ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous
2014-06-17T02:28:27+00:00

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall? 

Command:    MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

               AM Delta:                    NIS Full:  

       Engine: Not included  NIS engine:    2.1.10502.0

  AS base VDM: Not included  NIS base VDM:  111.0.0.0  

  AV base VDM: Not included  NIS full VDM:  111.25.0.0 

 AS delta VDM: 1.175.2352.0

 AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

     Copied mpasdlta.vdm

     Copied mpavdlta.vdm

     Copied gapaengine.dll

     Copied nisbase.vdm

     Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

                         Watson Report:    Position:

                HRESULT: 0x80070005        P1       

         FailedFunction: MpUpdateEngine    P2       

              Operation: AM Delta          P3       

 SourceComponentVersion: 11.1.4590.0       P4       

    SourceComponentName: mpsigstub.exe     P5       

         ProductVersion: 4.5.218.0         P6       

            ProductName: Windows Defender  P7       

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

                         Watson Report:    Position:

                HRESULT: 0x80070005        P1       

         FailedFunction: MpUpdateEngine    P2       

              Operation: NIS Full          P3       

 SourceComponentVersion: 11.1.4590.0       P4       

    SourceComponentName: mpsigstub.exe     P5       

         ProductVersion: 4.5.218.0         P6       

            ProductName: Windows Defender  P7       

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command:    MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe" 

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command:    MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe" 

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command:    MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command:    MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

                 Windows Defender:

         Status: Active           

        Product: 4.5.218.0        

         Engine: 1.1.10600.0      

     Signatures: 1.175.417.0      

     NIS Engine: 2.1.10502.0      

 NIS Signatures: 111.19.0.0       

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

               AS FE:      

       Engine: 1.1.10600.0 

  AS base VDM: 1.175.0.0   

  AV base VDM: Not included

 AS delta VDM: 1.175.2365.0

 AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

                         Watson Report:         Position:

                HRESULT: 0x80070490             P1       

         FailedFunction: PackagesNotApplicable  P2       

              Operation: (null)                 P3       

 SourceComponentVersion: 11.1.4590.0            P4       

    SourceComponentName: mpsigstub.exe          P5       

         ProductVersion: (null)                 P6       

            ProductName: (null)                 P7       

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2014-07-08T09:27:06+00:00

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

Was this answer helpful?

0 comments

50 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2014-07-07T22:34:43+00:00

    Volume in drive C has no label.

     Volume Serial Number is 067F-42C2

     Directory of c:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManag

    er

    05/11/2014  11:56 AM    <DIR>          .

    05/11/2014  11:56 AM    <DIR>          ..

    05/11/2014  11:56 AM           774,144 MpScanCache-1.bin

                   1 File(s)        774,144 bytes

                   2 Dir(s)  13,585,842,176 bytes free

    Value of 

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan\CacheFile

    is

    C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpScanCache-1.bin

    Will try chdsk. Should I try deleting this file? Maybe it'll be rebuilt and solve this problem?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2014-07-08T02:24:39+00:00

    chkdsk had no effect - same errors still occur. File is still present

    Was this answer helpful?

    0 comments
  3. Anonymous
    2014-07-08T02:37:26+00:00

    Prashant should be back soon, but I'd advise against deleting this file -- try renaming it.

    -steve

    Was this answer helpful?

    0 comments
  4. Anonymous
    2014-07-08T22:46:45+00:00

    SFCState value is 7.

    Deleting it required SYSTEM privilege, which seems awkward to obtain. I will rename and see if that makes a difference, thanks.

    Was this answer helpful?

    0 comments