RIVET
Home / Process library / msmpeng.exe
What is msmpeng.exe?
msmpeng.exe is Microsoft Defender Antivirus. Defender's scanning engine. It can use a lot of CPU during a scan, especially just after an update.
| Name | msmpeng.exe |
|---|---|
| Full name | Microsoft Defender Antivirus |
| Publisher | Microsoft Windows Publisher |
| Normal location | %ProgramData%\Microsoft\Windows Defender\Platform or %ProgramFiles%\Windows Defender |
| Safe to end? | Keep No. msmpeng.exe is part of Windows and should keep running. |
| If you end it | Real-time malware protection stops. Windows protects it from being stopped. |
How to check it's the real msmpeng.exe
- Open Task Manager (Ctrl+Shift+Esc) and go to Details.
- Right-click msmpeng.exe and choose Open file location. It should open
%ProgramData%\Microsoft\Windows Defender\Platformor%ProgramFiles%\Windows Defender. - Right-click the file, choose Properties, then Digital Signatures. The signer should be Microsoft Windows Publisher.
A file called msmpeng.exe somewhere else, or without that signature, is worth scanning with Microsoft Defender.
What RIVET shows
RIVET's process list shows msmpeng.exe with this explanation, the verdict above, and a signature check, so you can see at a glance whether it is the genuine Windows file. Ending a process can't be undone, and RIVET warns you before it ends anything Windows needs.
Questions
Is msmpeng.exe a virus?
The genuine msmpeng.exe is part of Windows, signed by Microsoft Windows Publisher, and runs from %ProgramData%\Microsoft\Windows Defender\Platform, %ProgramFiles%\Windows Defender. Malware sometimes copies the name, so check the location and signature as shown above.
Can I end msmpeng.exe?
No. msmpeng.exe is part of Windows and should keep running. Real-time malware protection stops. Windows protects it from being stopped.