MpIdle task from MSE

I think I am going to have to change my opinion about MSE, which has been quiet and unobtrusive for a long time, but suddenly has started acting up, and I don't seem to be able to get it to behave. The issue is that every day, as soon as the computer is idle, MSE insists on starting a full scan in the background. A full scan on this machine takes about six hours to complete, and involves a ton of disk activity. Sure, the task stops as soon as a work on the computer, but I really don't want the machine to be constantly busy with those pointless scans.

This is triggered by the hidden MpIdle task that MSE installs in the task scheduler. MSE will re-create that task if I delete it or modify it in any way. I searched the web for advice on this, and there were claims that this behavior would stop once a full scan is completed. So, I ran a full scan yesterday, which completed successfully, and the MpIdle task was gone. However, this morning, after starting the computer sure enough it was back, doing its thing. Does anybody have any advice on this? If this doesn't stop, then MSE will be gone, for good.

P.S.: For now, I have stopped the insanity by creating my own task that removes MSE's MpIdleTask as soon as it's created.

 

Just go into settings and uncheck "Run a scheduled scan". I do that as soon as I install MSE on any of our computers and none of them run any scans in the background.

 

I think that's it... my computers don't seem to have that task.

 

Pirx, I too have the task , but as MidnightSun & yuyi64 point out unchecking seem to prevent the launch while idle. Like you I did do a full scan initially. Unchecking Run a scheduled scan in settings seems to prevent the undesired behavior. I would uninstall MSE and install the latest version.
2.1.1116.0, Then do the full scan

 

I tried all of that, and I have never had scheduled scans set. Like I said, this behavior seems to have started suddenly, no idea what caused the issue. The way it was set, my MSE should never have scheduled any scans for any reason. There is clearly some bug involved here somewhere.

I finally compared registry settings between this computer and three more Win7 machines that behaved normally, and I found that mine had the key SFCState in HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Scan
set to a different value than all the others. So I reset the value of that key, and now things seem to be back to normal, with no MpIdleTask created anymore, and no extraneous scans. Knock on wood that this was the solution...

 

Pirx, thanks, I have learned from you! Did you set the SFCState to Zero ?

 

No, the other installations had the value "7" in there, so that's what I set it to. But, unfortunately, this story is not over: Now I don't have the MpIdleTask in the scheduler anymore, but this morning MSE again started scanning, even though there is no task in the scheduler...

Notice that there is no message in the event viewer for any of those scans. Looking at the Resource Monitor I can see that MsMpEng.exe performs what looks like a full scan of all the files on my computer. So now I am completely at a loss as to what is going on.

I have now uninstalled MSE one more time, made sure that all its registry keys and folders had been deleted (they were), rebooted, and reinstalled it again. Right now it's performing its initial scan, which I believe it always does on a new install (again, this is a "hidden scan", not the Quick Scan it prompts you to do right after installation). That scan should be done some time late this afternoon. Then I can check tomorrow if MSE again starts scanning. I'll post again once I know...

 

O.k., final update (knock on wood...): Seems like things are back on track now. SFCState seems to remain on 7 now, and I don't see anymore spurious scans. Still, I wonder what has caused this. And, of course, it should not be necessary to do the kinds of things I had to do to get MSE to behave. MSE was plain broken on my machine, and a simple reinstall would not resolve the issue. A normal user could not have fixed this, ever. Not exactly a recommendation for MSE...

 

Pirx, in hindsight any idea what might have caused the issue?
Have you ever created tasks for scheduled scans, using taskscheduler perhaps?
Curious about this issue because I can't find anything on Google, glad it's solved though.

 

I can really only speculate, but I found a couple of people guessing that maybe what is causing this is MSE not being able to scan certain files (due to the existence of reparse points, perhaps, or some sort of a conflict). I think the idea is that MSE will then try to re-scan later. Why it would do that without even telling me that there was a problem with a scan (note that it had always claimed that any scan I manually performed completed successfully) is a mystery to me.

Sorry I can't say more about this. When all is said and done I have to admit that I simply don't understand what happened here. All I know is that I'm glad I resolved this problem.