Windows defender-not updating-Engine unavailable

Hi folks,
My wife's HP laptop , running Windows 10 Home 64bit version 21H1 OS build 19043.1526. ( I asked her to bring it from my daughter's home for updating and got into trouble )

Yesterday I booted and started Windows update, Security Intelligence update- Windows Defender started installing version 1.359.84.0 and at 66%, install failed.
Attachment 359622

Engine unavailable, Load updates did not do anything. It tried to update but returned to Load updates.


February Cumulative Update KB5008876 installed fine, though it took a long time.

System File Checker did not find any integrity violations.

I suspected Malware infliction, downloaded the trial version of Malware Bytes. The scan revealed 94 -PUPs mostly - and quarantined. Still Defender updates failed at 66% install. ( Malware Bytes not registered in Security Center so that Defender can run independently)

I then downloaded the update from https://www.microsoft.com/en-us/wdsi/defenderupdates and tried to install it - this morning..



When I clicked on the mpam-fe.exe, it went through the motion of installing with the green circle at the pointer arrow spinning for a while and stopping. I had no confirmation of it having installed.

I tried windows update and it sure started installing version 1.359.123.0 just moments ago but the install failed again at 66%.

The last successful update was on 11 Feb and version 1.357.375.0

So here I am seeking a resolution.

I suggest a Repair install as it's a Windows component misbehaving.

Oh, by the way, "I had no confirmation of it having installed." is normal. All you can do is watch its entry in Task manager processes to decide when it's finished.
Its entry in Task mgr, Processes has varied. The ones I have seen in the past are

Antimalware definition update
Microsoft malware protection command line utility
Microsoft malware protection signature update stub

so I suggest first adding the Command line column [right-click on any column header then select it] so you can see the file you are running positively identified.

All the best,
Denis

@Try3, Thanks for popping in. I shall keep the repair install as the last option if all else fail as I wait for other experts' opinion.
@hdmi,

Thanks for dishing out the reference.
I had already googled and seen that article and after reading that only I tried the first option downloading and installing the update from the Mirosoft website. It did not work. In the last 18 hours the security updates have changed many times. Downloading and installing it did not resolve the problem. Actually Windows update itself found the last newer update but failed to install, the install failing at the same 66%. I changed to a different network (SSID) and still the downloaded update/ direct download by Windows update, did not install. The same latest update 1.391.131.0 which the windows update found installed on my DELL PC without any problem.

As for the next option of "Windows Key+R > Regedit > Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Change both DisableAntiSpyware and DisableAntiVirus values to 0" on the HP Laptop, those two key values are already 0. So nothing to introduce , nothing to be set to 0. .

You had already tried what that MSA forum OP had said was the solution anyway [the definition update].

If there has ever been another antimalware application on that computer, I assume its own specialist removal tool was run. Remnants can come back to haunt you with bizarre symptoms years later.

Step 7 of
https://answers.microsoft.com/en-us/...5-1c91a86489e9
might be worthwhile.

I have no idea why you regard a Repair install as being something to keep as a last resort.

Denis

There was no other antimalware application before. Only Windows Defender. Yesterday only when I found that defender definition was not getting installed , I installed Malwarebytes trial version to check for malware as I indicated in my first post. It found and quarantined 94-mostly PUPs. After that the laptop was a tad faster.

I had seen the 2017 article by PrasanthKumar96 you had referred and this morning itself I had tried it "1. Restart your PC" - restarted many times. "2. Remove existing antivirus and antispyware software" - None existed before. Only after noticing the problem Malwarebytes was installed to look for and quarantine Malware. My Dell desktop also is running Malware Bytes Premium alongside Windows Defender and it hasn't created any problem. "3. Scan your PC for malware" - Done and quarantined. "4. SFC scan" - done as mentioned in my first post itself. I also ran DISM /Online /Cleanup-Image /CheckHealth "5. Clean boot" - Done. "6. Restart Security Service" - In both the HP lap top and my DELL Security Center service WSCSVC is running - Automatic ( Delayed Start). It cannot be stopped , started or do any such operation which are all greyed out. Identical in both the machines. 7. "Delete conflicting Registry Entry; "Some malwares adds malicious entries in registry that blocks real antiviruses from running. To remove these entries, follow these steps:

1. Press Windows key + R. This will open Run. Alternatively, you can go to Start and search for 'Run'.
2. In Run dialog box, type 'regedit' and hit enter. This will open Registry Editor.
3. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options.
4. In this key, if you find any entry for MSASCui.exe, MpCmdRun.exe or MsMpEng.exe then right click on it and click on Delete. If you do not find any of these entry then it is normal and you don't need to do anything."

In both the HP laptop and my Dell, MsMpEng.exe is present. Should I delete it? No. On my Dell It has not blocked any real antivirus. How could it be otherwise.
Screen shots below.
The HP laptop:



My Dell:



"8. Enabling Windows Defender from Group policy: " registry entry named DisableAntiSpyware, then change its value to 0"
It is already there in the HP laptop as mentioned in my last post.

I am too lazy to do a repair install now, I am still looking for an easy solution . If nothing comes , I will do it at my own leisure. I am in no hurry.( I have the recovery drive also and I can restore it to factory condition. There aren't many installed programs. and I want to sleep for a few days .

Having read your post, I checked 3 Windows 10 computers and I am no longer convinced by that Step 7 either.
MsMpEng.exe was a subkey of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options in all mine.

Talk again when you wake up. Please do remember that a Repair install only makes the computer do some work not you. Your role is to double-click on setup.exe then make a pot of tea.

All the best,
Denis

Try3 said:

Your role is to double-click on setup.exe then make a pot of tea.

I'm chuffed!

Compumind said:

I'm chuffed!

Well, make the pot of tea, drink the tea and then you'll be refreshed instead.

All the best,
Denis