Microsoft Defender Antivirus Malware Protection Engine
MsMpEng.exe is the Microsoft Defender Antivirus Malware Protection Engine, the core scanning engine behind Windows Defender. It loads malware definitions, manages real-time protection, and coordinates with the Defender service to inspect files, processes, and downloads for threats. The engine runs continuously as a background process to safeguard the system.
MsMpEng.exe is the executable that powers Defender's scanning pipeline, performing signature checks, heuristic analysis, and cloud-assisted lookups. As the central engine, it orchestrates scanning threads, updates, and integration with Windows Security UI.
Reasons it's running:
No. MsMpEng.exe is the Microsoft Defender Antivirus Malware Protection Engine, a legitimate Windows security component.
Typical locations include C:\Program Files\Windows Defender\MsMpEng.exe or C:\Program Files\Microsoft Defender\MsMpEng.exe, depending on Windows version.
You can temporarily pause real-time protection, but Defender should remain enabled for ongoing protection; disabling permanently is not recommended.
CPU usage spikes during scans or updates when Defender analyzes many files or downloads updates; scheduling scans and ensuring definitions are current helps.
Schedule scans for off-peak hours, ensure up-to-date definitions, limit high-I/O workloads during scans, and consider exceptions only for safe software.
If false positives occur, review quarantines, update definitions, and submit samples to Microsoft if needed; ensure exclusions are not overly broad.