Antimalware Service Executable runs when saving KiCad 6

Microsoft antimalware service executable (MsMpEng.exe) runs whenever a KiCad 6 file (_pro, _pcb or _sch) is saved, either by Cntr S or timed save. The program locks up for about 5 minutes or more and then becomes operational. Libraries and files are on a server, program in on a local laptop. Task Manager shows the antimalware service executable to run each time.

I tried to disarm antimalware service executable by exclusion, calling no spyware in regedit and group policy, and each time antimalware service executable runs when saving. Installed Avast to bypass Defender and then the program hangs up during save as Avast runs its antimalware. This is specific to KiCad 6 and is not a problem in KiCad 5. I may have to go back an rebuild my last project in KiCad 5 because the wait is ridiculous and uncalled for.

Go to Help>>About KiCAD. You will find a button to copy version information. That might be helpful here. We don’t even know which version of Windows you have running and that might give some clues. Obviously this isn’t expected behavior and most seem to not have this happening to them. That’s as much Windows help as I can give though. :wink:

A search on “antimalware msmpeng.exe” got quite a few results suggesting reconfiguration to reduce its usage of CPU and disk access.

One reason it might be activated often by KiCad v6 is the autobackup feature which saves project files periodically.

Good luck, maybe Windows users can elaborate.

This is not unique to KiCad 6. This is standard Defender behavior to scan all file IO activity.

KiCad 6.02. Windows 10 version 21H1, KB5010324 update.

That is where I started as well and it seems that it is a problem for many. I am not surprised considering how MS has handled other know issues.

No, I do not have the same issue with KiCad 5.1.12. Same pathways between our server and my client computer running the program - no interference on saving.

It is specific to KiCad 6.

I moved the KiCad 6 files (_pro, _pcb or _sch) to my local computer from our server and this fixed the issue. However, now the team cannot collaborate on editing the file since it is now on my local drive.

Any suggestions?


You shouldn’t have concurrent editors on project files anyway, this can cause inconsistencies. You need a code repository system for collaboration.

1 Like

We do not work on the projects concurrently. One person will execute part of the design and then another reviews the design in the project once the first is done.

I suspect that this issue is caused by the new method of saving whereby we save to a temporary file first and then, when that is successful, move the temporary file over the previous schematic/layout file.

This is safer in general as it protects against failed writes/crashes.

That said, it depends on the ability to immediately read a full file from the network share. This is where the Windows network caching slows us down as the antimalware software will tend to wait until the file is fully available on the network drive before reading it to check for malware (and then allowing the move/rename action)

We are addressing this by first saving the temporary file into the Windows temporary directory, which should not be a network share. This should allow antimalware to immediately read the file and allow the renaming.

This feature will be available in tomorrow’s 6.0 testing build. Please test it out from Downloads | KiCad EDA and let us know on the issue tracker if this does not resolve your issue.


That sounds about right because if I end the KiCad program after the antimalware service starts, the next time I open KiCad the program says that it was not shut down correctly, but the edits are there. I look forward to the test build.


This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.