ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall?

Command: MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

AM Delta: NIS Full:

Engine: Not included NIS engine: 2.1.10502.0

AS base VDM: Not included NIS base VDM: 111.0.0.0

AV base VDM: Not included NIS full VDM: 111.25.0.0

AS delta VDM: 1.175.2352.0

AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

Copied mpasdlta.vdm

Copied mpavdlta.vdm

Copied gapaengine.dll

Copied nisbase.vdm

Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: AM Delta P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: NIS Full P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

0 comments

50 additional answers

Anonymous

2014-06-27T00:50:25+00:00

Everything worked fine with the RTM installed. This problem just showed up since the defender update started to fail around June 11th.

Should I uninstall KB 2939155? I can't find any info on it, on Bing or Google.

I believe everything was working before and after that KB was installed (in April - the defender tab problems are more recent than that.)

-Matt
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-27T05:14:23+00:00

[KB2919355 was installed on April 30th but this] problem [started] around June 11th.

When (exact date) were KB2957689, KB2964736, KB2939576, KB2957189, KB2965788 & KB2966072 installed according to Installed Updates?

When (exact date) was KB2939153 installed according to Update History (this time)?
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-27T20:35:24+00:00

[KB2919355 was installed on April 30th but this] problem [started] around June 11th.

When (exact date) were KB2957689, KB2964736, KB2939576, KB2957189, KB2965788 & KB2966072 installed according to Installed Updates?

When (exact date) was KB2939153 installed according to Update History (this time)?

The KB's were all installed on 6/11. Update History does not show KB2939153 installed.
Was this answer helpful?

0 comments No comments
Anonymous

2014-06-27T21:06:49+00:00

How have you determined that one or more of the Windows Updates you installed on the 11th didn't cause the problem (i.e., versus a bad or buggy Definitions update)?

If Defender's Update (History and/or Settings) tab is still inaccessible, I'm afraid a Refresh or a Reset will be your only recource. cf. http://windows.microsoft.com/en-US/windows-8/restore-refresh-reset-pc

[Ignore my question about KB2939153 - it wouldn't have been offered to your Win8.1 computer.]
Was this answer helpful?

0 comments No comments