Antimalware Service Executable: High CPU Usage

Today I noticed that my Windows 8.1 was getting very slow. I decided to take a look at Task Manager where I noticed that AntiMalware Service was using about 70-90% CPU. For some instants, the usage was full, 100%!

This guide explains how to fix this problem and is applicable to integrated Windows Defender in Windows 8.x and to Microsoft Security Essentials in Windows XP, Vista and 7.
By saying this you are already understood AntiMalware Service Executable is a  Windows Defender/Security Essentials service, so ending this process is not recommended. Anyway, you won’t be able to end it because is a integrated system process, so you probably will get access denied exception.

Why does it happen?

It’s something ridiculous. I will try not be ironic at all … because I really want to.
In the Task Manager (pictures below are from Windows 8.x but the process is identical in 7 and older), if you right click AntiMalware Service Executable, you can open the file location.

 

The file in cause is MsMpEng.exe
Now I am able to explain why is it using so much CPU (when I took the picture it was more stable, but 11% stills considerable)
The MsMpEng.exe is the file used by Windows Defender/Security Essentials to scan your PC files. For some genius idea, that file is scanning itself. Why? Because .. Logic!
I am sorry but I really can’t explain why is that happening.
Anyway, let’s jump this part of questing ourselves why, and let’s fix it!
How to fix it?
Once you opened file location, you must the coy the directory. In Windows Explorer (8.x version), in top, click tab Home and Copy Path

Now, go to Windows Defender or Microsoft Security Essentials (search for it on Start Menu), go to Settings < Excluded files and locations

In first box, paste the path and click Add
The path will show up on the second box
Save changes São necessárias credenciais de administrador and your problem must be fixed

 

Leave comments or send e-mail to hyrokumata@outlook.com
 
 

You may also like...

53 Responses

  1. Anónimo says:

    thank you very much!!

  2. Anónimo says:

    Thanks!

  3. Anónimo says:

    Thank you man! 😉

  4. Anónimo says:

    Many thanks for the tip!

  5. Doesn't work for me please help!

  6. Anónimo says:

    my problem fixed… thanks so much…

  7. Anónimo says:

    Sadly, didn't help my constant 41% usage by Antimalware Service Executable.

  8. Mahmoud says:

    Great
    That worked with me.
    Thank you

  9. Anónimo says:

    Really good. Problem fixed thank.

  10. Anónimo says:

    Not sure it's a good idea from preventing security essentials from scanning whether their own exe is infected by something (a virus could have attached to it – well I don't know if those kind of virii are still around these days)

    The cause of msmpeng.exe eating CPU on my machine was that whenever my e-mail client, Mozilla Thunderbird, did anything, like get new mails, delete a mail, msmpeng.exe was going wild, so I added the Thunderbird folder in %appdata% to the excluded folders list, that helped.
    Maybe it's the same with other mail clients, too.

    Look here for Thunderbird :
    https://wiki.mozilla.org/Thunderbird:Testing:Antivirus_Related_Performance_Issues#Symptoms

  11. Anónimo says:

    This is a great way to make sure you are vulnerable to getting a virus. The process is scanning its one executable. How? Because: computers. The .exe is started and loaded into Memory. The process is actually run from memory not from the .exe file itself. The process then scans the file to make sure it's legitimate. Of course, this logic is still a bit confusing as an intruder could prevent the process from loading into memory, change the .exe, then run the .exe. This would open up the computer to getting all sorts of viruses.
    The solution presented will work and give you your CPU back but it's at the cost of being vulnerable to an attack replacing the .exe with malicious code. If you are OK with that then the presented solution is valid.
    If you are not OK with that – you should look further for a solution. For example, the reply from whoever posted the issue regarding Thunderbird.

    • Gui Mourão says:

      Well. it works. and if the antivirus is so worried about scanning itself, probably its not having time to scan the other files. anyway, its flawed, blame microsoft

    • Though I agree preventing Windows Defender from scanning itself is potentially dangerous, what "whoever posted the issue regarding Thunderbird" did is even more dangerous. The three most common ways of getting a computer virus is, namely 1. through the browser, 2. through email or 3. through flash drives that happened to be inserted in infected computers. If you have those covered, you're less likely to get your Windows Defender infected than if you have any of those vulnerable.

  12. Congcong Xue says:

    This is so cool! Thank you so much

  13. Unknown says:

    it's seem does not work on my PC, it's still running high.

  14. Tiger Wahid says:

    The most stupid solution i have ever read. Even more stupid people.

    • hyro says:

      Thanks for your visit and comment 🙂
      My solution is stupid… I am sorry to disappoint you. I wouldn't say stupid, at least, maybe a risky solution, but I don't think you meant that, did you? Tell me more Tiger Wahid, why is this stupid and what do you suggest? Calling people of stupid just because you have nothing else to do… meh!! at least justify please 🙂

    • hahahaha… tiger wahid… sounds indian dumbass!

  15. Oh wow, this article got it all wrong.
    Let's get a few things straight:
    – The Antimalware Executable is the PROCESS NAME of MsMpEng.exe, it is the same file!
    – The executable is NOT scanning itself! The disk usage is in respect to what is scanING, rather than what is being scannED. This means that the service executable is scanning 'SOMETHING', thus bringing Disk Usage to high percentages – LOGIC!!!

    The best thing to do is to pinpoint all programs with active foreground and/or background processes, and shut them down one by one until the the virus scan stops. When you're able to find the right program, you can either add it to the exclusions or leave it as it is.

    • hyro says:

      Thanks for notice that mistake 🙂
      The executable is NOT scanning itself. Could you tell me where did you find such information? I tried to contact Microsoft about this problem and they never mentioned something like what you are saying, though make sense and is obvious… Interesting is, if what you are saying is true, looks like I will have to disable system processes because the high CPU percentage happens even on Windows clean installations – a total fresh Windows install, no third party software. I know that what you are saying is true, if the process is using so much the hardware resources (HDD and CPU) that is explained by the fact of being scanning something, whatever it is. I concluded that problem was that the antivirus was scanning MsMpEng.exe, a file that is part of the software. This conclusion was made after several experiences on different PC's e.g Why does the real time protection takes much more hardware resources (this security feature evolves scanning files, as you know) than scanning a folder that excludes Windows Defender folder? Because of all of this, I suggested to exclude the path of scan. Of course, this is a bit risky. There might be some threats that can infect MsMpEng.exe or other Windows Defender files, but this was a solution for me and many other users.
      I will do some more research about this. Thanks for sharing your tip 🙂
      Trying to contact Microsoft support again…

  16. Nam Vu says:

    Thank you soooooo much man!

  17. Anónimo says:

    thank you !

  18. Anónimo says:

    Thank you so much!

  19. Anónimo says:

    Work for window 10?

  20. Alexis Ramos says:

    Genius, Amazing, Thanks so much, Muchisimasssss Gracias

  21. Gentlment you have it wrong/
    You expose yourselves to viruses.
    You most likely have a MSSQL EXPRESS database or other database on your computer. Remove the folder containing the mdf files and voila.

  22. Thank U Best Wishes From Peru

  23. JositoR says:

    Awesome solution. Thank you very much

  24. Anónimo says:

    Thank you, you´re a master

  25. Rob Urban says:

    How do I fix this annoying thing in Windows 10. It’s taking up memory and making my computer run slow. thanks

  26. Grine says:

    dduuuuuuddeeee ! Thank you so mutch !!! I just love you. After disabling Superfetch, my computer still wasn’t ok… And now, i found your solution ! thank you so much !

  27. Genius says:

    would not recommend, sounds like you are wide open for viruses after this. Other people recommend just closing the exe that is causing it to run

  28. Julio Peralta Saavedra says:

    That you sooo muuch

  29. bobby says:

    yes, you just have to go into settings for windows defender

  30. Lucian the Purifier says:

    I see some people say you expose yourself (by excluding W.Defender of scanning himself)?
    Is this the updated version i am looking at or not? because the older comments seem to hint at older content(or not, i can’t look into older content) Either way i have excluded the program to scan himself and will see what happends next. Thanks for the fix.

Leave a Reply

Your email address will not be published. Required fields are marked *