ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall?

Command: MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

AM Delta: NIS Full:

Engine: Not included NIS engine: 2.1.10502.0

AS base VDM: Not included NIS base VDM: 111.0.0.0

AV base VDM: Not included NIS full VDM: 111.25.0.0

AS delta VDM: 1.175.2352.0

AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

Copied mpasdlta.vdm

Copied mpavdlta.vdm

Copied gapaengine.dll

Copied nisbase.vdm

Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: AM Delta P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: NIS Full P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

0 comments

50 additional answers

Anonymous

2014-06-25T21:58:59+00:00

Clean install of Win8 RTM, then clean install of Beta Win8.1, then clean install of RTM Win8.1.

Defender's Update tab...does not open

How/where did you obtain "RTM Win8.1?"

Was Defender's Update tab (and other tabs, I assume) inaccessible when Win8.1 Preview (beta) was installed? ...when Win8 was installed? ...before you installed KB2939155?

Have you ever done a Refresh or a Reset since you did the clean install of Win8?
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-25T21:37:13+00:00

For your information:

You seem to use 2 profiles: SickOfViruses and syckofviruses

I've merged your 2 threads (created with different Profile) on same topic.

Please don't:

Post questions that are the same or similar to questions you have already posted. When someone has an answer to your question, that person will respond to you.

http://answers.microsoft.com/en-us/page/faq#faqCodeConduct3

Thanks for understanding.
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-25T20:06:54+00:00
1a. 2008

1b. Clean install of Win8 RTM, then clean

install of Beta Win8.1, then clean install of

RTM Win8.1. Prior to Win8 ran Win7 and Vista

prior to that :)

1c. November 2013

2a. June 11th per the history

2b. What Definitions version is displayed in

Defender's Update tab? Tab does not open
1. Strictly MS software only, never any 3d party
firewall or anti-malware
1. No
2. No
6a.

KB2957689, KB2964736, KB2939576,

KB2957189,KB2965788, KB2966072 are ALL installed

6b. 4/30/2014

7a. Version 11.0.9600.17126, update 11.0.9

KB2957689

7b. Chrome is installed
1. Yes, 114.0.0.1235
2. NO, never!
Thank you for investigating this
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-24T07:15:04+00:00
If VS update is not working, Defender is not working and updating and even Refresh is not working then I don't think this is the case of 'buggy virus definition software'. Something is wrong with Windows and it seems it can be fixed by fresh install only.

BTW, this behavior of Defender can be caused by malware (as Steve said earlier) or conflicting software. Here are some steps (just basic troubleshooting steps) you have to follow to ensure this is not due to any kind of conflict or infection:
1. Scan your PC with HitmanPro and Malwarebytes(Free). I know you scanned with Defender Offline but still give them a try.
2. Run a scan with AppRemover. This tool finds conflicting softwares and removes them.
After these two scans, boot in clean boot state and try to run Windows Defender again.

In addition, run Windows Update Fix it to ensure Windows Update is working properly.

Prashant Kumar
Was this answer helpful?

0 comments No comments