ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall?

Command: MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

AM Delta: NIS Full:

Engine: Not included NIS engine: 2.1.10502.0

AS base VDM: Not included NIS base VDM: 111.0.0.0

AV base VDM: Not included NIS full VDM: 111.25.0.0

AS delta VDM: 1.175.2352.0

AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

Copied mpasdlta.vdm

Copied mpavdlta.vdm

Copied gapaengine.dll

Copied nisbase.vdm

Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: AM Delta P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: NIS Full P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

0 comments

50 additional answers

Anonymous

2014-07-03T12:07:36+00:00
I think what Stephen Boots said is right. You can re-install from scratch or just install any other antivirus.

But before you do so, I want you to answer some questions (our last hope):
1. Open Registry Editor (in Start menu search for regedit.exe and open it). After opening Registry Editor, navigate to this registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and check values of 'Start' and 'Type' entries for these keys:
- WdBoot
- WdFilter
- WdNisDrv
- WdNisSvc
- WinDefend
Reply with 'Start' and 'Type' values.
1. In Registry Editor, navigate to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender

What is the value of DisableAntiSpyware and DisableAntiVirus entries?
1. In Registry Editor, navigate to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection

What is the value of DisableRealtimeMonitoring?

Note: DO NOT CHANGE ANY REGISTRY ENTRY!!!

Prashant Kumar
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-03T14:39:30+00:00

WdBoot: Start: 0, Type:1

Wdfilter: Start:0, Type: 2

WdNisDrv: Start: 3, Type: 1

WdNisSvc: Start: 3, Type: 16

WinDefend: Start: 2, Type: 16

DisableAntiSpyware: 0

DisableAntiVirus: 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection - no subkeys, value not set
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-04T07:35:57+00:00
Some more questions:
1. All the registry entries are correct. I think Windows Defender Service should run properly. How can you say Windows Defender Service is not working?
2. Open Task Manager (Ctrl + Shift + Esc), go to Details tab and see is MsMpEng.exe is running or not.
On thing you can try (if you still haven't) is clean boot. Clean boot and see if Defender works normally or not.

Prashant Kumar
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-05T02:03:50+00:00

The service is not running. The red flag is up on the taskbar, and msmpeng.exe is not running. If I manually start the services, it just dies quickly.

I haven't tried the clean boot trick yet,, I'll give that a try, frankly I'd be shocked if it made a difference.
Was this answer helpful?

0 comments No comments