ERROR 0x80070490 : MpSigStubMain - Windows Defender Updates

Anonymous

I'm seeing a similar problem - last raft of windows updates for my win8.1 x64 machine, everything works fine except the definition update for defender. I've tried downloading the definition update directly and ran the mpas-fex64.exe, which simply returns, no messages, but update still fails. Here's the mpsig* information showing defender's got some dll's out of sync. My guess is this has been failing for awhile. Any way to repair it short of a reinstall?

Command: MpSigStub.exe /program "C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe" WD /q

Start time: 6/15/2014 5:40 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

AM Delta: NIS Full:

Engine: Not included NIS engine: 2.1.10502.0

AS base VDM: Not included NIS base VDM: 111.0.0.0

AV base VDM: Not included NIS full VDM: 111.25.0.0

AS delta VDM: 1.175.2352.0

AV delta VDM: 1.175.2352.0

================================ PatchApplication ================================

Patched nisfull.vdm to 111.25.0.0

================================= MpUpdateEngine =================================

Package files for the engine update:

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P (?.?.?.?)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM (1.175.2352.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM (111.0.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm (111.25.0.0)

C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL (2.1.10502.0)

ERROR 0x800106ba : MpUpdateEngine(C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs)

================================== XcopyDeployment =================================

Using Xcopy location: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates

================================== XcopyForProduct =================================

Copied mpasdlta.vdm

Copied mpavdlta.vdm

Copied gapaengine.dll

Copied nisbase.vdm

Copied nisfull.vdm

================================== ServiceStart ==================================

ERROR 0x80070005 : OpenServiceW

ERROR 0x80070005 : XcopyDeployment

ERROR 0x80070005 : IProduct->UpdateEngine

================================= ValidateUpdate =================================

mpasdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

mpavdlta.vdm version in package is 1.175.2352.0, but after update machine has older version 1.175.417.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: AM Delta P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x800106ba : MpConfigSetValue(DeltaUpdateFailure)

================================= ValidateUpdate =================================

nisfull.vdm version in package is 111.25.0.0, but after update machine has older version 111.19.0.0

Watson Report: Position:

HRESULT: 0x80070005 P1

FailedFunction: MpUpdateEngine P2

Operation: NIS Full P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: 4.5.218.0 P6

ProductName: Windows Defender P7

ERROR 0x80070005 : One or more of the packages found failed to update for Windows Defender.

ERROR 0x80070005 : One or more of the products found failed to update; returning this error

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\111.0.0.0_TO_111.25.0.0_NISFULL.VDM_SOURCE_NISBASE.VDM._P

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPASDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\MPAVDLTA.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\NISBASE.VDM

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\nisfull.vdm

Deleted C:\Windows\Temp\532E177AAE7D2F54FB0E3D5965B66E07-Sigs\GAPAENGINE.DLL

ERROR 0x80070005 : MpSigStubMain

End time: 6/15/2014 5:40 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\59630698aa14776ecf0f\mpasbase.vdm (1.175.0.0)

g:\59630698aa14776ecf0f\mpasdlta.vdm (1.175.2365.0)

g:\59630698aa14776ecf0f\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\59630698aa14776ecf0f\mpasbase.vdm

Deleted g:\59630698aa14776ecf0f\mpasdlta.vdm

Deleted g:\59630698aa14776ecf0f\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:44 PM

Command: MpSigStub.exe /program "C:\Users\matt\Downloads\mpas-feX64.exe"

Start time: 6/15/2014 5:44 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm (1.175.0.0)

g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm (1.175.2365.0)

g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasbase.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpasdlta.vdm

Deleted g:\475cf70691f8cad655a4e80355955bd3\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:45 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:54 PM (version 11.1.4590.0)

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm (1.175.0.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm (1.175.2365.0)

g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasbase.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpasdlta.vdm

Deleted g:\4ce5e2e04bedb5f9f42e6449d1\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:54 PM

Command: MpSigStub.exe /program mpas-feX64.exe

Start time: 6/15/2014 5:55 PM (version 11.1.4590.0)

================================= CacheMpSigStub =================================

Copied MpSigStub.exe to C:\Windows\system32\MpSigStub.exe

=================================== ProductSearch ==================================

Windows Defender:

Status: Active

Product: 4.5.218.0

Engine: 1.1.10600.0

Signatures: 1.175.417.0

NIS Engine: 2.1.10502.0

NIS Signatures: 111.19.0.0

================================ PackageDiscovery ================================

Package files discovered:

g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm (1.175.0.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm (1.175.2365.0)

g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll (1.1.10600.0)

AS FE:

Engine: 1.1.10600.0

AS base VDM: 1.175.0.0

AV base VDM: Not included

AS delta VDM: 1.175.2365.0

AV delta VDM: Not included

=============================== PackagesNotApplicable ==============================

No products found to update.

ERROR 0x80070490 : SearchForApplicableProducts

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasbase.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpasdlta.vdm

Deleted g:\4b9a1d7f8d9a34ddc32118c9\mpengine.dll

Watson Report: Position:

HRESULT: 0x80070490 P1

FailedFunction: PackagesNotApplicable P2

Operation: (null) P3

SourceComponentVersion: 11.1.4590.0 P4

SourceComponentName: mpsigstub.exe P5

ProductVersion: (null) P6

ProductName: (null) P7

ERROR 0x80070490 : MpSigStubMain

End time: 6/15/2014 5:55 PM

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Yes, you can try deleting that file, it'll rebuild, but rename instead of deleting. And you can try changing registry value to MpScanCache-0.bin, instead of MpScanCache-1.bin. Registry Editor will not be able to change the value (permission problems), so you have to open Registry Editor with the method I discussed in answer to this thread:

http://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start/cant-turn-the-security-on-win-81-x64/95ea798e-6993-45ad-9a75-2ce1ac2e68b3

One more question:

What is the value of SFCState key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan?

Prashant Kumar

0 comments

50 additional answers

Anonymous

2014-07-03T03:00:29+00:00

I don't know that Microsoft's recommendation is #6, but I certainly think it is your best option. It may be painful and time consuming, but I suspect that continuing down the troubleshooting path will be more of both in the long run.

Alternatively, if everything else appears to be working and you are confident that no infection is present, forget about Defender and install a 3rd party antivirus product of your choosing which will normally disable/replace Defender on Windows 8.x.

-steve
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-03T01:27:51+00:00
Thanks for your help. Let me summarize:
1. Windows defender has stopped on my win8.1/x64 system. Defender updates will not install, nor will it restart. My system is current with all the required KB's per the extensive checklist you provided, except for the defender definitions update which will not install
2. None the various start/stop/reset windows update/... things make no difference
3. Downloading the defender definition's updates and running them by hand, has no effect; this seems to rely on the windows defender service running, but it won't run
4 Offline windows defender scan shows no problem.
1. Attempts to 'refresh/restore' fail - nothing useful in the error message.
2. At this point, I believe Microsoft's recommendation is, 'reinstall from scratch.'
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-02T22:23:01+00:00

I have nothing further to add to this very confusing discussion.
Was this answer helpful?

0 comments No comments
Anonymous

2014-07-02T21:43:26+00:00

Yes, several times, no difference. The problem's with defender - my guess is some part of it has gotten out of sync with some other part. The service simply won't start, I believe the definitions are a 'red herring' and the problem's more fundamental. It's also kind of concerning that I can't 'refresh' this computer; that simply just fails, no useful message, nothing.

Does it matter than I have a second partition active? C: and G: both are disk space. I added this partition some time after I installed 8.1.
Was this answer helpful?

0 comments No comments