Help, my windows defender keeps updating

[Guest]

To Whom it May Concern:
My Windows Defender keeps updating like it is stuck in some kind of update
feedback loop. It has updated 12 time in the last half hour with the same
update. It is getting extremely annoying.

 

[plun]

Hi

Try this:

Perform a manual Windows update and see how it works:

http://update.microsoft.com

It not remove definitions withhelp from this kb and try to
update again.

http://support.microsoft.com/?kbid=915105

 

[Guest]

Yes Yes Yes, infinite loop. Using the remove sig and manual update did the
trick. Until then stuck with 13.1276.3 (read three which is smaller than
sixteen ;>] )
--
The Dutch Italian

Coelum Non Animum Mutant Qui Trans Mare Currunt

 

[Guest]

The kb fix worked for me! Cheers.

Hi

Try this:

Perform a manual Windows update and see how it works:

http://update.microsoft.com

It not remove definitions withhelp from this kb and try to
update again.

http://support.microsoft.com/?kbid=915105

 

[Bill Sanderson]

Thanks, Plun--that KB article is sure getting a workout.

--

 

[Bill Sanderson]

Frank, Please follow plun's advice, and use the steps in this KB article to
resolve this:


http://support.microsoft.com/?kbid=915105

--

 

[plun]

Hi Bill

Yes, with a manual Windowsupdate the connection first is checked
, next step then is the kb.

If Windowsupdate not is possible they probably are behind a corporate
network

It is also rumours about a new WD version ......

Watching IRC for Vista just now...

regrads
plun

 

[Will Rolison [495512]]

Help > About > Check For Updates

Only way it worked for me.

 

[Bill Sanderson]

Interesting--that would be either autoudate directly to Microsoft's servers,
or WSUS, if you are on a corporate network.

 

[Guest]

In my case,
a) manual update from within Windows defender: stated updated successfully,
but sig version in About WD still showed 1.13.1276.3. Also a failed update
event log.

b) So tried MU: offered the update, after download stated install
successful, but still showed 1.13.1276.3 and a failed update event log
c) tried MU again, offered update again, stated installed successful again,
but still 1.13.1276.3 and a failed update event log
d) did the KB 915015 fix (had to shut down WD for this to work)
e) tried manual update and this time 1.13.1276.16 was installed. Succesful
update event log.

What concerns me (apart from the annoyance of having to apply the fix yet
again) is that both manual update and MU reported successful update whereas
in fact the defininitions had not been updated. Not all users would bother to
check in About WD window or in event log after receiving the message that the
update was succesful.

 

[Bill Sanderson]

One user has reported that the version number as shown in the main
msascui.exe window did not change until he exited and re-entered msascui.

I'm wondering about the relationship, in terms of updating, among the three
parties:

msmpcmd.exe which requests and apparently monitors to completion (?--at
least it takes a good long time?) the update via autoupdate,
msmpeng.exe--the Windows Defender service, which provides real-time
protection, and presumably actually makes use of the updates, and
msascui.exe, which perhaps just reports the state of things.

So far the updates have been invisible for me in most cases--I just open the
app and the update is listed as there already.

I agree that your cases with success messages coupled with event log failure
messages look like significant bugs.

 

[Bill Sanderson]

I've looked at maybe half a dozen machines this afternoon, and found one
windows 2000 server at .3 still.

I did:

\program files\windows defender\msiexec -x as_sigs.msi

I then went to Microsoft Update and was not offered signature updates
I then went into msascui.exe and asked it to check for updates. Rather
quickly, it stated that the app was up to date, and when I closed and
reopened the UI, it read .16

So--is that result real? As far as I can tell with the new app, what it
reads at the bottom of the home window is trustworthy--will look at log
records later.

--

 

[Guest]

The KB fix doesn't work for me. I'm still stuck on 3. This morning there
was a new update that kept trying to install, kept telling me that it had
installed successfully, but never did install. After half a dozen tries I
cancelled the notice that kept popping out of my systray. I'm running a
standalone computer, ZoneAlarm but no router. If this doesn't clear up soon,
I'm going to go back to Microsoft Antispyware so that my system has some
protection.

 

[Bill Sanderson]

The essential part of the KB fix is the removal of the old signature files.

It's possible to use the Windows Installer Cleanup tool to do roughly the
same thing--perhaps that would be worth trying?

http://support.microsoft.com/default.aspx?scid=kb;en-us;290301

You should find the signature update listed by the tool, once you download,
install, and run it.

Once removed, try both Help, About, check for updates (first)--then
WindowsUpdate, if necessary. Current sig ends in .6 and revs the engine
build as well.

--

 

[Guest]

The cleanup tool allegedly removed the old signature file -- it's not listed
by the cleanup tool any more -- but 1.13.1276.3 is still listed in Defender,
and both Check for Updates and Microsoft Update find no new signature files
or engines. So I can't install a new signature file and don't even know for
sure whether the old signature file is still installed. The engine version
listed in Defender is 1.1.1185.0, which I assume is also out of date. <sigh>

 

[Bill Sanderson]

There's a single update that does both pieces--so there's only one to look
for.

I'll see whether I can thing of anything, but I'm stumped for the moment.

--

 

[Bill Sanderson]

What happens if you execute the as_sigs.msi file that exists in the \program
files\windows defender folder?

--

 

[Guest]

I get a small installation window for about a second and a half. The little
green squares shoot across it, and then it's gone. Nothing else happens.

 

[Bill Sanderson]

No change to the version displayed in the home page of Windows Defender, nor
any update offered via help, about, check for updates, or Windows Update?

And am I still recalling that Windows Update appears fully functional?

--

 

[Guest]

I use Microsoft Update rather than Windows Update. Otherwise, you've got
everything correct. There are no updates for me anywhere, I don't know for
sure whether the old signature file has been removed, the KB fix doesn't
work, as_sigs.msi doesn't work, the cleanup tool apparently doesn't work,
Microsoft Update works fine except where Defender is concerned. Defender
itself works fine, except for the problem of not being able to update it.
Defender has a MAJOR bug in its update process.