Disk Activity and MsMpEng.exe Task

[BobH]

Res. Mon. Disk Act..jpg

As you can see in the screenshot captured from Task Manager's Resource Monitor, disk activity on my system on the C: drive is pretty high. I filtered to see what the MsMpEng.exe task is because it approaches the system and Firefox in disk hits. From the path and filename data, this appears to have something to do with monitoring the email client; so I shut Thunderbird down and it is still hitting the disk pretty hard.

I searched and discovered that this task has had lots of discussion on web forums. Some call it malware and others say that it is part of Windows Defender. Per Microsoft "Windows Defender is your first line of defense against spyware and other unwanted software. . . . " When I look at installed software, I see no reference to Windows Defender as a separately installed program; therefore I infer that is a component of the kernel or is bound up in MSE or another program.

Can anyone tell me what it really is and whether or not I should allow it to run? It seems to be a real resource hog, but that might just be the price one must pay for real time malware detection.

[HansV]

MsMpEng.exe is the core executable of both Windows Defender and of Microsoft Security Essentials (MSE).

Windows Defender is a built-in component of Windows 7. If you install another anti-virus program than MSE, it should be disabled, but if you install MSE, the built-in version will be replaced with that of MSE.

[BobH]

Perhaps I don't understand that explanation, Hans; but I do run MSE and no other AV. If MSE replaces it, why is it still showing up when I run Resource Monitor? Does MSE have a component that does what MsMpEng.exe does? If so, it seems to me that I have 2 competing programs running simultaneously and this one really has high disk activity and seems to run on the email port even when my email client is not running.

As you can tell, I'm still experiencing some issues. Occasionally, the system will hang for a moment or 2 and on others my Internet response times go in the toilet. The new router has improved connectivity a lot and I have a PCIE card network adapter that I will install one day next week, but I'm concerned that I'm seeing spikes in CPU usage and disk activity. To make matters worse, I cannot hang the onset of the problems on any recent events. The Windows Update kerfuffle of a few weeks back caused me to remove the bad update and the replacement was installed automatically.

[HansV]

From my previous reply: "MsMpEng.exe is the core executable of both Windows Defender and of Microsoft Security Essentials (MSE)."
So if MSE is your anti-virus program, you'll see MsMpEng.exe running in Task Manager and in Resource Monitor. That's nothing to worry about.