Antimalware Service Executable, also known as MsMpEng.exe, is a background process used by the built-in Windows 10 antivirus – Windows Defender.
What does the process do? Why is it causing high disk and CPU usage in Windows 10? How to disable it? Read more on the subject below.
What is Antimalware Service Executable (MsMpEng.exe) in Windows 10?
This particular process is Windows Defender’s main background service. It’ll exist and remain as a background process when your Windows Defender is active.
Its job is to scan the files in your computer for malwares and viruses, installing updates for Windows Defender, or anything else that has to do with Windows Defender.
Why is Antimalware Service Executable causing high disk and CPU usage?
When you open a program or access to a file, Windows Defender will scan the particular program or file you are about to open for malware. This will cause the MsMpEng.exe process to run at high resource usage for a short while, especially when the size of the file or program is very large. After the scan is completed, it will stop using any resource until its next task.
If the process continuously running at high disk / CPU usage, it could mean that Windows Defender is performing a regular scan, or is updating its virus definition. Usually, Windows Defender will perform the regular scan only when your computer is idle. But, in some cases, when the scan has started, it wouldn’t stop until it’s completed. You may want to just wait it out.
The point here is that it’s completely normal and fine for Antimalware Service Executable process to run in the background and using up resources to keep your PC from getting infected.
How to disable the MsMpEng.exe process?
Windows Defender will automatically be active when Windows 10 doesn’t find any other antivirus software running on your computer. Technically, to stop Windows Defender from running, you need to have a proper antivirus software installed, such as Avast, Kaspersky, Norton or McAfee.
When Windows detects any active antivirus software on your PC, it will switch itself off automatically. If it doesn’t, it will turn on its real-time protection to protect you from malwares.
Although we don’t recommend turning off Windows Defender, you can still disable it but only for temporary. You can’t just disable it permanently. No matter how many times you try to disable it, it will eventually turn itself back on. This is one of Microsoft’s measures to ensure that your computer is always under protection.
To temporary disable Windows Defender:
- Go to Start Menu.
- Search for Windows Defender Settings, then open it.
- Click on the Open Windows Defender Security Center button.
- Next, click on Virus & threat protection, then Virus & threat protection settings.
- Under Real-time protection, click on the toggle button to toggle it off.
If you already have an existing antivirus software running on your PC, check if the periodic scanning option is switched on. If it is, Windows Defender will still perform the regular scan despite already having another active antivirus program in Windows 10.
To disable (or enable) the Windows Defender’s periodic scanning, refer to step 1-4 above. In the Virus & threat protection window, toggle off the Periodic scanning under Windows Defender Antivirus options.
Is MsMpEng.exe a virus?
No, the process is not a virus if it’s located at C:\Program Files\Windows Defender or C:\ProgramData\Microsoft\Windows Defender\Platform.
You can check it by going to Task Manager > Details tab > right-click on MsMpEng.exe > select Open file location. If it’s not in the mentioned directory or any trusted folder, you may want to run a scan with another antivirus to see if it’s a malware.