The windows security has been continuously filling my disk,and the real time protection can't open.

Question

The windows security has been continuously filling my disk,and the real time protection can't open.

国伟保 0

C:\programdata\microsoft\windows defender\definition updates, Windows Security is keeping filling {xxx<hex>} folders, all of them are similarly 213MB and containing similar files. Yet my Cdrive has been filled out by 180GB stuff. I deleted them by PE but they are still coming.
Windows Security noticed me that Threat Services has stopped and has to restart, but it always failed. I tried to repair it in cmd 'sfc /scannnow', which shows it successfully repair the Windows Security, but actually nothing changed. I'm attacked?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Abhishek U 85

Hello @国伟保

You’re most likely not “attacked” — this is a known Microsoft Defender malfunction where definition update folders keep duplicating in C:\ProgramData\Microsoft\Windows Defender\Definition Updates, consuming huge disk space, while the Threat Service fails to start. It’s usually caused by broken update loops or corrupted Defender platform files, not active malware.

There is two ways that you can try one is to manually update the Windows defender or To run commands which will help to update The defender and the services related to it.

It Would be helpful if you share the Event ID
Open Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational. You can Find it here.

国伟保 0 Reputation points

2026-09-11T09:08:45.0066667+00:00

Event ID 5007. It keep happening almost every half minutes...How can i manually update it since the protection can't open so it won't show other options but restart...
Abhishek U 85 Reputation points

2026-09-11T09:13:24.15+00:00
Event ID 5007 repeating every 30 seconds means Defender’s configuration is being constantly altered — either by a broken update loop or by malware trying to disable it. The configuration of Microsoft Defender Antivirus changed.

Ensure the Threat Service (WinDefend) is set to Automatic and running.

Open PowerShell (Admin)

Run: Get-Service WinDefend

If status is Stopped, run: Set-Service -Name WinDefend -StartupType Automatic

Then: Start-Service -Name WinDefen

Clear Corrupted Definitions

Remove all existing definition files to stop the repeated Event 5007 changes.

Run MpCmdRun tool

Run: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

This wipes all cached signatures

Force Fresh Signature Update

Most Common Fix

Download a clean set of definitions directly from Microsoft.

Run MpCmdRun tool

Run: "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate -MMPC

Wait until update completes successfully

Repair Platform Files

Remove old Defender platform versions that may be looping updates.

Navigate to C:\ProgramData\Microsoft\Windows Defender\Platform

Delete all folders except the newest one

Re‑run signature update command

Run Offline Scan

Check if malware is forcing the configuration changes.

Run PowerShell (Admin)

Run: Start-MpWDOScan

System will reboot and perform an offline scan outside Windows

Please ensure that your Data is backed up before you do any changes.
Abhishek U 85 Reputation points

2026-09-11T09:15:00.0133333+00:00

Also you can run this command in Command prompt as Admin.

net stop WinDefend && "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All && rmdir /s /q "C:\ProgramData\Microsoft\Windows Defender\Platform" && "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate -MMPC && net start WinDefend
国伟保 0 Reputation points

2026-09-11T09:27:41.4666667+00:00
1.In PowerShell, i got the status which is stopped, but that 'set-service' command failed with error: '+ CategoryInfo : PermissionDenied: (System.ServiceProcess.ServiceController:ServiceController) [Set-Servi

ce], ServiceCommandException

+ FullyQualifiedErrorId : CouldNotSetService,Microsoft.PowerShell.Commands.SetServiceCommand'

2.I successfully start service which shows while get again.

3.when i run the MpCmdRun tool in cmd(admin), it shows both service version and engine version 0.0.0.0 and No engine/signature is currently loaded.

4.Signature update, both versions are 0.0.0.0 and error: Signature Update failed with hr=0x800106ba

CmdTool: Failed with hr = 0x800106ba. Check C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log for more information

5.C:\ProgramData\Microsoft\Windows Defender\Platform, there is only one folders last changed int 15th, July.

6.run offline scan, it errored: + Start-MpWDOScan

+ CategoryInfo : NotSpecified: (MSFT_MpWDOScan:ROOT\Microsoft\...\MSFT_MpWDOScan) [Start-MpWDOScan], CimE xception + FullyQualifiedErrorId : HRESULT 0x800106ba,Start-MpWDOScan
Abhishek U 85 Reputation points

2026-09-11T09:36:34.7066667+00:00
The errors you’re hitting (engine version 0.0.0.0, hr=0x800106ba, offline scan failing) confirm that Defender’s platform binaries themselves are missing or corrupted — not just the signatures.

At this point, no single MpCmdRun command can fix it because there’s nothing for it to update against.

The only way forward is to reinstall the Defender platform package manually.

https://www.microsoft.com/en-us/wdsi/defenderupdates?utm_source=copilot.com

Choose the correct package for your Windows version (x64 for most modern PCs).

Save the .exe or .msi.

Run the downloaded installer as Administrator. This reinstalls the missing engine and platform files under C:\ProgramData\Microsoft\Windows Defender\Platform.

Run a forced signature update (single command in Admin CMD): cmd
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate -MMPC

Verify Defender status (Admin PowerShell): powershell
Get-MpComputerStatus | Select AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntispywareEnabled
All should return True.
国伟保 0 Reputation points

2026-09-11T09:42:34.8866667+00:00

I run the installer as Administrator and run the command, but it seems nothing changed.....Thanks a lot for your help, I decide to reset or reinstall the system to solve it.