Windows Defender: Microsoft screws up update, disables virus scanners

Microsoft actually wanted to close a security gap, but a current update now apparently partially paralyzes Windows Defender. Users around the world are reporting virus scans crashing and services being terminated.

Patch cripples Defender

Microsoft has just updated its Windows ISOs with new Defender packages. Now, however, the company has apparently made the scanning function of the in-house Defender unusable under Windows with another and, above all, faulty update. The company actually wanted to close a critical vulnerability. Instead, the update causes the virus scanner to stop working unexpectedly. Both home users and companies that rely on the operating system’s integrated protection are affected. The symptoms are identical on most computers. If users start a quick scan, the process stops at 75 to 80 percent. At the same time, the threat protection running in the background stops completely. Under Windows 11, the system often restarts the service automatically. However, older versions sometimes require manual intervention. The more in-depth offline scan also stops unexpectedly.

Affected versions

Like first Günter Born reported on his blog, there are now several reports about the problem. Users sometimes spent hours searching for errors. They often incorrectly suspect an active virus infection. However, the origin of the error is probably Microsoft’s attempt to patch a zero-day vulnerability known as ShieldBreak, which the controversial security researcher NightmareEclipse had previously published. In an attempt to fix the problem, the developers apparently damaged a core component of the scanner. The error code 0x000005 is increasingly appearing in the Windows event viewer, like users on Reddit report. It points directly to the file mpengine.dll. The module is the heart of the Defender. Systems with Defender versions v1.1.26070.7 and v1.1.26080.2 in combination with the following signature updates from the past few days are primarily affected:

Transitional solutions for users

There is currently no official statement or hotfix from the Redmond developers. The well-known standard system file repair tools cannot fix the error. If you still want to check your system for malware, you can use a custom scan of individual folders. Manual scanning of selected directories continues to work without any errors. Another option is to restore the operating system to a state before the update using a system restore point. This temporarily fixes the error, but has the disadvantage that the original zero-day vulnerability is open again on the PC. Users now have to wait until Microsoft distributes a corrected signature update via the update function that repairs the scanner. Of course, third-party software can also be used to scan the system.