered (0Kbps reported).

    Part of the issue I think some people may have, they will have with any solution, they are still running sub-standard PCs. That doesn't mean the latest and greatest, but there are some running with extremely low amounts of RAM and less than adequate processors, then expect everything they run today, to run like the PC did when it was new and consumed a 3rd of the resources of ANY app we use today.

    Kinda like a car, We've got Ethanol in every gallon we pump here now, your older car wont pur quite the way it used to if it wasnt made with that in mind.


    One a side note about Vista, The only processes I prefer to exclude or disable are full HD indexing and Superfetch. With those offline and out of the way, my user experience couldn't get much better.
    Tuesday, August 04, 2009 1:01 AM
  • Hi Stephen,
    I have the same problem with MSMPENG>EXE.  You say to disable all startup items via MSCONFIG and then enable items one at a time until the conflict is identified.  Before you start enablen all of the items one at a time, do you enable MSMPENG.EXE first?  If not, how would you be able to identify which item is causing the conflict?  Unless you have a contract with Microsoft for software support in the USA, it's a waste of time calling.  Their 1st and 2nd level support is a joke.

    TJMacc 
    Wednesday, September 16, 2009 9:39 PM
  • If you start the system clean, you would leave OneCare running, so msmpeng is going to be active.
    Some people have had poor experiences with support, but there have been many more good experiences. If the basic troubleshooting performed at 1st level cannot identify the conflict, you can request escalation. The high CPU issue with MSMPENG is common enough that they should have a good understanding of what items may be conflicting based on looking at your running processes and programs
    -steve
    Microsoft MVP Windows Live / Windows Live OneCare, Live Mesh, & MS Security Essentials Forums Moderator
    Thursday, September 17, 2009 12:15 PM
  • I just switched from OneCare to Security Essentials and notice that  MSMPENG.EXE continues to be active.  Do OneCare and MSE both use MSMPENG.EXE?  Thanks. - Dave
    Saturday, October 03, 2009 2:13 PM
  • dnpeters,

    Yes, both OneCare and Microsoft Security Essentials use exactly the same engines, only the GUI is actually different which includes the extra features in OneCare.

    Rob
    Saturday, October 03, 2009 10:54 PM
  • I didn't have a problem with 'MsMpEng' untill I upgraded to Internet explorer 8.  After the update, I found another pgm that came with Internet Explorer 8 that was using more cpu than MsMpEng at startup called 'System Idle Process'.  When 'System Idle Process' was using from 75 to 99 of cpu, MsMpEng was using 50 to 70 of the cpu.  This situation cleared up after I was on line.   If Microsoft does not fix this problem, (I can't wait for that)the only other thing you can do is to increase your memory.  Thats what I'm going to do.

    TJMacc
    Sunday, October 25, 2009 5:44 PM
  • System Idle Process is the percentage of the processor that is unused or idle. It does not come with IE8, it exists on all Windows systems.
    MSMPENG at startup is scanning processes and programs loading and may also be performing a quick scan for malware for about 10 minutes. It will use 50 to 70 percent of the processor at that time. That's normal.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, October 26, 2009 1:03 AM
  • Hi,

    Did you already tried to do a clean boot?

    if not here's the step


    1) click on start>on start search type in msconfig>press enter (If your using XP click on start>click run then type in msconfig)
    2) go to general tab> click on selective start up
    you will see there 3 or 4 boxes just uncheck all the boxes but not "load system services" (leave it check)
    3)Then go to Services Tab
    on the bottom left you will see there "hide all Microsoft Services" uncheck the box>then click disable all
    4)Then lastly go to start up tab click on disable all
    5)click Apply then Close and it will give you the option to restart the computer

    -Paul
    • Proposed as answer by tmradius Sunday, November 29, 2009 3:10 AM
    Thursday, November 12, 2009 3:03 AM
  • Do a little experimentation.  Open Defender (MSD) and the Task Manager (TM) so that  you can see both windows at the same time.  Set TM so that you can see the Performance and the running Services. * Click on the CPU heading to sort by the services using the maximum amount of CPU function at the top of the column

    Now open MSD and move the window so that you can see both windows.  Click to Start Quick Scan on the MSD window.  Watch the CPU as the scan starts and notice that MsMpEng.exe immediately appears and becomes the biggest user of the CPU (over 90% almost consistently).  Then Stop the scan and watch it disappear.  The CPU activity drops drastically. 

    I am using Microsoft Security Essentials (MSE) now.  I opened it and did the same. Again MsMpEng.exe appeared and it used over 90 & of the CPU.  Now suppose you have both of them running.  

    So I opened both MSE and MSD, and watched the TM.  There were two of the MsMpEng.exe files running and the CPU was running 100%. (Of course I turned them both off or else I wouldn't be able to type this entry.

    Conclusion?  Run one or the other but not both.  Expect either to use a lot of the CPU when running.  Schedule your scans to run while you are playing on the guitar or sleeping.  I decided to disable Defender and use MSE exclusively. 

    * If your TM does not show the headings I mentioned, click on View and then Select Columns.
    If your menu bar doesn't show at all, double click on the grey area at the top of the window.

    Reference:  EMachine, 2 gig Mem, 2.8 Proc. Windows XP Home Edition.   Frank
    Sunday, November 29, 2009 3:38 AM
  • Recently, my Norton subscription expired.  As I'm broke, I switched to using Windows Defender.

    Ever since then, Defender (MsMpEng.exe) has been using up 139 MB of my availiable 736 MB of memory, basically bringing my computer to a crawl.

    I've noticed for some poeple, this only happens for 2-3 minutes, or when they cycle.  For me, it is constant, and persistant.

    I am trying the disabling thing in MSConfig, but so far, it has only saved me about 25 MB.

    Do I need to format?  What else can I do?
    Friday, December 11, 2009 9:00 AM
  • Recently, my Norton subscription expired.  As I'm broke, I switched to using Windows Defender.

    Ever since then, Defender (MsMpEng.exe) has been using up 139 MB of my availiable 736 MB of memory, basically bringing my computer to a crawl.

    I've noticed for some poeple, this only happens for 2-3 minutes, or when they cycle.  For me, it is constant, and persistant.

    I am trying the disabling thing in MSConfig, but so far, it has only saved me about 25 MB.

    Do I need to format?  What else can I do?

    First of all, you need more than Windows Defender, you need an antivirus program.
    Defender has its own discussion groups here: 

    http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    You may want to consider Microsoft Security Essentials - http://www.microsoft.com/security_essentials/
    If you pursue, that, remove Defender (I assume you are using XP) and run the Norton Cleanup tool (on the list here): http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91

    Then install Microsoft Security Essentials.

    139 MB of memory usage by MSMPENG is a little high, but that would not be the reason that the PC is running slowly.

    -steve

     


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Friday, December 11, 2009 2:40 PM
  • Most interesting reading all this to do with OneCare and Windows Defender etc etc. The culprit of course is MsMpEng.exe and the fact for example switching from Windows Defender to Microsoft Security Essentials I too now suffer the 100% CPU problem. It seems the legacy problems that y'all faced using OneCare have come to bug us who have started to use Microsoft Security Essentials. I had no problems using Windows Defender and AVG; now I have a pig. Guess I now look for the new Microsoft Security Essentials Forums to "discover" what it might be that's dragging my system into the ground?
    Saturday, December 26, 2009 12:17 PM
  • MSMPENG.EXE high CPU usage is typically caused by the same thing for all programs that use this as the engine: OneCare, Defender, ForeFront, and Microsoft Security Essentials.
    Typically, the cause is a conflict with other security software on the PC, but it can also be caused by a conflict with a driver or service that has nothing to do with security, but causes an endless loop of scanning the conflicting process as it attempts to do whatever it is doing.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Saturday, December 26, 2009 11:39 PM
  • Interesting - no answers only endless probabilities. Okay so I didn't have this problem with Windows Defender and AVG Free installed. I uninstall both and install Microsoft Security Essentials. Now I get 100% CPU when for example I Display Properties and select Screen Saver. It all hangs for around 45-seconds up to 90-seconds. Same goes when I add to favorites in IE. Same goes when I start Word. Same goes during start-up which now takes minutes longer with constant peeks of 100% CPU most around MSMPENG. So I do what all good users have learnt to do. I uninstall Microsoft Security Essentials and re-install Windows Defender and AVG Free. Voila --- the problems have dissipated to almost being of no consequence. Obviously this MSMPENG engine when in Microsoft Security Engine is an unintelligent process attempting to do "whatever it is doing" that it obviously isn't doing with Windows Defender, regardless of the conflicts it has with "something" that is already installed in the first place!
    Now wouldn't it be the perfect world if Microsoft actually recognised conflicts do exist and when installing MSE there was some intelligence to it all warning you of the potential conflicts that now existed on your machine? That would be too perfect, right? Of course then we would not have the fun of running around like headless rabbits wondering the endless possibilities that might, more often "do not", cause these horrendous conflicts grinding everything to a stop. Given the number of drivers and services installed it really is the most unprofessional trial and error way of having to go about things! Shame on you Microsoft. You call this security essentials? Can't wait to switch to Apple :)
    • Proposed as answer by flee2k Sunday, January 24, 2010 3:04 AM
    Wednesday, December 30, 2009 12:16 PM
  • Check this out for a description:

    http://www.processlibrary.com/directory/files/msmpeng/

    MSMPENG.EXE runs with Windows Defender installed or Windows One Live Care.

    Two things I would check. First off check your scanning schedule, by default Microsoft will set it to once a day meaning your computer is probably being scanned while in use slowing it down. the msmpeng.exe runs scans.

    msmpeng.exe also gives you LIVE protection from antivirus and spyware, so if you have an older computer maybe check your live scan settings. If the process is running it is doing something you need like scans, updates, or live protection, so you probably need to make sure everything is set to perform these actions when you're not using your computer. Hope this helps.
    Wednesday, January 06, 2010 11:26 PM
  • Recently, my Norton subscription expired.  As I'm broke, I switched to using Windows Defender.

    Ever since then, Defender (MsMpEng.exe) has been using up 139 MB of my availiable 736 MB of memory, basically bringing my computer to a crawl.

    I've noticed for some poeple, this only happens for 2-3 minutes, or when they cycle.  For me, it is constant, and persistant.

    I am trying the disabling thing in MSConfig, but so far, it has only saved me about 25 MB.

    Do I need to format?  What else can I do?

    First of all, you need more than Windows Defender, you need an antivirus program.
    Defender has its own discussion groups here: 

    http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    You may want to consider Microsoft Security Essentials - http://www.microsoft.com/security_essentials/
    If you pursue, that, remove Defender (I assume you are using XP) and run the Norton Cleanup tool (on the list here): http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91

    Then install Microsoft Security Essentials.

    139 MB of memory usage by MSMPENG is a little high, but that would not be the reason that the PC is running slowly.

    -steve

     


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~


    Folks, whatever you do, do not follow this advice.  This "solution" is actually the problem.  The response that has been repeated over and over about a conflict with other security is correct, but it is cloaked in ambiguity.  It is an MS program - Microsoft Security Essentials - that is causing the "conflict".  Yes, by definition another program is involved in the conflict as well, but the common denominator is Security Essentials.  When it is the MS security program (be it Security Essentials or Defender or OneCare) that is the process running wild on your pc, start your troubleshooting there.    
    I'm running Vista 64.  MSMPENG.EXE runs with Security Essentials under the service name "microsoft malware service".  I could not end or disable the service; it continued to restart itself immediately.  So, I just uninstalled Security Essentials.  That solved the problem immediately. 

    If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus).  They work great and don't hog your system's resources.   




    Friday, January 22, 2010 10:34 AM
  • Folks, whatever you do, do not follow this advice.  This "solution" is actually the problem.  The response that has been repeated over and over about a conflict with other security is correct, but it is cloaked in ambiguity.  It is an MS program - Microsoft Security Essentials - that is causing the "conflict".  Yes, by definition another program is involved in the conflict as well, but the common denominator is Security Essentials.  When it is the MS security program (be it Security Essentials or Defender or OneCare) that is the process running wild on your pc, start your troubleshooting there.    
    I'm running Vista 64.  MSMPENG.EXE runs with Security Essentials under the service name "microsoft malware service".  I could not end or disable the service; it continued to restart itself immediately.  So, I just uninstalled Security Essentials.  That solved the problem immediately. 

    If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus).  They work great and don't hog your system's resources.   





    I am sorry to advise you that you are mostly incorrect in your statements above.

    MSMPENG.EXE is the engine used by Windows Defender, Windows Live OneCare,ForeFront Security, and Microsoft Security Esentials.

    The "common denominator" is MSMPENG.EXE in any one of the above Microsoft security products.

    As stated repeatedly above and in many threads here and elsewhere, the cause of the problem is *usually* conflicting security software - that is, any software that is "scanning" files that MSMPENG is also trying to intercept and scan. There have been cases where a driver or non-security application causes this deadlock or hyper-activity of the scanning engine. When these problems are identified, the Microsoft Antimalware team responsible for the engine and definitions can typically fix the problem for a future update of the engine and definitions.

    Your advice about other security solutions is fairly sound - there are many other solutions to consider if you choose not to use one provided by Microsoft. However, your mileage may vary as to resource usage. Each situation is different.

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    • Proposed as answer by Dabur972 Friday, January 22, 2010 5:53 PM
    Friday, January 22, 2010 1:26 PM
  • Folks, whatever you do, do not follow this advice.  This "solution" is actually the problem.  The response that has been repeated over and over about a conflict with other security is correct, but it is cloaked in ambiguity.  It is an MS program - Microsoft Security Essentials - that is causing the "conflict".  Yes, by definition another program is involved in the conflict as well, but the common denominator is Security Essentials.  When it is the MS security program (be it Security Essentials or Defender or OneCare) that is the process running wild on your pc, start your troubleshooting there.    
    I'm running Vista 64.  MSMPENG.EXE runs with Security Essentials under the service name "microsoft malware service".  I could not end or disable the service; it continued to restart itself immediately.  So, I just uninstalled Security Essentials.  That solved the problem immediately. 

    If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus).  They work great and don't hog your system's resources.   





    I am sorry to advise you that you are mostly incorrect in your statements above.

    MSMPENG.EXE is the engine used by Windows Defender, Windows Live OneCare,ForeFront Security, and Microsoft Security Esentials.

    The "common denominator" is MSMPENG.EXE in any one of the above Microsoft security products.

    As stated repeatedly above and in many threads here and elsewhere, the cause of the problem is *usually* conflicting security software - that is, any software that is "scanning" files that MSMPENG is also trying to intercept and scan. There have been cases where a driver or non-security application causes this deadlock or hyper-activity of the scanning engine. When these problems are identified, the Microsoft Antimalware team responsible for the engine and definitions can typically fix the problem for a future update of the engine and definitions.

    Your advice about other security solutions is fairly sound - there are many other solutions to consider if you choose not to use one provided by Microsoft. However, your mileage may vary as to resource usage. Each situation is different.

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    You may want to argue intricacies regarding exactly what programs MSMPENG.EXE runs (I didn't care enough to look them all up - it was Security Essentials on my pc though).  However, what is not "mostly incorrect" is the fact that it is the MS security engine that is in conflict.  That is the point.  It does not matter whether it is conflicting with other security software or some other application or a driver.  The point is there is a conflict between two "things" that causes MSMPENG.EXE to to use excess memory.  But, one of those "things" is always the microsoft security product trying to run and "conflicting" with some unknown program.  So, the "common denominator" is a MS security product.  I am merely advising users that rather than going into msconfig and turning off all startup programs to find what is "causing the conflict", we know one cause will always necessarily be the MS program.  Whether Security Essential was in conflict with my anti-virus/firewall (Kaspersky) or a driver, I wasn't going to go on a wild goose chase looking; nor was I going to disable any of those to run Security Essentials.  So, if a user can't find the program in conflict (or doesn't want to), I am merely suggesting a solution if they can't solve their problem by stating explicitly what is only implied (at best) in this forum.

    Friday, January 22, 2010 4:57 PM
  • hi ,

    people should ask as to why msmp runs like that , normally its due to an other security product , and mse scans those files , since those files contain the codes and info fro the other security program mse wants to check them , ...

    flee2k its your choice to run both kaspersky and mse , but both will be weaker and sometimes evne cancel each other out and leave you with no protection at all , .... (!)

    my advice it choose only one , ...

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Friday, January 22, 2010 5:53 PM
  • Recently, my Norton subscription expired.  As I'm broke, I switched to using Windows Defender.

    Ever since then, Defender (MsMpEng.exe) has been using up 139 MB of my availiable 736 MB of memory, basically bringing my computer to a crawl.

    I've noticed for some poeple, this only happens for 2-3 minutes, or when they cycle.  For me, it is constant, and persistant.

    I am trying the disabling thing in MSConfig, but so far, it has only saved me about 25 MB.

    Do I need to format?  What else can I do?

    First of all, you need more than Windows Defender, you need an antivirus program.
    Defender has its own discussion groups here: 

    http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    You may want to consider Microsoft Security Essentials - http://www.microsoft.com/security_essentials/
    If you pursue, that, remove Defender (I assume you are using XP) and run the Norton Cleanup tool (on the list here): http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91

    Then install Microsoft Security Essentials.

    139 MB of memory usage by MSMPENG is a little high, but that would not be the reason that the PC is running slowly.

    -steve

     


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~


    Folks, whatever you do, do not follow this advice.  This "solution" is actually the problem.  The response that has been repeated over and over about a conflict with other security is correct, but it is cloaked in ambiguity.  It is an MS program - Microsoft Security Essentials - that is causing the "conflict".  Yes, by definition another program is involved in the conflict as well, but the common denominator is Security Essentials.  When it is the MS security program (be it Security Essentials or Defender or OneCare) that is the process running wild on your pc, start your troubleshooting there.    
    I'm running Vista 64.  MSMPENG.EXE runs with Security Essentials under the service name "microsoft malware service".  I could not end or disable the service; it continued to restart itself immediately.  So, I just uninstalled Security Essentials.  That solved the problem immediately. 

    If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus).  They work great and don't hog your system's resources.   





    hi ,


    i test mse whenever i can , your statement is wrong , ...

    and you should never download from a third party , .... not even from cnet , you have the risk to get faulty software (!) if you got MSE from that site look no further , you have your problem right there , ... 

    only use this site to download MSE

     http://www.microsoft.com/security_essentials/

    NOTE in general , always state your version of MSE if you have a problem

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Friday, January 22, 2010 5:57 PM
  • I will concede that I should not have noted that your statements were "mostly incorrect."
    You are indeed correct the the issue is that the conflict is with MSMPENG, in your case when trying to use Microsoft Security Essentials. So, we are actually in agreement.
    The point is that you are posting to a discussion in the OneCare forums. You'll find the same discussions regarding the other products in their respective forums and discussion groups.
    The advice that will be given in these locations will be similar to what you are recommending against. The assumption is that the person encountering the problem would like to use their chosen Microsoft security product - in the case of OneCare, one that they paid for. To resolve the problem, identifying what is in conflict and causing MSMPENG to spike is the process to follow. And, yes, another course of action is to abandon the Microsoft security product and switch to a different product -- that is always an option. In fact, that may well be the best option for some people.

    It is interesting to note this statement: "Whether Security Essential was in conflict with my anti-virus/firewall (Kaspersky) or a driver, I wasn't going to go on a wild goose chase looking; nor was I going to disable any of those to run Security Essentials."

    I am 99.9% positive that you have identified the root cause of your problem with that statement. Having Kaspersky installed and active on the system *and* installing MSE was the cause as you introduced a second real time scan process to the system, whereby both the Kaspersky and MSE services would endlessly fight over access to every file and process loading into memory. You'll face the same or similar issue with any other antivirus software installed and running alongside Kaspersky's antivirus product. You should never have more than one security product installed on the PC providing active protection/scanning. This can cause performance issues, system instability, and can hinder the effectiveness of both products at providing protection.

    The key, of course, is "So, if a user can't find the program in conflict (or doesn't want to)." If they don't want to identify the conflict or have been advised the the probably cause is that another security product is running that needs to removed and they don't want to remove that other product, then remove the newly introduced variable - the Microsoft Security product. If they can't find the conflict, then it is a choice - seek a solution or take your advice and use a different product, removing the Microsoft security product. However, if the cause is a conflict with other security software, switching to yet another security product instead of the Microsoft one doesn't fix things if the net result is more than one product performing real time protection/scanning for viruses and malware.

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    • Proposed as answer by Dabur972 Friday, January 22, 2010 6:19 PM
    Friday, January 22, 2010 5:59 PM
  • Steve: 

    I agree with a lot of what you said.  However, regarding the last sentence, you're correct concerning computer security in general (which you know); but I'm pointing it out because this is a MSMPENG thread: "switching to yet another security product instead of the Microsoft one doesn't fix things" cannot be correct.  If the Microsoft security product is uninstalled, then the engine will not run, a conflict cannot arise, and MSMPENG cannot consume excess memory.  Granted, like you said, if someone has multiple security products (but not a Microsoft security product) simultaneously scanning their pc, then they will have problems - but they won't have a MSMPENG problem.

    Also, it is obvious that your advice throughout this year-long thread is guided by this sentence: "The assumption is that the person encountering the problem would like to use their chosen Microsoft security product."  A more reasonable assumption is: first and foremost, the person wants their problem resolved.  The underlying premise behind your assumption does not yield that result.  It essentially translates into: resolve the person's problem, so long as it can be resolved while still using a Microsoft product.  These people came here because a Microsoft product is causing a problem by consuming too much (or all of) their RAM - crippling their system - and they trust you to tell them the best way to fix it.  

    Finally, to say that, "The point is that you are posting to a discussion in the OneCare forums," makes no sense because my post was in response to you telling Madoushi to download Security Essentials (not to mention MSE has replaced OneCare - which has been discontinued - and they both use MSMPENG).  Madoushi said he was using Defender because he was broke, that MSMPENG was crippling his computer's performance, he had tried disabling programs in msconfig to no avail, he was even getting ready to reformat his hard drive he was so desperate to free up RAM, and he asked your advice. What did you tell him? You advised him to download MSE.  That is why basing advice on your aforementioned assumption results in faulty advice.  First, simply replacing Defender with MSE shouldn't solve his problem because they use the same engine.  He would have the same problem, but with a different security program.  Second, it is unreasonable to assume a person places a higher value on a Microsoft security product than they do their computer's performance.  Nowhere in his post did he even imply his goal was to keep using Microsoft (he even said he was only using Defender because he was broke and it was free).  What he wanted was free security software that didn't use all of his RAM, and switching from Defender to MSE doesn't make sense in light of his problems.  The fact that you wouldn't give him any advice other than download MSE when he was on the brink of reformatting is mind-boggling.  I just hope he didn't do it. 
     


    Dabur972: 

    Your reply to my comments posted earlier make absolutely no sense with respect to what I said.  Your English appears to be lacking, which is fine, unless you inaccurately reply to a comment you do not understand.  Please reread what I wrote if necessary.  I am not running both Kaspersky and MSE; I uninstalled MSE, which fixed my problem.  Also, I did not tell anyone to download MSE from CNET.  Please read and comprehend posts before replying with a misrepresentation of what I said.  It will only confuse readers further.
    Saturday, January 23, 2010 9:44 AM
  • Stephen, Wow! Quite a discussion.  It's pretty obvious that the default assumption on this forum is a desire to use MSE sucessfully; fleek is disengenuous in his comments. Don't let pull your chain. Just tell him AGAIN;

    1. Multiple virus scanners, configured so that they run at the same time is a bad practice.
    2. Choose one antivirus service to run.
    3. If you choose MSE, delete the others.
    4. If you choose another service, such as Kaspersky, delete MSE.   

    The rest of what you are saying is essentially just backhanded trashing of MS - you are entitled to your opinions and there are forums for you to express that - but this is not one of them. Substitue MSE or OneCare for every mention of Kaspersky and Kaspersky for the MS products. Read it again and your remarks are just trashing  Kaspersky  

    I HAVE decided that I want to use MSE as my anti-virus engine - it is a great, lightweight product.  I have tested many and thats what I want to use. My computer with XP Pro SP3, Pentium D, 2GB Memory is useless for 5 or ten minutes after reboots, etc.  I understand that there is a conflicting service or program that needs to be disabled or deleted. Is there a protocol or KB article that provides some guidance. I do have a lot of things running on my computer, but no other virus checkers. 

    Thank you,
    Steve J.
    Ann Arbor, MI 
    Saturday, January 23, 2010 4:34 PM
  • Your reply to my comments posted earlier make absolutely no sense with respect to what I said.  Your English appears to be lacking, which is fine, unless you inaccurately reply to a comment you do not understand.  Please reread what I wrote if necessary.  I am not running both Kaspersky and MSE; I uninstalled MSE, which fixed my problem.  Also, I did not tell anyone to download MSE from CNET.  Please read and comprehend posts before replying with a misrepresentation of what I said.  It will only confuse readers further.

    hi ,

    english is my first language , ... born and bred in the usa by the way , ...

    read your own post , it does give the impression maybe you do not realize it but it does that you advice people to dowmload from cnet and that you use both programs , ...

    in my post i wrote >

    ' and you should never download from a third party , .... not even from cnet , you have the risk to get faulty software (!) if you got MSE from that site look no further , you have your problem right there , ... 

    only use this site to download MSE

     http://www.microsoft.com/security_essentials/ '

    i fail to see whats wrong with that ? especially since on cd and cnet there are downloads that are outdated from all versions of software , not to mention downloads that are potentially unsafe for the user , ... (!!)



    if you fail to properly understand the language , click * translator * below in my signature , ...

    i have asked others read the post's and they agree with me , but i dont think going after some one will give anything to the discussion regarding this thread (!)

    i hope that particular subject is closed now

    have a nice day


    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Saturday, January 23, 2010 4:46 PM
  • Sliverine:

    I'm not on here to trash Microsoft.  I don't have a problem with MS.  I'm using a PC with Vista and I use the MS Office suite.  I would have kept MSE on my computer if there wasn't a live scan that conflicted with Kaspersky.  I'm not going to debate Kaspersky vs. MSE here.  That is a choice for individuals to make for themselves.   

    You said, "The rest of what you are saying is essentially just backhanded trashing of MS."  Like what?  It's best if you use an example rather than broad generalizations.  However, if everything I said is true, then you are forced to make comments without any specificity - like you did.  What I did criticize was this forum - at least their handling of the MSMPENG problem.  I honestly don't know why you guys come to the conclusion that, "It's pretty obvious that the default assumption on this forum is a desire to use MSE successfully."  Maybe for you, but not for everyone.  I mean, this forum isn't called "How to Use MSE Successfully";  it's called "MSMPENG".  I got here (and I'm sure others as well) by seeing that MSMPENG was consuming too much RAM when I was in task manager.  I didn't even know it was the MS security engine.  I just knew it was a problem on my PC that needed to be resolved.  

    I googled MSMPENG and this was the first entry.  I figured out what it was in here, but as Condoghost said: "Interesting - no answers only endless probabilities."  I read the entire thread and he was exactly right.  This thread is over a year old and the only advice is to go into msconfig and turn off all startup programs and figure it out for yourself.  What I did was provide people with an answer if they don't want to do that - if their goal is simply to stop MSMPENG from hoarding all of their RAM and regain control over their computer.  It may not be an "MS-friendly" answer, but it does resolve the problem. 

    You're right, this is, now, quite a discussion.  Hopefully readers will take away that there are different ways to solve their MSMPENG problem, and there are security alternatives they can turn to if they can't solve their problem while using MSE.  If someone wants to keep MSE, they can use the msconfig method.  If not, they can try my recommendations.  If someone reads my conversation with Steve, then their MSMPENG problem should be resolved whichever approach they choose - which is the point.  

    Dabur: 

    I'm not going to dwell on this after this post.  If English is your first language...well...maybe you're young and your control of it may explain why you didn't understand what I was saying.  Anyway, "So, I just uninstalled Security Essentials.  That solved the problem immediately," does not give off an inkling of an impression that I use both programs.  It says uninstalling one (MSE in my case) solves the problem.  For the record (to any reader not in the discussion), uninstalling Kaspersky or turning off Kaspersky's live protection would also likely have solved the problem.  However, I prefer Kaspersky to MSE, and I made my choice accordingly.

    Also, "If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus)," does not say I downloaded MSE from CNET or tell anyone else to.  Even if I did, you saying, "if you got MSE from that site look no further , you have your problem right there," is not correct at all.  The source of the download isn't the cause of the problem, which is what you are saying.  Talk such as that is what I was referring to when I said you may just confuse a reader (at least one who doesn't know any better).  Even Steve acknowledged the legitimacy of that statement when he said: "Your advice about other security solutions is fairly sound."  This isn't the forum to debate the merits or trustworthiness of CNET.  If you trust it - use it.  If you don't - then don't
    Saturday, January 23, 2010 9:14 PM
  • Sliverine:

    I'm not on here to trash Microsoft.  I don't have a problem with MS.  I'm using a PC with Vista and I use the MS Office suite.  I would have kept MSE on my computer if there wasn't a live scan that conflicted with Kaspersky.  I'm not going to debate Kaspersky vs. MSE here.  That is a choice for individuals to make for themselves.   

    You said, "The rest of what you are saying is essentially just backhanded trashing of MS."  Like what?  It's best if you use an example rather than broad generalizations.  However, if everything I said is true, then you are forced to make comments without any specificity - like you did.  What I did criticize was this forum - at least their handling of the MSMPENG problem.  I honestly don't know why you guys come to the conclusion that, "It's pretty obvious that the default assumption on this forum is a desire to use MSE successfully."  Maybe for you, but not for everyone.  I mean, this forum isn't called "How to Use MSE Successfully";  it's called "MSMPENG".  I got here (and I'm sure others as well) by seeing that MSMPENG was consuming too much RAM when I was in task manager.  I didn't even know it was the MS security engine.  I just knew it was a problem on my PC that needed to be resolved.  

    I googled MSMPENG and this was the first entry.  I figured out what it was in here, but as Condoghost said: "Interesting - no answers only endless probabilities."  I read the entire thread and he was exactly right.  This thread is over a year old and the only advice is to go into msconfig and turn off all startup programs and figure it out for yourself.  What I did was provide people with an answer if they don't want to do that - if their goal is simply to stop MSMPENG from hoarding all of their RAM and regain control over their computer.  It may not be an "MS-friendly" answer, but it does resolve the problem. 

    You're right, this is, now, quite a discussion.  Hopefully readers will take away that there are different ways to solve their MSMPENG problem, and there are security alternatives they can turn to if they can't solve their problem while using MSE.  If someone wants to keep MSE, they can use the msconfig method.  If not, they can try my recommendations.  If someone reads my conversation with Steve, then their MSMPENG problem should be resolved whichever approach they choose - which is the point.  

    Dabur: 

    I'm not going to dwell on this after this post.  If English is your first language...well...maybe you're young and your control of it may explain why you didn't understand what I was saying.  Anyway, "So, I just uninstalled Security Essentials.  That solved the problem immediately," does not give off an inkling of an impression that I use both programs.  It says uninstalling one (MSE in my case) solves the problem.  For the record (to any reader not in the discussion), uninstalling Kaspersky or turning off Kaspersky's live protection would also likely have solved the problem.  However, I prefer Kaspersky to MSE, and I made my choice accordingly.

    Also, "If you don't have a firewall or anti-virus, go to CNET and there are some great free programs you can download (try Zone Alarm as your firewall and either Avira or Avast as your anti-virus)," does not say I downloaded MSE from CNET or tell anyone else to.  Even if I did, you saying, "if you got MSE from that site look no further , you have your problem right there," is not correct at all.  The source of the download isn't the cause of the problem, which is what you are saying.  Talk such as that is what I was referring to when I said you may just confuse a reader (at least one who doesn't know any better).  Even Steve acknowledged the legitimacy of that statement when he said: "Your advice about other security solutions is fairly sound."  This isn't the forum to debate the merits or trustworthiness of CNET.  If you trust it - use it.  If you don't - then don't

    "Whether Security Essential was in conflict with my anti-virus/firewall (Kaspersky) or a driver, I wasn't going to go on a wild goose chase looking; nor was I going to disable any of those to run Security Essentials."

    thats what you wrote , thats your problem and the solution >> choose one ( you did ) , point , thats it , stop to complain and read the instructions during set up

    so nothing further has to be said , just my two proverbial two cents

    i will say it again , only download from the company that makes the software , not from third parties or fourth parties , older versions , spyware , adware , etc , those are problems we see in these forums due to people who advise to go to cnet , .... (for example)

    you can spend time to go after me , but nowhere did you post your version of mse , and some other facts , ... or did you post how high the commit charge was , ...

    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Saturday, January 23, 2010 11:34 PM
  • Steve: 

    I agree with a lot of what you said.  

    Thanks. ;-)

    I'll note that my reply that you refer to here: "Madoushi said he was using Defender because he was broke, that MSMPENG was crippling his computer's performance, he had tried disabling programs in msconfig to no avail, he was even getting ready to reformat his hard drive he was so desperate to free up RAM, and he asked your advice. What did you tell him? You advised him to download MSE.  That is why basing advice on your aforementioned assumption results in faulty advice.  First, simply replacing Defender with MSE shouldn't solve his problem because they use the same engine.  He would have the same problem, but with a different security program." included one very critical piece of information that you overlooked, which would more than likely resolve the CPU issue with MSMPENG...

    "run the Norton Cleanup tool (on the list here): http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91"

    So, my hope is that he followed *all* of my advice.

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, January 25, 2010 12:48 AM
  • I'm tempted to delete a whole bunch of posts from this thread. I won't, though, nor will I lock the thread - yet.

    I'll simply note that the goal is for people to practice secure computing and that they use legitimate, supported antivirus software.
    *This* forum is for Windows Live OneCare, which uses MSMPENG as the scan engine. People have experienced the high CPU issues since day 1 and in almost every case, it is caused by a conflict. Usually, that conflict is with other security software, but it has also been caused by interaction with drivers. The advice from day 1 has been:

    If you have other security software on the PC that provides real time protection along with OneCare, remove it. If you had other security software that expired or you removed other security software via Control Panel, look for a cleanup/removal tool from the vendor to make sure that it is gone. Failing that, contact support for help.

    And, yes, the assumption is that someone posting to the OneCare forum is looking for the problem to be resolved *and* to allow them to use OneCare, which they paid for.

    OneCare is now at end of life, so these forums will likely be closed at the end of 2010.

    MSMPENG is also the engine for Microsoft Security Essentials. Guess what? People have high CPU issues with MSMPENG, too. The advice for people using MSE is the same as above and they can contact support, if desired. They can also choose to switch to a different security product.

    Note that the forums for MSE are here: http://social.answers.microsoft.com/Forums/en-US/category/mse - so, if you arrived here from a search and are having a problem with MSMPENG and are using Microsoft Security Essentials, go to that forum.

    If you are not using MSE or OneCare, but Defender, the discussion groups for that are here: http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, January 25, 2010 1:00 AM
  • Stephen, Wow! Quite a discussion.  It's pretty obvious that the default assumption on this forum is a desire to use MSE sucessfully; fleek is disengenuous in his comments. Don't let pull your chain. Just tell him AGAIN;

    1. Multiple virus scanners, configured so that they run at the same time is a bad practice.
    2. Choose one antivirus service to run.
    3. If you choose MSE, delete the others.
    4. If you choose another service, such as Kaspersky, delete MSE.   

    The rest of what you are saying is essentially just backhanded trashing of MS - you are entitled to your opinions and there are forums for you to express that - but this is not one of them. Substitue MSE or OneCare for every mention of Kaspersky and Kaspersky for the MS products. Read it again and your remarks are just trashing  Kaspersky  

    I HAVE decided that I want to use MSE as my anti-virus engine - it is a great, lightweight product.  I have tested many and thats what I want to use. My computer with XP Pro SP3, Pentium D, 2GB Memory is useless for 5 or ten minutes after reboots, etc.  I understand that there is a conflicting service or program that needs to be disabled or deleted. Is there a protocol or KB article that provides some guidance. I do have a lot of things running on my computer, but no other virus checkers. 

    Thank you,
    Steve J.
    Ann Arbor, MI 
    Hi, Steve J.
    I don't think that it was the intent of fleek to bash Microsoft at all.

    Here's a KB article that decribes how to do a clean boot of XP - 

    http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    This will allow you to troubleshoot what's sucking up your resources at boot.
    Do note that this forum is actually for OneCare. You'll find the Microsoft Security Essentials forums here:
    http://social.answers.microsoft.com/Forums/en-US/category/mse

    -steve

    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Monday, January 25, 2010 1:03 AM
  •  
    Thanks. ;-)

    ...

    "run the Norton Cleanup tool (on the list here): http://social.answers.microsoft.com/Forums/en-US/msestart/thread/407bf6da-c05d-4546-8788-0aa4c25a1f91 "

    So, my hope is that he followed *all* of my advice.

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    You're welcome ;)

    And you're right ^

    Good Day
    Monday, January 25, 2010 3:43 AM

  •  People have experienced the high CPU issues since day 1 and in almost every case, it is caused by a conflict. Usually, that conflict is with other security software, but it has also been caused by interaction with drivers. The advice from day 1 has been:

    If you have other security software on the PC that provides real time protection along with OneCare, remove it. If you had other security software that expired or you removed other security software via Control Panel, look for a cleanup/removal tool from the vendor to make sure that it is gone. Failing that, contact support for help.

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~

    hi ,

    indeed , wheter its a small add on security toolbar or a dormant not fully uninstalled trial or other version of security software .

    sharing is an other problem , the engine was never made with massive up and download in mind , at max 15 or 20 gig a month , some users get this in a week and then they complain since every single bit is inspected , ...

    one more problem that is often found is to many programs at one time on a comp with not enough memory or cpu power , ...
    the charge on the memory stays the same , from 125 000 to 175 000 . the page faults can run in the millions but that is all normal , ... if faced with small memory then try to undue the bottlenecks and get either more ram , a usb stick or increase the cache a bit , ll three would be best needless to say .
    is in todays world such a scan engine needed ? yes , with the bugs , spyware , trojans and other nasty stuff its needed . if you do not want your computer protected and use a lot of cpu or mem power get external protection from your isp or get a hardware firewall with anti virus and anti spy or malware , this can free up a lot of power but be carefull , it can give a ac ertain false sense of security (!!) security starts with the user (!) get a good OS , update and back up , and optimize your pc , a erson will change the oil on his or he car but they refuse to defrag , or to remove some software , etc , ... downloading any file or opening any attach will sooner or later turn against the user , playing on line can do he same , hosting , the so called free online storage that uses a part of your comp are all security risks , not even to mention the usb sticks , phones , etc that are hooked up , the dvd that is copied but leaves with the rip a nice piece of monitoring software , etc , .... the more you use your comp the more that little protection engine will work , ...
    when i compare the msmp with for example outlook or using 4-5 tabs on the browser you will see that that will use more then msmp , ...

    most problems are again related to a bad source of getting the software , not updating , not following set up instructions , not willing to remove other security software , etc , ...

    the changes of having problems with msmp when use on a comp with lets sya vista with at least 2 gig or higher from there on are almost zero

    a few weeks ago i came for a visit to a friend , he had no less the 8 different security suites , ... and he was complaining about microsoft , ... after 2 days clean up his comp runs like it just came out of the box , ...

     have no idea about the numbers but i would state that at least 40 or more percent of the problems relates to either having other security or to have pieces left from previous installs , ...

    have a nice day and a good monday !

    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Monday, January 25, 2010 8:16 AM
  • That's a lot to read. So I'll keep it short. When I started the new version of Windows Live Messenger I knew there was something "off" about it. It didn't seem like I was sharing data but the program was defenatly indexing my pc. Then things got slower and slower. Yesterday I read about Prefetch files; *.pf and wouldn't you know it. It's the name of a folder in your windows map. Prefetch files are made to determine how running applications behave and how long it will take next time you start the process. Did I read that right ?  An app is going to decide for me ?  So, I deleted all the files and rebooted. That took a while but the pc wasn't sluggish after it had fully started. Applications were working fine. So what is happening here ?  ...  Turns out ms' sql express service is running amok. Together with hpqWmiEx.exe, hpwuschd2.exe, sqlwriter.exe, DWTRIG20.EXE, wlcomm.exe, LSSvc.exe, WLIDSVC.EXE, WLIDSVCM.EXE, Rtvscan.exe, MsMapEng.exe, wmiprvse.exe. Then I realise it is exactly what it looks like. Something is making an index of my pc and makes mirrows. Everybody who's got norton's AV has got "SymantecRootInstaller.exe" in "Documents and Settings\All Users\Documents" disguised as "LiveUpdate" received lately, 20th for me. So, you try and stop MsMapEng.exe in taskmanager but it keeps coming back. Everything in "Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Log" looks like it's a fraud. It has even generated it's own certificate. Trying to remove the process "sqlservr.exe" is not going to work. The solution is to uncheck "Windows Live Sync" as an exception on the windows firewall. Most home os' have limits in cmd. This is the birth of a brand new security age !  Project Geneva is being implemented; claim based security. Which could have the drawback that we loose our privacy but gain security and easability in surfing.

    Information is provided "AS IS" without any guaranty nor liability and, in no lesser extent, with devotion and care.
    • Edited by Shems Monday, January 25, 2010 10:38 AM spelling
    Monday, January 25, 2010 9:31 AM
  • That's a lot to read. So I'll keep it short. When I started the new version of Windows Live Messenger I knew there was something "off" about it. It didn't seem like I was sharing data but the program was defenatly indexing my pc. Then things got slower and slower. Yesterday I read about Prefetch files; *.pf and wouldn't you know it. It's the name of a folder in your windows map. Prefetch files are made to determine how running applications behave and how long it will take next time you start the process. Did I read that right ?  An app is going to decide for me ?  So, I deleted all the files and rebooted. That took a while but the pc wasn't sluggish after it had fully started. Applications were working fine. So what is happening here ?  ...  Turns out ms' sql express service is running amok. Together with hpqWmiEx.exe, hpwuschd2.exe, sqlwriter.exe, DWTRIG20.EXE, wlcomm.exe, LSSvc.exe, WLIDSVC.EXE, WLIDSVCM.EXE, Rtvscan.exe, MsMapEng.exe, wmiprvse.exe. Then I realise it is exactly what it looks like. Something is making an index of my pc and makes mirrows. Everybody who's got norton's AV has got "SymantecRootInstaller.exe" in "Documents and Settings\All Users\Documents" disguised as "LiveUpdate" received lately, 20th for me. So, you try and stop MsMapEng.exe in taskmanager but it keeps coming back. Everything in "Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Log" looks like it's a fraud. It has even generated it's own certificate. Trying to remove the process "sqlservr.exe" is not going to work. The solution is to uncheck "Windows Live Sync" as an exception on the windows firewall. Most home os' have limits in cmd. This is the birth of a brand new security age !  Project Geneva is being implemented; claim based security. Which could have the drawback that we loose our privacy but gain security and easability in surfing.

    Information is provided "AS IS" without any guaranty nor liability and, in no lesser extent, with devotion and care.

    hi ,

    there is loads of bogus info about that , what it does it learns and sees what you need the most , do not turn it off , that has nothing to do with your problem ,

    okay , back up , run the onecare scan , link below in signature , unflag virus scan and see what it finds , ...

    live sync can take some power but you should not notice it (!!!!)

    if you are unsure or thing your com might be infected run a full one care scan , do it overnight since it may take a huge amount of time , do not use the comp in the mean time (!!)
    and close all that is not needed like sync and messeneger

    buy for 35-50 usd a good usb stick so you van have some ready boost , at least 8 gig so you can have 4 gig in mem support

    defrag , upgrade your OS to seven , do a diskcheck , etc , ....  type msconfig in the start pane and see what runs at boot and what runs now , ...

    you can choose what to index and what not , only do what you need the most like pics etc , .... do not index your entire harddrive !!

    that should speed it up and keep you occupied for two days , ... if it does not go , well post again

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Monday, January 25, 2010 1:26 PM
  • I'm tempted to delete a whole bunch of posts from this thread. I won't, though, nor will I lock the thread - yet.

    I'll simply note that the goal is for people to practice secure computing and that they use legitimate, supported antivirus software.
    *This* forum is for Windows Live OneCare, which uses MSMPENG as the scan engine. People have experienced the high CPU issues since day 1 and in almost every case, it is caused by a conflict. Usually, that conflict is with other security software, but it has also been caused by interaction with drivers. The advice from day 1 has been:

    If you have other security software on the PC that provides real time protection along with OneCare, remove it. If you had other security software that expired or you removed other security software via Control Panel, look for a cleanup/removal tool from the vendor to make sure that it is gone. Failing that, contact support for help.

    And, yes, the assumption is that someone posting to the OneCare forum is looking for the problem to be resolved *and* to allow them to use OneCare, which they paid for.

    OneCare is now at end of life, so these forums will likely be closed at the end of 2010.

    MSMPENG is also the engine for Microsoft Security Essentials. Guess what? People have high CPU issues with MSMPENG, too. The advice for people using MSE is the same as above and they can contact support, if desired. They can also choose to switch to a different security product.

    Note that the forums for MSE are here: http://social.answers.microsoft.com/Forums/en-US/category/mse - so, if you arrived here from a search and are having a problem with MSMPENG and are using Microsoft Security Essentials, go to that forum.

    If you are not using MSE or OneCare, but Defender, the discussion groups for that are here: http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx

    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~

    Steve, thx for the info re this is OneCare another forum for MSE and another for Defender. Most interesting, three separate forums all of which, and I'm guessing here because I've yet to look at the others, having the same problem of 100% CPU around MsMpEng.exe.

    Well you'll no doubt be pleased to hear that I've resolved most of my 100% CPU problems; I've unistalled MSE, wiped out Defender and gone for Outpost Firewall Pro and Avira AntiVir Personal. I still get the occassional 100% CPU loading MS Word for example and I can't play MP4 files with QuickTime Pro anymore because running that now gives me 100% CPU conflicts but never mind. It'll do for now until we actually get replies from some who have actually discovered what caused their "conflict" so that others don't have to go re-inventing the wheel.

    Most surprising on this forum is this one fact: not a single reply from anyone telling us what they discovered was causing them "conflict". Amazing. And not a single post from you Steve for example listing the Top-10 results of "conflict". Now I most certainly do realise that "conflict" can be caused by "anything" B-U-T wouldn't it be nice to know the Top-10 Anything found to date?

    Just a thought is all.

    When I have time I'll go and bug the MSE forum and also the Defender forum, but only after I've read the squillions of posts to see if anyone posted their answers there.

    Thx everyone; it's been a real experience. 
    Tuesday, January 26, 2010 11:55 AM
  • Hi, Condoghost.

    Actually, there was at least one post way back where a problem with MSMPENG was dscovered with a specific driver that was not a security product. I don't recall exactly what it was, but the Antimalware team addressed it with an engine update in each case.
    Most of the time, the conflict is found to be scanning software - other antivirus products and the like.
    The difficulty with these CPU spikes, whether due to MSMPENG, or in your current situation with MP4 files and Quicktime Pro, is that there is often not a single cause that affects a slew of people. Each situation is unique, though it is likely that there are others with the same condition and the same cause.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    • Proposed as answer by damn_windows Friday, January 29, 2010 12:56 PM
    Tuesday, January 26, 2010 1:01 PM
  • Alright Kids....GOOD NEWS... Im running MicroSoft Security Essentials (same engine as ONECARE?) in a multi-anti-virus platform and I can notice NO performance changes.

    I was here month ago cause MS sec. essentials had dogged my sys beyond my tolerance.  any way, at that time I had

    IMB THinkpad R60
    1.5 yrs old
    celeron M
    XP Home

    anti-malware byte
    spybot
    AVG and ....
    of course micro sec. essential

    well the system was slowwer than an abacus.


    I got rid of MSE...
    got hit ny another trojan a week ago
    had to do fac. hard drive restore

    now...i really wanted the security essentials because ..face it..it was able to detect viruses and repair viruses when the other programs had no clue!

    So, by chance malware was malfuntioning..so i uninstalled..

    i added security essentials in its place and i hanve no ill dogging of my sysenm like i did the forst time i used it....i guesss getting rid oof malware did the trick?

    so i have avg, spybot., xp operatring sys, and MSE.  all in harmony..heh and fast again. joy..hope this helps...
    OH...do an uninstalll...of MSE....(if sloooooooow).....  couple of reboots...and install again fresh.

    GL....biutches
    • Edited by damn_windows Friday, January 29, 2010 1:14 PM correction
    Friday, January 29, 2010 1:12 PM
  • Alright Kids....GOOD NEWS... Im running MicroSoft Security Essentials (same engine as ONECARE?) in a multi-anti-virus platform and I can notice NO performance changes.


    You're in the wrong forum. MSE forums are here:
    http://social.answers.microsoft.com/Forums/en-US/category/mse

    You need to *remove* AVG if you intend to continue with Microsoft Security Essentials. It is not intended as an addition to other security software providing real time virus and spyware protection.

    You can keep MalwareBytes as long as it is not the paid version, running all the time. You can also run Spybot Search & Destroy, as long as you do not enable Tea-timer, which provides real time protection.
     

    You should never have more than one security product installed on the PC providing active protection/scanning. This can cause performance issues, system instability, and can hinder the effectiveness of both products at providing protection.

    -steve


    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    • Proposed as answer by Dabur972 Saturday, January 30, 2010 1:29 AM
    Friday, January 29, 2010 3:35 PM
  • Hi, Condoghost.

    Actually, there was at least one post way back where a problem with MSMPENG was dscovered with a specific driver that was not a security product. I don't recall exactly what it was, but the Antimalware team addressed it with an engine update in each case.
    Most of the time, the conflict is found to be scanning software - other antivirus products and the like.
    The difficulty with these CPU spikes, whether due to MSMPENG, or in your current situation with MP4 files and Quicktime Pro, is that there is often not a single cause that affects a slew of people. Each situation is unique, though it is likely that there are others with the same condition and the same cause.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~

    hi ,

    a low spike is caused by updating , but like you write , most is due to other security programs , some IE toolbars can also cause high run mode , most of the time its MSE trying to do its job , for example if you are downloading ten movies , surfing , mailing etc , ... and there is potential ( !! ) that its unsafe MSE will check all , needless to say that that is actually good , MSE tries to fully protect you unlike other products that are NOT pro-active (!) most of the cases can be fixed and nine out of ten they are due to the user of MSE ,
    i have seen one router that had software on the comp having a high usage of MSE , over one 1 or there around , but when i dug deeper i found the cause , the user had abou 5 gig of space on his comp others could use as storage , so MSE was constantly trying to check each and every file , .... after updating the router and getting forefront there are no problems any more , .... just one example inwhere MSE got the blame from a lot of people for no reason , ...

    have a nice weekend
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Saturday, January 30, 2010 1:17 AM
  • Alright Kids....GOOD NEWS... Im running MicroSoft Security Essentials (same engine as ONECARE?) in a multi-anti-virus platform and I can notice NO performance changes.

    I was here month ago cause MS sec. essentials had dogged my sys beyond my tolerance.  any way, at that time I had

    IMB THinkpad R60
    1.5 yrs old
    celeron M
    XP Home

    anti-malware byte
    spybot
    AVG and ....
    of course micro sec. essential

    well the system was slowwer than an abacus.


    I got rid of MSE...
    got hit ny another trojan a week ago
    had to do fac. hard drive restore

    now...i really wanted the security essentials because ..face it..it was able to detect viruses and repair viruses when the other programs had no clue!

    So, by chance malware was malfuntioning..so i uninstalled..

    i added security essentials in its place and i hanve no ill dogging of my sysenm like i did the forst time i used it....i guesss getting rid oof malware did the trick?

    so i have avg, spybot., xp operatring sys, and MSE.  all in harmony..heh and fast again. joy..hope this helps...
    OH...do an uninstalll...of MSE....(if sloooooooow).....  couple of reboots...and install again fresh.

    GL....biutches

    hi ,

    instead of getting more protection what you have done by getting all those security programs is actually to switch each other off and open your computer , ...

    the MSE set up told you not to have any other security software , ... as a result you could be infected with unknown bugs , ...

    you need to make a choice and keep only one , and go for something good , keep MSE or get avast 5 or online armor

    despite the fresh install there is still a rsik of infection , click the onecare link below in my signature and run a full scan , it might take a while but its important not to use your computer while scanning and to close all programs like messenger , mail , etc , ... disable all security software also ( you can leave MSE )

    if you keep one security sofware get a fresh downloadfrom that company so you will know that you have the correct sofware , do not use third party downloads

    if you need more security get either a modem or use a hardware firewall with anti virus and anti malware scanning , you can also ask your ISP to put you behind a security screen , some ISP's do this for a low fee

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Saturday, January 30, 2010 1:29 AM
  • Stephen,

    I have installed Live One Care and Windows Defender for the last few months after being killed by Mcfee performance issues. This has been a blessing.  But I see a bit of the "World revolves around me" with this issue of MsMpEng.exe being a resource pig.

    Try putting in a few delay loops in the start-up so things can get done by the custom. We are trying to do work and security performance issues is going to kill your product like it is Mcfee.


    Friday, February 05, 2010 5:04 PM
  • BTW, 

    A thought, since you think it is a conflict with other security packages, why not scan for these products in your code and place a warning to the customer?

    Second, I kill MDM and wuauclt.exe when I start up as not to burn out my CPU (joke). Actually it lets me get going.


    Friday, February 05, 2010 5:15 PM
  • Stephen,

    I have installed Live One Care and Windows Defender for the last few months after being killed by Mcfee performance issues. This has been a blessing.  But I see a bit of the "World revolves around me" with this issue of MsMpEng.exe being a resource pig.

    Try putting in a few delay loops in the start-up so things can get done by the custom. We are trying to do work and security performance issues is going to kill your product like it is Mcfee.



    If you are running OneCare, you should not be running Defender as Defender is included in OneCare.
    OneCare is going away -  http://social.microsoft.com/Forums/en-US/onecareinstallandactivate/thread/0000c782-ed1b-4ed3-8afb-87989bb9638c

    And I'm just a fellow customer. :-)
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Friday, February 05, 2010 6:07 PM
  • BTW, 

    A thought, since you think it is a conflict with other security packages, why not scan for these products in your code and place a warning to the customer?

    Second, I kill MDM and wuauclt.exe when I start up as not to burn out my CPU (joke). Actually it lets me get going.



    OneCare *does* scan for conflicting programs at install and periodically as part of Tune-up. However, it can't scan for *everything* that might be present, hence the advice to contact support when faced with this issue.
    Killing those processes at startup should not be needed - there's most certainly an issue with your system.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Friday, February 05, 2010 6:09 PM
  • Steve,

    Thank you for the response you gave me in e-mail. It was thoughtful.

    I just want to get back to the issue of MsMpEng.exe being a resource pig. This is 'form' over 'content'. If the background facility sucks the life out of the CPU then customers, like me, can't get work done and it is frustrating. You need to be better then the competition. I quit McFee even thought it is free from COX because it has performance issues. You at least are concerned and I appreciate that.

    You need a way to suspend what you do so I can get work done on my old XP, Sony computers. It may not be an issue too much longer since I just got my Droid and use the desktop computer much less now.


    Sunday, February 07, 2010 5:35 PM
  • BTW, 

    A thought, since you think it is a conflict with other security packages, why not scan for these products in your code and place a warning to the customer?

    Second, I kill MDM and wuauclt.exe when I start up as not to burn out my CPU (joke). Actually it lets me get going.



    OneCare *does* scan for conflicting programs at install and periodically as part of Tune-up. However, it can't scan for *everything* that might be present, hence the advice to contact support when faced with this issue.
    Killing those processes at startup should not be needed - there's most certainly an issue with your system.
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    hi ,

    indeed since in this case crypto should not be removed , ... (!!)

    big boota you should be carefull to mess with those settings , ...

    have a nice day

    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Sunday, February 07, 2010 7:09 PM
  • I find the registry tool in free-to-download program CCleaner also fixes the problem, as someone not really comfortable with Regedit who found a fast solution. Whether that's because of MsMpEng.exe scanning a broken registry entry, or because of its trying to scan itself, as Jamie P suggests, I'm not sure.
    Monday, February 15, 2010 2:30 PM
  • Forgive the novice question, but how does one get to and/or use MSCONFIG?
    Monday, February 15, 2010 7:43 PM
  • I find the registry tool in free-to-download program CCleaner also fixes the problem, as someone not really comfortable with Regedit who found a fast solution. Whether that's because of MsMpEng.exe scanning a broken registry entry, or because of its trying to scan itself, as Jamie P suggests, I'm not sure.

    hi ,

    stop right there , CCleaner will not fix anything , for that matter it will make any problems far more problematic !!

    no MSE does not scan itself , only its log files and some other sub folders and monitors some parts of the engine.

    what could happen is indeed that MSE will scan a broken reg or file , but there is no good way to spot this , in fact this is how a lot of bugs are found , ... !

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Monday, February 15, 2010 9:51 PM
  • Forgive the novice question, but how does one get to and/or use MSCONFIG?

    hi ,

    * start * click MSCONFIG in the search pane thats it , you then get a small pop up inwhere you changed the programs that are running now or the start up , unless you know exactly what you are doing you should not play with it since it can seriously affect the way how the OS works and other software !

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Monday, February 15, 2010 9:53 PM
  • Hi Steve,

    One more thought... I tried to set the Priority on wuauclt.exe to 'Low', but I get 'access is denied'. 

    Why not allow users to choose what priority they want their security package to be set?

    As I said before Microsoft Security Essentials should operate unnoticed in the background. Try reading about secure systems at:


    Yes, I was a Multician.

    Cheers,

    Big Boota
    Tuesday, February 16, 2010 4:35 PM
  • Hi Steve,

    One more thought... I tried to set the Priority on wuauclt.exe to 'Low', but I get 'access is denied'. 

    Why not allow users to choose what priority they want their security package to be set?

    As I said before Microsoft Security Essentials should operate unnoticed in the background. Try reading about secure systems at:


    Yes, I was a Multician.

    Cheers,

    Big Boota

    hi ,

    you want protection or not ?

    if you do then stop to play with it , .... the reason why many are set above normal or high is simple , they need to react fast and they need to be able to run on top BEFORE something happens !

    if you change those options dont be surprised when you have a problem , warranty will not cover you neither for that matter , you do so at your own risk (!!)

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Tuesday, February 16, 2010 9:59 PM
  • Security software is your life, not mine. It is not good enough it protects the user, it also needs to be performent and not encumber the user. At this you fail.

    Cheers,

    BTW, read about Multics, the most secure operating system ever built. We solved those problems.

    Wednesday, February 17, 2010 12:31 AM
  • Security software is your life, not mine. It is not good enough it protects the user, it also needs to be performent and not encumber the user. At this you fail.

    Cheers,

    BTW, read about Multics, the most secure operating system ever built. We solved those problems.


    hi ,

    you give the impression its my fault , its not , you give the impression you build multics , did you ? probably not ! and you are wrong , its not the most secure neither

    a system can only be as secure as you want it to be , any system has shortcomings , weak spots , etc , ... but all that is of the main case > MSE

    if you want to play with MSE and change its reg , go ahead but dont come and complain you had a problem afterwards , ... (!!)

    have a nice day


    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Wednesday, February 17, 2010 12:43 AM
  • Dabur,

    Nope, I did not accuse you or imply any fault. In fact, I like the package and use it exclusively.

    I worked on Multics for eight years as a group of developers from MIT, Honeywell and Uof Calgary. Many of the best and brightest people contributed to Multics. I only point this out because we never stopped improving on perfection. While MSE is good, you need to heed the comments about it's problems too. Accept the 100+ comments here as constructive criticism, even if you do not realize there is a problem people were willing to take the time to post and are meant to make this better.

    Please don't be defencive and always think outside the box.

    Cheers,
    Richard

    Wednesday, February 17, 2010 5:01 PM
  • Hello Jamie,

    Thank you very much for your great explanation.
    Excluding MsMpEng.exe from the processes also solved the problem for me even with the newest version of Microsoft Security Essentials from february 2010!
    My problem was also that MsMpEng.exe was using between 50 and 100% CPU every view minutes blocking execution of any other application for about 10 seconds.
    This was really annoying and blocking me from doing any productive work.
    Now by adding the following to the registry solved the problem for me:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes]
    "MsMpEng.exe"=dword:00000000

    Now MsMpEng.exe is not using more then max. 10% CPU :-)

    I find it a little strange that I never had such a problem with e.g. Antivir or similar products which also include malware protection.
    Hopefully Microsoft will be able to solve this problem permanently for all users!
    However, I am satisfied with Microsoft Security Essentials now with this fix.

    All the best.

    Friday, February 26, 2010 8:06 AM
  • Hello Jamie,

    Thank you very much for your great explanation.
    Excluding MsMpEng.exe from the processes also solved the problem for me even with the newest version of Microsoft Security Essentials from february 2010!
    My problem was also that MsMpEng.exe was using between 50 and 100% CPU every view minutes blocking execution of any other application for about 10 seconds.
    This was really annoying and blocking me from doing any productive work.
    Now by adding the following to the registry solved the problem for me:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes]
    "MsMpEng.exe"=dword:00000000

    Now MsMpEng.exe is not using more then max. 10% CPU :-)

    I find it a little strange that I never had such a problem with e.g. Antivir or similar products which also include malware protection.
    Hopefully Microsoft will be able to solve this problem permanently for all users!
    However, I am satisfied with Microsoft Security Essentials now with this fix.

    All the best.


    hi ,


    and your protection is trown away with it , ....

    have a nice day
    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Friday, February 26, 2010 5:36 PM
  • The developers just don't get it. Over and over again they are told there is a performance problem but seem not to get it!

    Must be Bill Gates gives them high powered workstations with more power then God. I think they need to work on a single processor cheap platform like the rest of us mortals.


    Saturday, February 27, 2010 2:27 AM
  • The developers just don't get it. Over and over again they are told there is a performance problem but seem not to get it!

    Must be Bill Gates gives them high powered workstations with more power then God. I think they need to work on a single processor cheap platform like the rest of us mortals.



    hi ,


    maybe Microsoft should install a help and install file for MSE , with pictures that is easy to understand , ....

    1 people dont want to uninstall other security software and then they have problems with MSE

    2 people dont want to click upgrade in MSE when told , maybe they are lazy , ...

    3 people refuse to accept the solutions provided by the real experts who know what they are doing , ....

    4 people need to stop playing with the core of MSE and change the registry , it will lead to problems and then they cry , ...

    5 people need to update windows

    6 people need to check what is needed before the install software that cant run on the older computer wih 256 mb mem

    7 Microsoft has developed and distributed true the Gates foundation a low cost cheap computer for thirdworld countries !

    8 people need to read whats posted in the forums before they jump the gun claiming they know better , .....

    9 people need to act more safely instead of downloading X pictures and movies that are infected with trojans , .... not even to mention the need to be less naive , ....

    10 by the way MSE was not developed on high powered workstations , .... in was born on a few small ( low powered ) computers in an office cubicle in Microsoft Research Labs , ....

    those are the general feelings of the people and staff in the support sections and are more or less also the view of the developers , .... >>> not the fake wanna bee developers who from time to time show up and brag <<<

    have a nice weekend


    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Saturday, February 27, 2010 5:12 AM
  • The developers just don't get it. Over and over again they are told there is a performance problem but seem not to get it!

    Must be Bill Gates gives them high powered workstations with more power then God. I think they need to work on a single processor cheap platform like the rest of us mortals.



    Big Boota,

    I'm running OneCare on an old Sony VAIO 1.5GHz P4 with only 512MB RAM and absolutely no issues.

    I'm also running the new Microsoft Security Essentials on a 1.9GHz P4 and barely notice its presence other than when the Quick Scan occurs around 2:00am each day.

    I've never had any issues with MsMpEng.exe even though I've had multiple previous anti-malware applications installed on each of these systems.

    Performance issues are specific to a small subset of systems and almost always relate to issues with either malware such as rootkits, remnants of other old anti-malware applications, uncommon drivers or other third-party applications that cause MSE to go into overdrive.  Sometimes odd exclusions or other configuration tricks will appear to 'fix' or at least reduce the overhead associated with such problems, but these solutions often appear to make no sense and may not be repeatable for others.

    Those who have the issues are understandably frustrated, but the only possible chance to fix the issues is to assure that all other anti-malware are fully removed, including running any removal tools they may provide.  Then insure that no malware such as a rootkit are present and finally contact MSE Support to trouble-shoot further if nothing else has worked.

    Since most of these issues relate to corruption or other issues with that specific PC, it's not likely all of these will ever be fixed, so expecting this to be accomplished by changes to the program itself is a pipe dream.  The only ones likely to be fixed over time are those caused by new drivers or applications.

    Rob
    Saturday, February 27, 2010 5:39 AM
  • Rob,

    Thank you for your insightful response.

    I still think this is a problem looking for a solution.  You apparently don't have this problem with your computers, but the hundreds of posts here is a systemic indication that a problem exists.

    Firstly, since you have some indication of what can cause this, (malware such as rootkits, remnants of other old anti-malware applications, uncommon drivers or other third-party applications that cause MSE to go into overdrive.) why not build a 'scrubber' program to fix at least the known issues? Not everyone has the knowledge or time to try and fix them on an individual basis.

    Secondly, I don't know what kind of Software Engineering practices you use at Microsoft, but from what I have seen of Vista and IE8, it might be time to run a performance evaluation of the code. Some old code inefficiency can be removed just by desk auditing the code. Those modules being called the most might be better optimized by re-writing them in a primitive assembler code which would be more efficient then what is generated for compiler code.

    As I said before, the MSE is a good package. Being retired and basically lazy I would not take the time to comment if I didn't way to see you guys succeed.

    Cheers,

    Big Boota
    .
    Saturday, February 27, 2010 5:14 PM
  • Rob,

    Thank you for your insightful response.

    I still think this is a problem looking for a solution.  You apparently don't have this problem with your computers, but the hundreds of posts here is a systemic indication that a problem exists.

    Firstly, since you have some indication of what can cause this, (malware such as rootkits, remnants of other old anti-malware applications, uncommon drivers or other third-party applications that cause MSE to go into overdrive.) why not build a 'scrubber' program to fix at least the known issues? Not everyone has the knowledge or time to try and fix them on an individual basis.

    Secondly, I don't know what kind of Software Engineering practices you use at Microsoft, but from what I have seen of Vista and IE8, it might be time to run a performance evaluation of the code. Some old code inefficiency can be removed just by desk auditing the code. Those modules being called the most might be better optimized by re-writing them in a primitive assembler code which would be more efficient then what is generated for compiler code.

    As I said before, the MSE is a good package. Being retired and basically lazy I would not take the time to comment if I didn't way to see you guys succeed.

    Cheers,

    Big Boota
    .

    hi ,

    its not possible , to many various causes . windows update check for each person what updates are missing , if people choose not to follow set up for example it will not work , ... with MSE you get the message at install to remove any other anti bug software , if people still choose to install MSE with 4 or 5 other security suies and then they have prolems there is nothing Microsoft or anyone else for that matter can do , .... (!!)

    trust me when i say that Microsoft does ( actually constantly ) evaluate all the time the soft and hardware , 24 / 24 and 7 / 7

    its not about changing the code , the main problems lay with the users , .... for example all that registry edit and tweak soft that allows people to change to many things , or all those so called tools and self made solutions that actually create more problems , when support asks people not to use them you can bet the user's will do it and come up with a whole bunch of ' so called fixes that in fact are BS ' and then they blame Microsoft or support * sigh *

    how hard can it be to click ' upgrade ' ?? well it seems to hard ! 98 percent of the people who come to this site and complain about MSE have not even clicked the ' ? ' mark or even read the faq on the MSE site , ... ( i think the number is higher ) how do you get that changed ? thats the key

    and MS should be more hardon the users , if you break it the warranty should be void , you break it you fix it , ....

    if you buy a car and change the engine and go back to the dealer will you get a refund for example ? NO , well the same should be done with MSE

    writting in a simpler code is no option , you have to make it complicated , the bugs today can read the simple code allready , ... thats why many AV and AM are spread over the system now in order that they are protected from bugs who target the AV or AM , the other problem is that simple code will lead also to too many problems from kids on holidays or people who think they can improve it while in fact they destroy it , ...

    today to many people have MSE installed that is to old , millions of people still have the old beta installed , and nearly 75 percent has more then one other AV or AM product installed next to it , ... sorry but i think i speak for many ( including MVP's and MOD's ) that i am sick and tired of people who ask for help when they are responsible , ask mr boots , he can testify to it , .... some people complain and when you help them you find out 2 months later they still have no clicked ' upgrade ' or uninstalled the beta and downloaded a good version from a certain site , they refuse and wine on and on about MSE not working and it being crappy software and not finding this or that , etc , ...

    hey not saying this is you he ! but when you help the people who follow the ill advice and they have lost holidays pictures due to some idiot who tweaked MSE while infact it was a trojan they installed you cant help it after a while but to be upset from time to time , ... across from me in the office and other user is trying for weeks to help people with MSE who have made the bad judgement of getting MSE from zdnet ( first beta ) the reviews from the people on that site are misleading and people believed a so called expert to install a fix he made , well on friday the proof came out that all those people are infected , the tweak closed the AV engine to do its job , .... just a small example

    have a nice day





    Scan with OneCare + 50 Windows 7even Tips + Plagued by the Privacy Center? REMOVE IT + Threat Research & Response Blog + Sysinternals Live tools + TRANSLATOR+ Photosynth + Microsoft Security + Microsoft SUPPORT + PIVOT from Live Labs + Microsoft Live Labs + Office 2010 beta + Get Windows LIVE!
    Tuesday, March 02, 2010 11:01 PM
  • Locking this thread as it has deviated from the original intent, though still related. Further discussion on MSE sould take place in the MSE forums:
    http://social.answers.microsoft.com/Forums/en-US/category/mse
    -steve
    ~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~
    Wednesday, March 03, 2010 12:25 PM