Windows Defender not updating through Windows Updates

DR.M

Malware Specialist
Joined
Sep 4, 2019
Messages
2,354
I just saw this.

I hope your issue got resolved, Karen, otherwise, there are some other things to try.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
Thanks. I thought you were avoiding me. :D Yeah, it's ironic but I may have to take a trip to you know where. 😉

I used FSS and I've downloaded SFCFix but haven't run it yet. I'm waiting to see what happens tomorrow.
 

DR.M

Malware Specialist
Joined
Sep 4, 2019
Messages
2,354
Thanks. I thought you were avoiding me. :D
Not my style at all! :D

You can use FSS now again, now you think the problem is solved, to confirm there is nothing wrong with the related services. Copy/paste it for me to check.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
So it didn't work. :(

Farbar Service Scanner Version: 23-12-2020
Ran by Cookie (administrator) on 27-10-2021 at 09:34:17
Running from "C:\Users\Cookie\Desktop"
Microsoft Windows 8.1 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv: "C:\WINDOWS\system32\wuaueng.dll".


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcsvc.dll => File is digitally signed
C:\Windows\System32\Drivers\afd.sys => File is digitally signed
C:\Windows\System32\Drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll
[2016-02-27 09:46] - [2016-01-06 12:47] - 0146944 ____A (Microsoft Corporation) 501D5EFAB9711039479AE48401386D2B

C:\Windows\System32\wbem\WMIsvc.dll
[2020-08-12 08:27] - [2020-07-10 13:58] - 0231936 ____A (Microsoft Corporation) 80644B29E2B93A2967E72A3E0E948EA3

C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
 

DR.M

Malware Specialist
Joined
Sep 4, 2019
Messages
2,354
Karen, there are some weird things in the log.

Boot in Safe mode, and then please do the following:

1. Restore services

2. Run FSS again
  • Restart in normal mode.
  • Right click on the tool icon and run it as administrator, as you did before.
  • Make sure all the options are checked.
  • Click on the Scan button.
  • It will create a log (FSS.txt) on your Desktop.
  • Copy and paste the log's content to your next reply.
 
Last edited:

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
I'm pretty sure there are things in the first regfix that are specific to Windows 10 and I'm running Windows 8.1.

Can you tell me what in the FSS log you find to be weird please?
 

DR.M

Malware Specialist
Joined
Sep 4, 2019
Messages
2,354
Karen,

Thanks for that. I missed it.

I edited the post above, taking the links for the Windows 8.1.

These are weird:

The ServiceDll of wuauserv: "C:\WINDOWS\system32\wuaueng.dll".

[2016-02-27 09:46] - [2016-01-06 12:47] - 0146944 ____A (Microsoft Corporation) 501D5EFAB9711039479AE48401386D2B

C:\Windows\System32\wbem\WMIsvc.dll
[2020-08-12 08:27] - [2020-07-10 13:58] - 0231936 ____A (Microsoft Corporation) 80644B29E2B93A2967E72A3E0E948EA3

The dll for the wuauserv is not correct and the other two seem as they lost their digital signature.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
Thanks. I'm actually not feeling very well so I may not get to this right away.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
So I decided to give it a go. I only did the first regfix because the other two and mine were already identical. There was a discrepancy in the first fix regarding "The ServiceDll of wuauserv: "C:\WINDOWS\system32\wuaueng.dll" and that's been fixed now. But the other two issues remain. I don't know what the deal is with those.

New FSS log:

Farbar Service Scanner Version: 23-12-2020
Ran by Cookie (administrator) on 27-10-2021 at 18:02:06
Running from "C:\Users\Cookie\Desktop"
Microsoft Windows 8.1 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcsvc.dll => File is digitally signed
C:\Windows\System32\Drivers\afd.sys => File is digitally signed
C:\Windows\System32\Drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll
[2016-02-27 09:46] - [2016-01-06 12:47] - 0146944 ____A (Microsoft Corporation) 501D5EFAB9711039479AE48401386D2B

C:\Windows\System32\wbem\WMIsvc.dll
[2020-08-12 08:27] - [2020-07-10 13:58] - 0231936 ____A (Microsoft Corporation) 80644B29E2B93A2967E72A3E0E948EA3

C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
These two are not signed but the numbers shown are the MD5s:

[2016-02-27 09:46] - [2016-01-06 12:47] - 0146944 ____A (Microsoft Corporation) 501D5EFAB9711039479AE48401386D2B

C:\Windows\System32\wbem\WMIsvc.dll
[2020-08-12 08:27] - [2020-07-10 13:58] - 0231936 ____A (Microsoft Corporation) 80644B29E2B93A2967E72A3E0E948EA3
 

DR.M

Malware Specialist
Joined
Sep 4, 2019
Messages
2,354
Hi, Karen. I hope you are feeling better today.

The issue with Windows Update Service is fixed, but the service is not running. Go to Services, find Windows Update Service, double click and choose Start to start it.

I only did the first regfix because the other two and mine were already identical. I don't know what the deal is with those.
The other two reg files I asked you to run are supposed to fix these issues, restoring the related services.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
but the service is not running. Go to Services, find Windows Update Service, double click and choose Start to start it.
That is only because I don't have it set to install updates automatically but rather to downloand them and then let me decide to install them. If I change that setting to update automatically the service starts and this is what the FSS scan log looks like:

Farbar Service Scanner Version: 23-12-2020
Ran by Cookie (administrator) on 28-10-2021 at 09:12:42
Running from "C:\Users\Cookie\Desktop"
Microsoft Windows 8.1 Pro (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcsvc.dll => File is digitally signed
C:\Windows\System32\Drivers\afd.sys => File is digitally signed
C:\Windows\System32\Drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\wscsvc.dll
[2016-02-27 09:46] - [2016-01-06 12:47] - 0146944 ____A (Microsoft Corporation) 501D5EFAB9711039479AE48401386D2B

C:\Windows\System32\wbem\WMIsvc.dll
[2020-08-12 08:27] - [2020-07-10 13:58] - 0231936 ____A (Microsoft Corporation) 80644B29E2B93A2967E72A3E0E948EA3

C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

So the issue is still those two files and I haven't been able to figure that out yet. I won't do anything without suggesting it to you here first but I am researching to see if I can find the reason for the discrepancy on those two files.
 

Cookiegal

Karen
Thread Starter
Administrator
Malware Specialist Coordinator
Joined
Aug 27, 2003
Messages
121,909
I forgot to add that Windows update detected an update for Windows Defender automatically this morning like it should so hopefully that's been fixed. However, that happened before for a couple of days and then it stopped again so I'll post back if that occurs again.

But I'd still like help with those two files. BTW, I uploaded them both to Virus Total and they were clean. :)
 

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top