On Mon, 11/24/2025 12:00 PM, Jim the Geordie wrote:
Using Process Explorer, I see that MsMpEng.exe is almost always the biggest memory user. I believe that that is M$ Defender.
Does it need to be running all the time?
That's a real-time scanner. That's what it does. In real time.
It basically shadows your activities and watches how
things are going. It is quite possible, at least half of the
RAM space it uses, holds a compressed copy of all the signatures.
And just for the record, some of the real-time scanners,
they do have limits. One I was playing with, the Firefox tarball
was too big for it, and it actually choked on that while
scanning -- the scanner actually exited and wasn't running.
That was a "commercial" scanner, and it couldn't even handle
a very large tarball. I had to move all my tarballs to
a separate disk, so the stupid thing would not step in pooh
when scanning C: :-) I'm not aware of MsMpEng having a flaw
like that.
When the computer boots, it scans the "hot spots", the
most likely areas for a threat to be in. Such as scanning
System32, and your Program Files perhaps.
Paul
--- PyGate Linux v1.5.1
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)