Windows 10: MpCmdRun file "SpyNetService -RestrictPrivileges -AccessKey..........

Hi,
[am using windows 8.1]
my laptop used to be continuously unable to update Defender after using the system restore [used restore to an earlier time to be able to update defender,as this proiblem occurs regardless] and then updating Defender,if i try again on another day i would get a message that defender wasnt allowed to update the virus signatures, have forgotten the "reason" in the msg.
Now, i am having a look at the "MpCmdRun" file that is in the windows/temp folder,as the laptop developed a problem at the same time as the windows defender problem above,where i am not able to delete certain files and folders in the windows/temp folder,such as the MpCmdRun files and the Crashpad folder with its files it contains,unless i take ownership of it [have to do this every time i want to delete these files].
I suspected malware.

And NOW there are entries in the MpCmdRun file:
"MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey..............."

DO I HAVE SPYWARE ON MY LAPTOP?

HAVE MULTIPLE ENTRIES like the above as well as the below :
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges"

BUT now i am able to update defender,which i havent been able to do for a long time,unless i reformat the laptop or i use system restore ..........?!

Could anyone shed some light or have more info on this??

THANKS in advance

regards

:)

 

MpCmdRun killing my internet connection after installing creators update

Hi Brian,

The MpCmdRun.exe is associated with the Windows Defender program and is located in
C:\Program Files\Windows Defender. There are malicious programs that uses the same name so you won't suspect that it is malware. To check if this process is a malicious program, you can follow these steps:

• Right-click Start and select Task Manager.
• Under the Process tab, locate the MpCmdRun.
• Right-click MpCmdRun and select Open file location.

If the location is C:\Program Files\Windows Defender, then the system is safe and secure. If the location is elsewhere then we suggest that you run a virus and malware scan on your computer.

Let us know if you have any other questions.

 

MpCmdRun runs permanently with massive log files


Fragmentation check shows I have huge log files (and log.bak) at
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp

They show a log entry at least twice per second EVERY second as follows
----------------------------------------------------------------------------------
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Start Time: ‎Thu ‎Jan ‎21 ‎2016 10:00:59

WDEnable
ERROR: WDEnable(TRUE) failed (8007139F)
MpCmdRun: End Time: ‎Thu ‎Jan ‎21 ‎2016 10:00:59
-------------------------------------------------------------------------------------


What is what trying to do, and why doesn't it learn and stop?
How can I get rid of the problem?
Thanks

[ windows 10 Pro 1511 10586.63 ]

 

msmpeng.exe writing huge TMP* files to c:\windows\temp

We're having the following problem on one of our Windows 10 (version 1903) workstations.

At random intervals, about once every two days, msmpeng.exe starts writing files of up to 15GB to c:\windows\temp, with names like TMP0000002E27D3A3A88E075D32. It keeps adding more files until the drive is full and the system grinds to a halt. Resource monitor shows msmpeng.exe reading equally fast as it is writing.

I've tried to look into this in detail, and found something that might possibly be relevant. The same temp folder contained a small log file called MpCmdRun.log that got updated about 4 minutes before the TMP-issue started. Here's the tail:

With process explorer I saw that msmpeng.exe also had locks on these log files:

• c:\ProgramData\Microsoft\Windows
  Defender\Support\MPDetection-20190729-093413.log
  
• c:\ProgramData\Microsoft\Windows
  Defender\Support\MPLog-20190705-153212.log
  

Yet they don't seem to contain any logging around the time of the issue.

Given the appearance of msmpeng.exe and mpcmdrun.exe this is clearly a Windows Defender related issue. I can find some similar symptoms on other forums, yet only related to Windows XP, 7, in very outdated posts.

Would anyone have a clue as to how to debug this?