Microsoft Security Essentials definitions and PFRO Errors

Topic

New Reply

Starting in April I noticed that the PFRO file was listing errors related to Microsoft Security Essentials definitions when it never had before. Something different with how MSE operates behind the scenes or something wrong I should look into? From time to time I do notice the MsMpEng.exe file running at 25% seemingly every single web page causing the computer to delay loading pages a lot.

The errors seem to occur every couple or few days and always related to the MpKsl###.sys and offreg.###.dll files along the lines of

PFRO Error: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{###}\MpKsl###.sys, |delete operation|, 0xc0000034

PFRO Error: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{###}\offreg.###.dll, |delete operation|, 0xc0000034

Speaking of which. Why does MSE use the Windows Temp folder as a permanent location to update Signatures and for the MpCmdRun and MpSigStub files rather than its ProgramData folder?

Reply | Quote

Replies

Since that post I have had to disable Microsoft Security Essentials real time protection as MsMpEng.exe won’t stop running at 25% constantly whenever browsing. I have MalwareBytes and don’t think getting a virus is a concern but I still wonder why MsMpEng.exe is doing that all of a sudden. Creates too much lag and substantial heat on the hard drive so disabling it seems the way to go.

Reply | Quote

Have you tried uninstalling MSE completely and cleaning the system of remnants and then re-installing MSE from here:

https://support.microsoft.com/en-us/help/14210/security-essentials-download

and while your at it downloading the most recent mpam-fe definitions from here:

https://www.microsoft.com/en-us/wdsi/definitions

Windows - commercial by definition and now function...

Reply | Quote

I haven’t tried uninstalling and then reinstalling. First, I expected it to be something that resolved itself. Then I just sort of disabled the real time protection, which fixes it, and thought I would give it some time. I would be concerned I would just trade one minor issue for something larger as it just happened on its own so I am hoping it just fixes it on its own also.

Definitions download for it fine automatically so don’t need to do so manually.

Thanks.

Reply | Quote

It’s your system, if you prefer to leave it open to drive-by malware et al, by disabling real-time protection, that’s entirely your decision. Good luck with your expectations and surf/ download carefully 🙂

Note: If your MB is v3.xx premium, you don’t need MSE.

If MB v2.xx with MSE I’d advise to keep MSE real-time protection on, carrying out my previous post suggestion.

Windows - commercial by definition and now function...

Reply | Quote

I hope my reply to your kind assistance didn’t read as dismissive or ungrateful. I suck at writing and now worry it might read that way. It is unintended as any reply is appreciated.

I suspected MWB had me covered if I disabled the MSE real time protection so thank you for the confirmation.

Oddly, MsMpEng.exe is behaving normally today for the first time in a week. Way over my head but it seems to fixed itself after it updated its defintions today. It appears to have started a week ago. Now idea why or how but on or after July 20th MsMpEng.exe would run constantly when a browser was open and for a couple minutes after. I tried looking through the MpSigStub log file but nothing makes sense to me and doesn’t look abnormal.

PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Engine_Patch_1.1.15000.2.exe
PackageName: C:\Windows\SoftwareDistribution\Download\Install\AM_Base_Patch1.exe
PackageName:*C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe
Patched mpengine.dll to 1.1.15100.1
Patched mpasbase.vdm to 1.273.0.0
Patched mpavbase.vdm to 1.273.0.0

Everything after is just numbered and unnumbered AM Delta definition updates so no idea what started it or fixed it. The PFRO errors that started in April are unrelated and still unknown.

Thank you.

Reply | Quote

With my initial reply, I was trying to establish whether or not corruption had occurred during an update causing errors. In the past I found that doing this had rectified the issues similar to yours on increased CPU usage when surfing as well as clearing any definition issues.

What probably fixed it was an integrated fix within a definition update.??
As for Your PFRO errors that started in April, your guess is as good as mine..
Fingers crossed it stays sorted 🙂

Windows - commercial by definition and now function...

Reply | Quote