Windows Update trying to install Defender updates despite using MSE

[Spacedust]

Each day I got two definition updates. One for Windows Defender and the other one for Microsoft Security Essentials.

The one for Security Essentials installs without any problems, the one for Defender fails with error 8007007E.

 

[NoelDP]

It sounds as if Defender isn't properly switched off.

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[Spacedust]

Here you are:

Farbar Service Scanner Version: 21-07-2014
Ran by Marek (administrator) on 22-08-2014 at 15:02:21
Running from "C:\Users\Marek\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Attempt to access Local Host IP returned error: Localhost is blocked: Destination is unreachable
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend: "%ProgramFiles(x86)%\Windows Defender\mpsvc.dll".


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[NoelDP]

Interesting - there are a couple of odd settings:

Connection Status:
==============
Attempt to access Local Host IP returned error: Localhost is blocked: Destination is unreachable
....
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend: "%ProgramFiles(x86)%\Windows Defender\mpsvc.dll".

The first may be because of a third-party firewall, or may be because of malware, or a HOSTS file setting.

The Defender status is definitely wrong...
The service should be set to manual - and the servicedll should be reset to its proper location.
I suspect that there are other errors also present in the relevant registry Key.

Please open an Elevated Command Prompt, and run the following command

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\WinDefend /S

post the results.

Please also confirm that this is the system in your 'My System Specs' area, so I get the right values!


Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[Spacedust]

Yes this is my system. I do not use any other firewall despite Windows firewall.

/etc/hosts shows just:

127.0.0.1 localhost

Here you go:

C:\Users\Marek>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\WinDefend /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
DisplayName REG_SZ Windows Defender
ErrorControl REG_DWORD 0x1
ImagePath REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k secsvcs
Start REG_DWORD 0x3
Type REG_DWORD 0x20
Description REG_SZ @%ProgramFiles%\Windows Defender\MsMpRes.dll,-1176
DependOnService REG_MULTI_SZ RpcSs
ObjectName REG_SZ LocalSystem
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeImpersonatePrivilege\0SeBackupPrivil
ege\0SeRestorePrivilege\0SeDebugPrivilege\0SeChangeNotifyPrivilege\0SeSecurityPr
ivilege\0SeShutdownPrivilege\0SeIncreaseQuotaPrivilege\0SeAssignPrimaryTokenPriv
ilege
DelayedAutoStart REG_DWORD 0x0
FailureActions REG_NONE 8051010000000000000000000300000014000000010000
0060EA00000100000060EA00000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Parameters
ServiceDllUnloadOnStop REG_DWORD 0x1
ServiceDll REG_EXPAND_SZ %ProgramFiles(x86)%\Windows Defender\mpsvc.dl
l

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Security
Security REG_BINARY 01001480DC000000E8000000140000003000000002001C0001
00000002801400FF010F000101000000000001000000000200AC000600000000002800FF010F0001
0600000000000550000000B589FB381984C2CB5C6C236D5700776EC0026487000B28000000001001
0600000000000550000000B589FB381984C2CB5C6C236D5700776EC002648700001400FD01020001
010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
010200010100000000000504000000000014009D0102000101000000000005060000000101000000
00000512000000010100000000000512000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\TriggerInfo

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\TriggerInfo\0
Type REG_DWORD 0x5
Action REG_DWORD 0x1
GUID REG_BINARY E6CA9F65DB5BA94DB1FFCA2A178D46E0

 

[NoelDP]

There are some very strange entries there.
I think it would be best to delete the entire entry and rebuild it.

Please open an Elevated Command Prompt, and run the following command

REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend /f

Note any error message - post back with details if you get one.


Close the window.



I've uploaded a file - windefendx64.zip - to my OneDrive at Noel's OneDrive
Please download and save it to your desktop.
Right-click on the saved file and select Extract all...
Save it to the default location
This should create a file windefenx64.reg

right-click on the file, and select Merge
Accept the warnings, - you should then get a 'Success' message.
Close all windows, and reboot.

Then run FarBar again, and post the new log.

 

[Spacedust]

C:\Users\Marek>REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W
inDefend /f
Operacja ukończona pomyślnie.

Added registry keys. Here's new log:

Farbar Service Scanner Version: 21-07-2014
Ran by Marek (administrator) on 23-08-2014 at 13:29:03
Running from "C:\Users\Marek\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Attempt to access Local Host IP returned error: Localhost is blocked: Destination is unreachable
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv: "C:\windows\system32\wuaueng.dll".


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

[Spacedust]

I've removed MSE because I wasn't able to upgrade version 4.4 to 4.5 and now installation fails with error 0x80070643

 

[NoelDP]

I think you have malware - or perhaps a problem with RAM!
services which reported OK the first time are now showing problems.
The 643 error isn't a good one - and is often associated with registry problems.

Please test your RAM following this tutorial, and we'll see if the RAM is OK - if it is, then we'll check again for malware.

 

[Spacedust]

My RAM is ok, I've tested it a few times with memtest. I use only top class ECC memory and never had any bluescreens.

I was trying to do a repair install but it doesn't work too: http://www.sevenforums.com/installa...ll-freezing-starting-windows.html#post2863119

 

[Layback Bear]

Noel I have a thought.
Could this be messing up Windows 7.

From system specs.

Motherboard Apple - Foxconn

 

[Spacedust]

It was working perfectly in the past.

 

[NoelDP]

I'm not a great lover of Foxconn boards - they used to be as bad as ECS - but Apple's build quality requirements are very high, so I don't think that's the problem here.

 

[Spacedust]

It works fine on my in-place upgraded Windows 7 under VirtualBox. Now please help me fix this backup issue

 

[Spacedust]

Solution is to download MSE 1.0 then uninstall it, then install 4.5

 

[NoelDP]

?? You lost me there! <beg> Expand on that, please </beg>

 

[Spacedust]

Just install old version of Microsoft Security Essentials 1.0 like this one: Microsoft Security Essentials for Vista and 7 (64 Bit) - Pobierz - PL - Download.CHIP.eu

then remove it and installation of 4.5 will be smooth

 

[NoelDP]

I'm running the (perpetual) Beta of MSE - which is only up to
Antimalware Client Version: 4.6.302.0 ... Ah - they snuck an update or two on me while I wasn't looking!

v1.x hasn't been available for years, AFAIK?

 

[Spacedust]

Now I got the latest one:

Wersja klienta chroniącego przed złośliwym kodem: 4.5.216.0
Wersja aparatu: 1.1.10904.0
Definicje antywirusowe: 1.183.695.0
Definicje ochrony przed oprogramowaniem szpiegującym: 1.183.695.0
Wersja mechanizmu systemu inspekcji sieci: 2.1.10903.0
Wersja definicji systemu inspekcji sieci: 112.1.0.0