Windows Defender 0x80090006 Error Message

[Guest]

I maintain a network for around 50 users and a good deal of the workstations
are now getting the "Application failed to initialize: 0x80090006 Invalid
Signature" error message upon startup.

We run the most current version of Windows Defender.

Has anyone got a sure fire way of fixing this, as I cannot find a solution
on the web.

AB.

 

[Dave M]

I wouldn't say "sure fire", but you might look about here, particularly at
hit #2:
http://search.microsoft.com/results.aspx?mkt=en-US&setlang=en-US&q=0x80090006

 

[Bill Sanderson MVP]

Hmm - I wonder what the common cause might be?

As for a fix--have you tried:

mpcmdrun /removedefinitions /all
mpcmdrun /signatureupdate

(mpcmdrun.exe resides wherever Windows Defender was installed)

How is your antivirus protection? Have you checked one of these
workstations for rootkits, using, for example, Blacklight, from F-secure?

 

[Guest]

Dave, I thought you'd found Atlantis there, but the workaround specific to
0x80090006 uses either Symantec Ghost, or Image Drive Pro - I have knowledge
of neither.

Damn.

Though, the cuse of the error indicated "because the drive letter had
changed"...

Al.

 

[Guest]

Hi Bill,

I have just finished trying Blacklight and my workstation, at least, is
clean. I will run it on a few more.

Regarding the mpcmdrun /signatureupdate what would this command actually do
to any system?

Al.
--------------------------------------

 

[Dave M]

....aah, twas one of my wilder guesses... sorry

 

[Bill Sanderson MVP]

That initiates an update via bits. Alternatively, you could just go to
WindowsUpdate and do an express scan.

The first--removing all the exisiting defs, is the more significant
step--there used to be situations in which a set of defs were in some way
corrupted, or incompletely installed, perhaps--and wiping them out and
getting new defs was the standard fix. Haven't seen that issue for a while
though.

I'm not sure what would cause this symptom, which is why I mentioned the
rootkit /virus scans--the current storm worm emails have sometimes contained
rootkit code and been ahead of typical antivirus defs--I found one such
infected machine on a network I admin.

That infection had rather obvious symptoms--it disabled the Windows
firewall, as well as the antivirus in place, but it was pretty well hidden.

--