Windows 10: Cant get MsMpEng.exe back in programdata\microsoft\windows defender\platform\xxxxx

I took it out and put it in platform\ for a moment for a benchmark and I cant put it back into the proper folder.. any way to get it back in/rebuild defender?


I tried sfc /scannow to see if that would put it back and it didnt, and I also cant take ownership of the folder to get permissions while I move it and then change it back to SYSTEM after

:)

 

Programs Slow To Open Due To Windows Defender (MsMpEng)


This is something that I've noticed since Windows 8, but Windows Defender make some programs so slow to open. It's pretty noticeable on the programs that it does it on as it takes approx. 20-30 seconds to open them, even from an SSD, and if you look at Resource Monitor listed by CPU usage, you can see it's due to MsMpEng.exe running a scan before the program will open.

It would be understandable if it was doing it the first time the program had ever ran, or if the program wasn't signed, but that's not always the case. Canon DPP for example isn't signed, so presumably that's why Defender keeps scanning that, however here's an example of another program (SyncBackFree) that is signed, but yet Windows Defender still wants to keep scanning it on a daily basis despite nothing changing since previous scans.





Obviously I can add individual programs to the Windows Defender Exclusion list and exclude them from real-time protection, but what it is that Defender doesn't like with certain programs that is feels the need to keep scanning them daily? Is this a Microsoft problem, or is it down to the software not adhering to some sort of best practice policies Microsoft have laid out? There must me something that makes Defender treat it as potentially signed malware?

 

New Windows Defender Platform 4.18.1812.3-0

For those running custom scheduled tasks there's a new version platform folder:

C:/ProgramData/Microsoft/Windows Defender/Platform/4.18.1812.3-0/

This just came down on both my machines, no doubt in prep for tomorrow's CU.

 

High CPU usage from Windows Defender

I have been fighting this for the last 3 days.
An hour and a half ago I found this thread and followed yer-what's instructions, which are:

• kill the antimalware service executable process
• delete C:\ProgramData\Microsoft\Windows Defender\mpenginedb.db
• delete C:\ProgramData\Microsoft\Windows Defender\mpenginedb.db-wal
• restart defender process (or system like I did)

I don't know if that's permanent solution, but for the last 1,5 hours Defender process hasn't been slowing down my PC like it did before.

I've also got exclusions in place from my past attempts to fix the issue. These are

• C:\Program Files\Windows Defender\MsMpEng.exe
• C:\Program Files\Windows Defender
• C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MsMpEng.exe
• C:\ProgramData\Microsoft\Windows Defender

I have also disabled automatic sample submission and cloud-delivered protection and unchecked "run with highest privileges" in task scheduler.

If I won't encounter any issues with defender in the next few days, I'll enable above options and remove exceptions (one per day) to see, whether that breaks the antimalware service executable.


Hope that helps.