This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 23%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
I have been having an issue where when I try to run a quick scan, full scan the scan crashes disabling Microsoft Security features until it restarts the services. I have tried clearing and reloading definition files through Admin command prompt (
MpCmdRun.exe -removedefinitions -all
). I have restarted multiple times including when I performed a reinstall of Windows through System recovery > Fix problems using Windows updates > Reinstall now. Offline scans stall and never complete. Oddly I can run a full scan and select the C drive and it completes.
The errors I see in the4 event viewer are:
In Windows Application logs:
Faulting application name: MsMpEng.exe, version: 4.18.26070.9, time stamp: 0x9a78fc05
Faulting module name: mpengine.dll, version: 1.1.26070.7, time stamp: 0xa09e75a9
Exception code: 0xc0000005
Fault offset: 0x000000000092e48b
Faulting process id: 0x28D4
Faulting application start time: 0x1DD2F635659EBEB
Faulting application path: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MsMpEng.exe
Faulting module path: C:\ProgramData\Microsoft\Windows Defender\Definition Updates{579D2639-ABAF-4D65-BC1A-213EC738E17D}\mpengine.dll
Report Id: 80eecc34-fd5e-4217-a1de-dd7a5309c4da
Faulting package full name:
Faulting package-relative application ID:
In Defender Operations Logs:
Microsoft Defender Antivirus engine has been terminated due to an unexpected error.
Failure Type: Unexpected Crash
Exception code: 0xc0000005
Resource: mpengine.dll
Engine Code: 9626763
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: Network Inspection System
Error Code: 0x80070006
Error description: The handle is invalid.
Reason: The filter driver was unloaded unexpectedly.
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: Behavior Monitoring
Error Code: 0x80070006
Error description: The handle is invalid.
Reason: The filter driver was unloaded unexpectedly.
Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed.
Feature: On Access
Error Code: 0x80070006
Error description: The handle is invalid.
Reason: The filter driver was unloaded unexpectedly.
Any suggestions?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 18%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJD%3C/text%3E%3C/svg%3E)
Hi, good day!
From what I’ve observed here in the forum and across the internet, several users are experiencing the same issue. This could indicate that it may be a bug with Microsoft Defender rather than an isolated problem.
I recommend reporting the issue through the Feedback Hub app so Microsoft is aware of it and can investigate further. Hopefully, with enough reports from affected users, Microsoft can identify the cause and release a fix as soon as possible.
