Antimalware Service Executable can be annoying when it suddenly starts using a lot of CPU, RAM, or disk. Your laptop fan gets loud, apps open slowly, and Task Manager shows a process you may not even recognize.
The quick answer is this: you can stop Antimalware Service Executable temporarily by turning off Microsoft Defender real-time protection, but the safer long-term fix is usually to reduce when and how Defender scans your PC.
You should not remove it, delete it, or leave your computer without antivirus protection. Antimalware Service Executable is part of Microsoft Defender Antivirus, and its job is to protect your PC from malware.
What is Antimalware Service Executable?
Antimalware Service Executable is the background process used by Microsoft Defender Antivirus. In Task Manager, it may also appear as MsMpEng.exe.
Its job is to scan files, apps, downloads, and background activity for possible threats. That is why it sometimes uses CPU, memory, or disk resources. It is not automatically a virus just because it uses system resources.
In most cases, it is a normal Windows security process.
Why is Antimalware Service Executable using high CPU, RAM, or disk?
There are several common reasons.
1. Microsoft Defender is scanning your files
The most common reason is simple: Defender is scanning your system. This can happen in the background while you are using your PC.
If it is scanning a large number of files, compressed folders, downloads, or external drives, CPU and disk usage can rise.
2. A scheduled scan is running at the wrong time
Windows can run scheduled antivirus scans. If a scan starts while you are working, gaming, editing videos, or using heavy software, your PC may feel slow.
3. Real-time protection is checking files as you open them
Real-time protection scans files before they are opened or executed. This is good for security, but it can feel heavy if you are opening many files at once.
4. Defender is updating security intelligence
Microsoft Defender regularly updates its threat definitions so it can detect newer malware. During updates and scans, temporary resource usage can increase.
5. Another antivirus or security tool is conflicting
If you have another antivirus installed, there may be overlap or conflict. Running two security programs at the same time can sometimes slow down your system.
Before you disable anything, check these quick things first
Before you try to stop Antimalware Service Executable, do these simple checks.
Restart your PC
A restart can stop a stuck scan, clear temporary memory issues, and reset background services.
Check if a scan is running
Open Windows Security and check the Virus & threat protection area. If a scan is already running, wait for it to finish if possible.
Update Windows Security
Outdated Defender components can sometimes behave badly. Run Windows Update and let Microsoft Defender update its security intelligence.
Watch Task Manager for a few minutes
If CPU usage is high for only a short time, it may be normal. The real problem is when Antimalware Service Executable stays high for a long time and makes the computer difficult to use.
Method 1: Temporarily turn off real-time protection
This is the fastest way to stop or reduce Antimalware Service Executable activity for a short time.
Use this only when you need to troubleshoot, install trusted software, or test whether Defender is causing the slowdown.
Steps
- Open Start.
- Search for Windows Security.
- Open Virus & threat protection.
- Under Virus & threat protection settings, click Manage settings.
- Turn Real-time protection to Off.
Important note: Windows may turn real-time protection back on automatically. That is normal. Microsoft Defender is designed to protect your PC, so temporary disabling is not meant to be a permanent fix.
Method 2: Change when Defender scans your PC
This is one of the best fixes if Antimalware Service Executable slows your PC during work hours.
Instead of disabling protection, you can schedule scans for a time when you are not using the computer heavily.
Steps
- Press Windows + R.
- Type taskschd.msc and press Enter.
- Go to Task Scheduler Library.
- Open Microsoft > Windows > Windows Defender.
- Find Windows Defender Scheduled Scan.
- Open its properties.
- Go to the Triggers tab.
- Change the scan time to a better time, such as late evening or lunch break.
- Save the changes.
This helps because Defender can still protect your PC, but it is less likely to interrupt you during important work.
Method 3: Add a careful exclusion for trusted files or folders
Exclusions tell Microsoft Defender not to scan certain files, folders, file types, or processes.
This can help if Defender is repeatedly scanning a large trusted folder, such as:
- A development project folder
- A video editing cache folder
- A virtual machine folder
- A folder with many large compressed files
- A trusted app folder that Defender checks too often
But be careful. If you exclude a file or folder, Defender will no longer check that item for threats. This can make your device less secure if you exclude the wrong thing.
Steps
- Open Windows Security.
- Go to Virus & threat protection.
- Click Manage settings.
- Scroll to Exclusions.
- Click Add or remove exclusions.
- Choose Add an exclusion.
- Select File, Folder, File type, or Process.
- Add only the item you fully trust.
What should you avoid excluding?
- Do not exclude your whole C drive.
- Do not exclude your Downloads folder.
- Do not exclude random unknown programs.
- Do not exclude folders where you often download files from the internet.
A narrow exclusion is safer than a broad exclusion.
Method 4: Reduce scan impact with CPU-related settings
This method is more advanced, but it is useful for managed devices, IT environments, or power users.
Microsoft Defender includes CPU-related scan settings. These settings can help control how much CPU Defender tries to use during scans. However, this is not always a simple fix for normal users.
For most home users, changing the scan schedule is easier than editing advanced Defender policies.
Method 5: Use a trusted third-party antivirus if you want Defender to stop being the main antivirus
If your goal is to permanently stop Microsoft Defender from acting as the main antivirus, the safest route is not to remove Windows security files.
The safer route is to install a trusted, compatible third-party antivirus. This way, your PC still has protection while Microsoft Defender stops being the main antivirus tool.
This matters because you should never leave your PC without antivirus protection.
Methods you should avoid
Some online guides suggest aggressive steps. Be careful with them.
Do not delete MsMpEng.exe
MsMpEng.exe is part of Microsoft Defender. Deleting system security files can break Windows Security and cause more problems.
Do not keep ending the task in Task Manager
Windows will usually restart the process. Ending it does not solve the root cause.
Be careful with registry edits
Some older guides recommend registry changes to disable Defender. This is risky for normal users. Windows security settings are protected for a reason, and changing them incorrectly can create bigger problems.
Do not leave your PC unprotected
Turning off antivirus protection may make the computer faster for a moment, but it also makes it easier for malware to infect your system.
Best fix order for most users
Use this safe order:
- Restart your PC.
- Check if Defender is running a scan.
- Update Windows and Microsoft Defender.
- Change Defender’s scheduled scan time.
- Add a narrow exclusion only for a trusted folder or app.
- Temporarily turn off real-time protection only for testing.
- Install a trusted third-party antivirus if you want Defender to stop being your main protection.
This order fixes the performance problem without creating unnecessary security risk.
