From: nospam@needed.invalid   
      
   On Mon, 11/24/2025 12:00 PM, Jim the Geordie wrote:   
   > Using Process Explorer, I see that MsMpEng.exe is almost always the biggest   
   memory user. I believe that that is M$ Defender.   
   > Does it need to be running all the time?   
      
   That's a real-time scanner. That's what it does. In real time.   
      
   It basically shadows your activities and watches how   
   things are going. It is quite possible, at least half of the   
   RAM space it uses, holds a compressed copy of all the signatures.   
      
   And just for the record, some of the real-time scanners,   
   they do have limits. One I was playing with, the Firefox tarball   
   was too big for it, and it actually choked on that while   
   scanning -- the scanner actually exited and wasn't running.   
   That was a "commercial" scanner, and it couldn't even handle   
   a very large tarball. I had to move all my tarballs to   
   a separate disk, so the stupid thing would not step in pooh   
   when scanning C: :-) I'm not aware of MsMpEng having a flaw   
   like that.   
      
   When the computer boots, it scans the "hot spots", the   
   most likely areas for a threat to be in. Such as scanning   
   System32, and your Program Files perhaps.   
      
      Paul   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)