Issues with Windows Defender

[XFool]

Yesterday, following the usual signal from my Win 8.1 system, I tried to update my Windows Defender definitions file, The update failed shortly after starting, with a notice from Defender that my Definitions file was "Out of date" and "needed updating". Requesting further updates within Defender simply repeated this failure and message. I carried out a quick scan (and late a full scan) and in both cases just after the scan started got the worrying message:

! (Yellow warning triangle) "Preliminary scan results show that malicious or potentially unwanted software might exist on your system.
You can review detected items when the scan has completed."

Following the scan, nothing was shown in Defender.

Further attempts at updating failed and I looked into the matter. Microsoft has a means of manually updating Defender so I tried that, downloaded the program, ran it and Defender appeared succesfully updated.

However, when I run Defender, Quick or Full Scan, I still get the above worrying message. When the scan ends the pop up message from Defender is "No threats found" and when I check to see if anything has been found, there is nothing shown.

Googling the message does not throw up a definitive answer, IMO. Does anyone have any idea what is going on?

[Breelander]

Yesterday, following the usual signal from my Win 8.1 system, I tried to update my Windows Defender definitions file, The update failed shortly after starting, with a notice from Defender that my Definitions file was "Out of date" and "needed updating".

For the last month or so there has been an apparent issue when trying to run the definition update from within Defender (Win8.1) or MSE (Win7). It says there is a network problem....



...but on closing that error message you'll see that the definitions have in fact been updated successfully. Whatever the error is, it occurs after installing the definitions.

However, when I run Defender, Quick or Full Scan, I still get the above worrying message.

I too see the same preliminary results, but like you by the end of the scan there was nothing found. If you are still concerned about any possible infections, then you could try an offline Defender scan. For Windows 10/11 that's now a built in function. But for Windows 7/8.1 you need to make a bootable usb to do the offline scan. Details in this tutorial:

https://www.sevenforums.com/tutorials/1 ... fline.html

[XFool]

...Thanks Breelander (as usual!).

For the last month or so there has been an apparent issue when trying to run the definition update from within Defender (Win8.1) or MSE (Win7). It says there is a network problem....

Those error messages are not the same ones I have been getting. I did see an online reference to updating issues and MS saying "try again later".

[Breelander]

...Thanks Breelander (as usual!).

Those error messages are not the same ones I have been getting. I did see an online reference to updating issues and MS saying "try again later".

There are no issues in Win7 or Win8 when updating definitions through Windows Update. It's only if you open Defender and check from there that there's a (non)issue. It looks like after installing the latest definitions Defender makes a final check that it is up to date. It's this that fails.

I've just checked on my W8.1 machine and I too get that preliminary warning, but I soon get a notification that the scan completed and nothing was found. I think it's just MS being overcautious.

[Breelander]

This preliminary warning, but nothing found, seems to be a common issue. It's discussed in depth here.

https://www.askwoody.com/forums/topic/w ... st-2570150

[XFool]

Same thing again today, following usual MS "Update spyware" message.

Virus and spyware definitions couldn't be updated.
This application couldn't check for virus and spyware definition updates. Check your Internet or network connection and try again.

Error code: 0x80072f8f
Error description: The definition updates couldn't be installed.
Please try again later.

But... System Event Viewer. 02/08/2023 19:06:10

Installation Successful: Windows successfully installed the following update. Security Intelligence Update for Microsoft Defender
Antivirus - KB2267602 (Version 1.393.2089.0)

Along with several other messages, such as:

Log Name: System
Source: Schannel
Date: 02/08/2023 19:09:25
Event ID: 36887
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: xxxxxx
Description: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40.

[XFool]

Windows: Microsoft intends to disable TLS 1.0 and 1.1 soon by default in Schannel protocol

https://borncity.com/win/2023/08/02/windows-microsoft-intends-to-disable-tls-1-0-and-1-1-soon-by-default-in-schannel-protocol/

[XFool]

This is doing my head in...

It's still happening! Previously I ran SFC /scannow and Defender update worked OK afterwards. Solved? Seemingly not, as the latest update attempt gave exactly the same message as before.

I ran a Windows network diagnostic (error always seems to do with schannel and communications failure) one network error was corrected. Update still failed.

I just tried it again, same failure message. But checking Windows Update for updates installed I get:

Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.92.0)
Installation date: ‎10/‎08/‎2023 14:40
Installation status: Succeeded
Update type: Important

So who knows?

[Gerry557]

I've noticed the same issue on an old pc.

It's windows 8.1

I tried it a couple of times without success. Might take a longer look tomorrow or when it raining again

[XFool]

The error message, from Defender, seems to come up every time. But whether the update happens - using Defender - seems unpredictable. Must try to remember to try updating via Windows Update next time, as suggested by Breelander. If that is possible.

I'm wondering if this is a Microsoft end issue, which they are unlikely to bother fixing now for their Windows 8 servers.

[Urbandreamer]

The error message, from Defender, seems to come up every time. But whether the update happens - using Defender - seems unpredictable. Must try to remember to try updating via Windows Update next time, as suggested by Breelander. If that is possible.

I'm wondering if this is a Microsoft end issue, which they are unlikely to bother fixing now for their Windows 8 servers.

Well it wouldn't be as if they don't have a certain history would it?

Document I revealed that "FUD" (spreading fear, uncertainty, and doubt) was a traditional Microsoft marketing strategy, acknowledged and understood internally

https://en.wikipedia.org/wiki/Halloween_documents

MS settled out of court over one of these FUD events.
https://www.itprotoday.com/windows-78/m ... st-lawsuit

generated fake error messages while DR-DOS was running to make it look worse,

Of course you should update to Windows 11 to avoid the "risks" Defender is warning about.

[XFool]

New message today in Notification Area wrt updating Defender.

There is no means of updating Defender via Windows Update that I can see - it is not mentioned there.
Update... Failure as usual
Definitions last updated: 10/08/2023
Virus Definition version: 1.395.92.0

As previously, will try later today or in a few days time. But looks to me as if Defender (in Windows 8.1) is now borked, courtesy of Microsoft.

(Meanwhile, Plusnet email system has been completely borked these last two days. Sigh! Technology: Good, when it works...)

[XFool]

...Same as last time!

Repeated failures during the day then, just after 6pm local time (don't know if that is significant) - Updated

Definitions last updated: 17/08/2023 at 18:02
Virus Definitions: 1.395.674.0

Of course, still got the MS Defender Update failure pop-op, but the definitions version has updated and the Notification Area flag has been cancelled, as last time.

[jaizan]

When one free anti virus has problems, I move onto another one.

Windows Defender worked fine for years, but started slowing my PC down. I briefly returned to AVG, but the pop ups urging me to upgrade were too much, so I swiftly moved onto Avira.

[XFool]

I have established now that my Windows Defender Update still works, as long as it it only attempted a day or so after original notification. Trying on the same day as notification always leads to failure. Odd...

Priority being given to current versions of Windows? Earlier ones: "Join the queue"?

[XFool]

Quick update. MS Defender update is still working on my Win 8 PC. See following...

Though I was puzzled by this line for a recent Defender update:

'Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.226.0) - Current Channel (Staged)'

https://answers.microsoft.com/en-us/windows/forum/all/what-does-current-channel-staged-mean/e431e1cf-6415-4d2a-b4d7-710cd0521e12

What does Current Channel (staged) mean
"HI I would just like to ask a question. Recently I have noticed when windows update is installing a defention update for windows security their is a thing called current channel (staged) what I want to now is this part of the windows security defintions from now on."

"Hi,
I'm Rodrigo and I'll help you.
Current Channel (Staged) is a release channel where you get updates later during the gradual release cycle. Just before releasing it to the majority of devices."

Umm...

BTW. Today, I encountered my first ever virus on my Windows 8 PC hardware. I was given a USB stick by somebody in order to print out a simple Word document. Very sensibly, before looking in it, I thought of scanning the USB drive with MS Defender. WARNING! Virus "Sality.AM"

Apparently this class of virus is considered pretty serious. I successfully (cross fingers!) cleaned the USB with MS Defender before access and told the person who gave it me to let the person who gave it them that their PC is infected. Have just heard they have done so.

https://en.wikipedia.org/wiki/Sality

[XFool]

Nope! I still don't understand how Microsoft updates MS Defender...

I had a flagged up update required the other day, via the Windows Notification Area. I clicked on it and seemingly all went well. At least, that was what MS Defender update told me at the time. Out of interest I looked at MS Windows Update but could not see the Defender update listed. Oh well.

Today - with no Notification Area indication - I looked at MS Update. There was one important update waiting:

"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.1383.0) - Current Channel (Broad)
Download size: 1.5 MB
Update type: Important

Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed."

No idea what "Current Channel (Broad)" means. Presumably something different to "Current Channel (Staged)"

I went ahead and asked to install it, via MS Windows Update, it installed successfully and reported it in the MS Windows Update list of installed updates:

"Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.1383.0) - Current Channel (Broad)

Installation date: ‎29/‎11/‎2023 18:07

Installation status: Succeeded

Update type: Important

Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed."

With Microsoft, who knows?

[Breelander]

Nope! I still don't understand how Microsoft updates MS Defender...
.....No idea what "Current Channel (Broad)" means. Presumably something different to "Current Channel (Staged)".....

With Microsoft, who knows?

Defender intelligence definitions get updated as and when new threats are discovered, sometime this can be as often as three or four times a day. Windows Update only checks for updates once a day, so unless you check for updates yourself you should only get one new intelligence update a day. As I type this the current latest one is:
'Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.401.1412.0) - Current Channel (Broad)'

The Staged channel is released ahead of the Broad channel, and a (random) 10% of PCs may get offered one. If no issues are reported, the remaining 90% will get offered the same update through the Broad channel. I've yet to see any Staged releases on my PCs, all have been from the Broad channel so far. There are also Prerelease (Beta) and Preview channels for earlier testing of new definitions and the Defender antivirus platform, but no consumer PC should see any of those. The Broad channel is the one that's passed all the testing and is declared fit for general release.

Current Channel (Staged) - Get Current Channel updates later during gradual release - Devices will be offered updates later during the gradual release cycle. Suggested to apply to a small, representative part of your device population (~10%).
Current Channel (Broad) - Get updates at the end of gradual release - Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%).

https://learn.microsoft.com/en-us/micro ... -worldwide

[XFool]

Thanks Breelander.

But I am still far from sure I really understand what is going on with MS Defender updates!

I have just updated it via the Windows Notification Area flag. I then opened the Update tab in Defender to see that it was "Up to date" today at Ver. 1.403.43.0
I then looked at Windows Update and, yes, Defender was updated today. To Ver. 1.403.46.0

Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.403.46.0) - Current Channel (Staged)

"Installation date: ‎06/‎12/‎2023 19:17

Installation status: Succeeded

Update type: Important"