MsMpEng.exe writes large amounts of data to vmem file

Question

MsMpEng.exe writes large amounts of data to vmem file

Sourcell 5

I have a VMware Workstation virtual machine stored on an external removable SSD. Every time I start it, VMware Workstation creates a vmem file for it to store the virtual machine's memory data.

At this point, MsMpEng.exe keeps writing a lot of data to this vmem file, causing the SSD to reach 100% active time and my virtual machine to stop responding for a while.

User's image

I have tried to exclude paths, processes, and files related to VMware Workstation and vmem file using the following powershell commands, but it still does not change the behavior of MsMpEng.exe

Set-MpPreference -ExclusionPath "F:\Virtual Machines\Kali"
Set-MpPreference -ExclusionProcess "C:\Program Files (x86)\VMware\VMware Workstation\*","C:\Program Files (x86)\VMware\VMware Workstation\ x64\*","vmware.exe","vmware-vmx.exe","mksSandbox.exe"
Set-MpPreference -ExclusionExtension ".vmem",".vmdk"

So what can I do to prevent MsMpEng.exe from writing large amounts of data to the vmem file?

Also:

Why is MsMpEng.exe writing data instead of reading it?
I've allocated 32 GB of memory to the VM.

Anonymous

2024-06-07T01:53:38.84+00:00

Hi Sourcell,

Thanks for your post. "Msmpeng.exe" is a legitimate process related to Windows Defender. It is not recommended to disable or remove this process as it plays a crucial role in protecting your system from malware and other security threats. Try performing a full system scan and see if the issue persists after that.
Sourcell 5 Reputation points

2024-06-07T14:09:07.0666667+00:00

Hi Ian,

Thanks for the comment!

I also agree that removing or disabling the entire MsMpEng.exe process is not a good idea. Generally, we still need MsMpEng.exe to protect our computer.

I just want to configure the MsMpEng.exe process so that it ignores vmem files to avoid the annoying performance problems associated with VMware Workstation virtual machines described in the question. At the same time, the configuration I did using the Set-MpPreference command in the problem description did not have the desired effect.

As for your suggestion of a full disk scan, I don't think it will solve the problem, but of course, I'll give it a try. Because the vmem file is created when the VM starts up, but the vmem file is also deleted when the VM shuts down, which is equivalent to it being a temporary file.

I think the problem may be a bug in the real-time protection feature of Windows Security.