What is Antimalware Service Executable? High CPU Disk Usage Explained

What is Antimalware Service Executable?

Antimalware Service Executable is a part of the Microsoft Defender antivirus that comes pre-installed with Windows. It is responsible for scanning files and processes in the background and updating virus definitions to help protect your computer from malware and other threats. This process runs under ‘msmpeng.exe’ and operates discreetly to ensure your system remains secure.

While it is a crucial component of your system’s security, the Antimalware Service Executable can sometimes cause high CPU and disk usage. This occurs when the process is actively scanning your files and programs for potential threats. Since it is a real-time protection service, it needs resources to scan all activities on your PC thoroughly.

Although the process may use a significant amount of CPU and disk space, it is important to remember that it serves a vital purpose in safeguarding your computer. However, if the high resource consumption becomes problematic, you can consider installing a different antivirus program, which may result in disabling the Antimalware Service Executable. Turning off Microsoft Defender without installing a suitable alternative may leave your system vulnerable to attacks.

In summary, the Antimalware Service Executable is an essential component of the Microsoft Defender antivirus program, which helps protect your computer from malware and other security threats. While it may cause high CPU and disk usage, its function is crucial for maintaining a secure and stable system.

Why does Antimalware Service Executable use a lot of CPU?

Antimalware Service Executable, also known as MsMpEng.exe, is a background process run by Windows Defender. Its main function is to scan your computer for potential threats such as malware, viruses, and other harmful software. While this process is essential for maintaining your system’s security, it can sometimes cause high CPU and disk usage.

One reason for the high CPU usage is that Antimalware Service Executable performs periodic system scans. These scans can be resource-intensive, especially when scanning large files or multiple folders. Sometimes, the process might scan its own folder, located at C:\Program Files\Windows Defender. This can lead to unnecessary consumption of CPU resources.

Another factor that might contribute to the high CPU usage is the real-time protection feature of Windows Defender. This feature monitors your system continuously, checking for potential threats in files, downloads, and installations. While real-time protection is essential to keep your system safe, it may cause a surge in CPU and disk usage.

To mitigate excessive CPU usage by the Antimalware Service Executable, you can try the following methods:

1. Scan Manually: Configure Windows Defender to perform manual scans instead of automatic scans. This way, you control when the scans occur, reducing the chances of experiencing high CPU usage at inopportune times.
2. Turn Off/On Real-Time Protection: Temporarily disable real-time protection if you find that it is causing high CPU usage. However, remember that this may leave your system vulnerable to threats, so re-enable the feature immediately.
3. Change Defender’s Schedule: Adjust the frequency and time of scheduled scans to ensure they don’t interfere with your computer usage. For example, you could schedule the scans to run when you’re not using your PC, like overnight or during your lunch break.

Remember that while addressing the high CPU usage issue is important, it’s crucial to maintain a balance between system performance and security. Always ensure that an up-to-date antivirus program protects your computer.

How to Stop Antimalware Service Executable from Using Too Much CPU

Solution 1: Prevent Antimalware Service Executable from Scanning its Own Folder

You can prevent Antimalware Service Executable from scanning its folder to reduce CPU usage.

1. Open Windows Security and navigate to Virus & threat protection.
2. Click on Manage settings under Virus & threat protection settings and scroll down to Exclusions.
3. Click on Add or remove exclusions, then Add an exclusion, and choose Folder.

Browse to the following folder and select it:

C:\ProgramData\Microsoft\Windows Defender

Solution 2: Disable Realtime Protection and Reschedule Scans

You can reduce CPU usage by disabling Real-time protection and rescheduling scans.

1. Go to Windows Security > Virus & threat protection > Manage settings.
2. Toggle off Real-time protection.
3. To reschedule scans, go to Task Scheduler > Task Scheduler Library > Microsoft > Windows > Windows Defender.
4. Right-click on Windows Defender Scheduled Scan and select Properties.
5. Under the Triggers tab, click Edit.

Solution 3. Add Antimalware Service Executable to Windows Defender’s Exclusion List

You can reduce CPU usage by adding Antimalware Service Executable to Windows Defender’s exclusion list.

1. Go to Windows Security > Virus & threat protection > Manage settings > Exclusions > Add or remove exclusions.
2. Click on Add an exclusion and choose Process.
3. Enter MsMpEng.exe and click OK.

Solution 4. Disable Windows Defender in Registry

Disabling Windows Defender in the registry can help reduce CPU usage.

1. Press Win + R and type regedit.
2. Click OK. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
3. Right-click on an empty space, click New and choose DWORD (32-bit) Value.
4. Name it DisableAntiSpyware and set its value to 1.
5. Restart the computer.

Warning: Editing the registry can cause serious problems. Proceed with caution and create a backup before making changes.

Solution 5. Update all Available Device Drivers

Outdated device drivers can cause high CPU usage. Update your drivers by going to Device Manager. Expand each category, right-click on each device, and choose Update driver. Select Search automatically for drivers.

Solution 6: Roll Back Windows Defender Definition Updates

Rolling back Windows Defender definition updates may help with high CPU usage.

1. Go to Settings > Update & Security > Windows Security > Virus & threat protection.
2. Click on Virus & threat protection updates and then Update history.
3. Look for the latest definition update, right-click on it, and choose Uninstall.

Last Updated : 15 October, 2023