What is the "MsMpEng.exe" process on Windows 8? Is the "MsMpEng.exe" process a virus? Can I terminate the "MsMpEng.exe" process?

"MsMpEng.exe - Antimalware Service Executable" process is a service that helps protect users from malware and other potentially unwanted software.

On the Processes tab of "Task Manager", "MsMpEng.exe" process may be listed as:

Image Name   PID  User Name   Memory    Description

MsMpEng.exe  928  SYSTEM     07%  70,608 K  Antimalware Service Executable

Additional information about "MsMpEng.exe" process:

Command line:
   c:\Program Files\Microsoft Security Client\MsMpEng.exe
   
Started by: service.exe

Files used:
   C:\Program Files\Microsoft Office 15\root\office15
   C:\Program Files\Microsoft Security Client\...
   C:\ProgramData\Microsoft\Microsoft Antimalware\...
   C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft
     \SystemCertificates\My
   C:\Windows\System32\drivers\MpFilter.sys
   C:\Windows\System32\drivers\NisDrvWFP.sys
   C:\Windows\System32\en-US\KernelBase.dll.mui
   C:\Windows\System32\en-US\WinSATAPI.dll.mui
   C:\Windows\System32\en-US\winhttp.dll.mui
   C:\Windows\System32\ntdll.dll
   C:\Windows\System32\ntkrnlpa.exe
   C:\Windows\Temp\TMP0000027AAE84E1DFC9C3A61E

Registry keys:
Key  HKCR\PROTOCOLS\Filter\text/xml
Key  HKCU\Software\Classes
Key  HKLM\SOFTWARE
Key  HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\...
Key  HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\...
Key  HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN
Key  HKLM\SOFTWARE\Microsoft\Microsoft Antimalware
Key  HKLM\SOFTWARE\Microsoft\Security Center
Key  HKLM\SOFTWARE\Microsoft\SystemCertificates\...
Key  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\...
Key  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
Key  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\...
Key  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Key  HKLM\SOFTWARE\MozillaPlugins
Key  HKLM\SOFTWARE\Policies
Key  HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
Key  HKLM\SYSTEM\ControlSet001\Control\Session Manager
Key  HKLM\SYSTEM\ControlSet001\Control\Session Manager\Environment
Key  HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5
Key  HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9
Key  HKLM\SYSTEM\ControlSet001\services\crypt32
Key  HKU\.DEFAULT\Control Panel\International
Key  HKU\.DEFAULT\Software\Microsoft\SystemCertificates\...
Key  HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion
Key  HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key  HKU\.DEFAULT\Software\Policies
Key  HKU\.DEFAULT\Software\Policies\Microsoft\SystemCertificates

"MsMpEng.exe" process is not a virus. You can terminate "MsMpEng.exe" process, or disable the "Microsoft Antimalware Service". if it consumes too much CPU resources. And you enable and start "Microsoft Antimalware Service" later if you want it back.

⇒ "unsecapp.exe" Process on Windows 8

⇐ "ibmpmsvc.exe" Process on Windows 8

⇑ System Service Processes on Windows 8

⇑⇑ Windows 8 Processes Tutorials