ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous
2014-06-17T02:28:27+00:00

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall? 

Command:    MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

               AM Delta:                    NIS Full:  

       Engine: Not included  NIS engine:    2.1.10502.0

  AS base VDM: Not included  NIS base VDM:  111.0.0.0  

  AV base VDM: Not included  NIS full VDM:  111.25.0.0 

 AS delta VDM: 1.175.2352.0

 AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

     Copied mpasdlta.vdm

     Copied mpavdlta.vdm

     Copied gapaengine.dll

     Copied nisbase.vdm

     Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

                         Watson Report:    Position:

                HRESULT: 0x80070005        P1       

         FailedFunction: MpUpdateEngine    P2       

              Operation: AM Delta          P3       

 SourceComponentVersion: 11.1.4590.0       P4       

    SourceComponentName: mpsigstub.exe     P5       

         ProductVersion: 4.5.218.0         P6       

            ProductName: Windows Defender  P7       

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

                         Watson Report:    Position:

                HRESULT: 0x80070005        P1       

         FailedFunction: MpUpdateEngine    P2       

              Operation: NIS Full          P3       

 SourceComponentVersion: 11.1.4590.0       P4       

    SourceComponentName: mpsigstub.exe     P5       

         ProductVersion: 4.5.218.0         P6       

            ProductName: Windows Defender  P7       

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command:    MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe" 

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command:    MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe" 

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command:    MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command:    MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2014-07-08T09:27:06+00:00

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

Was this answer helpful?

0 comments

50 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2014-06-25T20:06:54+00:00

    1a.  2008

    1b. Clean install of Win8 RTM, then clean 

    install of Beta Win8.1, then clean install of 

    RTM Win8.1. Prior to Win8 ran Win7 and Vista 

    prior to that :)

    1c. November 2013

    2a. June 11th per the history

    2b. What Definitions version is displayed in 

    Defender's Update tab? Tab does not open

    1. Strictly MS software only, never any 3d party 

    firewall or anti-malware

    1. No
    2. No

    6a. 

    KB2957689, KB2964736, KB2939576, 

    KB2957189,KB2965788, KB2966072 are ALL installed

    6b. 4/30/2014

    7a. Version 11.0.9600.17126, update 11.0.9 

    KB2957689

    7b. Chrome is installed

    1. Yes, 114.0.0.1235
    2. NO, never! 

    Thank you for investigating this

    Was this answer helpful?

    0 comments
  2. Anonymous
    2014-06-24T07:15:04+00:00

    If VS update is not working, Defender is not working and updating and even Refresh is not working then I don't think this is the case of 'buggy virus definition software'. Something is wrong with Windows and it seems it can be fixed by fresh install only.

    BTW, this behavior of Defender can be caused by malware (as Steve said earlier) or conflicting software. Here are some steps (just basic troubleshooting steps) you have to follow to ensure this is not due to any kind of conflict or infection:

    1. Scan your PC with HitmanPro and Malwarebytes(Free). I know you scanned with Defender Offline but still give them a try.
    2. Run a scan with AppRemover. This tool finds conflicting softwares and removes them.

    After these two scans, boot in clean boot state and try to run Windows Defender again.

    In addition, run Windows Update Fix it to ensure Windows Update is working properly.

    Prashant Kumar

    Was this answer helpful?

    0 comments
  3. Anonymous
    2014-06-24T02:28:45+00:00

    Or, is there a better option? Like, maybe, a way to update the virus definitions without all this rigamarole? I mean, really, do I have to reinstall to just enable buggy virus definition software that's unfortunately part of the O/S to be updateable by other buggy update software? How do you ship updates that fail to install and not immediately revise them? I know you get reports of failed installs, are they investigated? Should I wait a few weeks and see if the next round of updates to the definition files work?

    With the Defender service disabled, it would appear that the system is indeed damaged.

    I believe you indicated that you tried the manual update from the portal, too.

    https://www.microsoft.com/security/portal/default.aspx

    I understand your frustration, but I wouldn't be so quick to point the finger at Defender as being the problem. Defender appears to be the victim.

    All errors reported via Windows Error Reporting are analyzed -- most by tools and a rare few by humans. The metrics that come from these reports are used in targeting fixes and solutions for Defender and Windows.

    My personal recommendation at this point -- install 3rd party antivirus if you aren't willing to reset Windows to factory (assuming this isn't also broken).

    -steve

    Was this answer helpful?

    0 comments
  4. Anonymous
    2014-06-23T22:36:40+00:00

    Still no luck. Tried to refresh - got through the process only to have it reboot and say, "There was a problem refreshing your PC. No changes made." Clicked on 'more information', got the 'checking for solution' then nothing.

    Assuming Win8.1 64-bit...

    Please answer each of the following [admittedly tedious] diagnostic questions in a correspondingly-numbered list in your very next reply, preferably without quoting this post:

    1a. When (approx. date) did you purchase the computer?

    1b. Did the computer come with Win8 (or Win8.1) preinstalled, did you do a clean install of Win8 (or Win8.1), or did you upgrade a (e.g., Win7) computer to Win8?

    1c. Assuming you started with Win8 => When (approx. date) was Win8.1 installed?

    2a. When (approx. date) were you last able to update Defender?

    2b. What Definitions version is displayed in Defender's Update tab?

    1. What third-party anti-malware applications are installed, if any?  What third-party firewall, if any?
    2. Has a Norton application or a McAfee application EVER been installed on the computer since you bought it?
    3. Did a Norton free-trial or a McAfee free-trial [pick one] come preinstalled on the computer when you bought it? (Doesn't matter if you never used or Activated it.)

    6a. Is KB2957689, KB2964736, KB2939576, KB2957189, KB2965788, KB2966072 and/or KB2926765 listed in Installed Updates (not Update History)? [1]

    6b. When (exact date) was KB2919355 installed according to Installed Updates?

    7a. What Update Version & KB number are displayed in the second line of text in IE11's Help | About [Alt+H+A] tab; e.g., Update Version: 11.0.54 (KB1231231) ?

    7b. Is Firefox, Chrome or any other alternate browser installed?

    1. Is Adobe Flash Player v14.0.0.125 for Internet Explorer installed? TEST HERE USING INTERNET EXPLORER ONLY! => http://www.adobe.com/software/flash/about/
    2. Are you in the habit of using "Registry cleaners" "directly or indirectly" (e.g., Registry Mechanic; System Mechanic; RegCure; RegClean Pro; Advanced SystemCare; Registry Booster; McAfee QuickClean; Glary Utilities; AVG PC TuneUp; Norton Registry Cleaner; PCTools Optimiser; SpeedUpMyPC; PC Doctor; TuneUp Utilities; WinMaximizer; WinSweeper; Comodo System Cleaner; Advanced System Optimizer; CCleaner's Registry Cleaner component)?

    =======================================================

    [1] Control Panel | Programs and Features | View installed updates (in left-hand menu)

    Was this answer helpful?

    0 comments