[German]It seems that Microsoft Security Essentials is causing a curious issue: Suddenly Windows Update shows double definition update entries, and the update history shows many install errors for some definition updates. The definition update will be installed multiple times.
A German blog reader pointed me to this issue. Because I could not reproduce this issue the first time, I posted a German article Microsoft Security Essentials: Doppelte Definitionsupdates – and immediately received reader feedback. Then a couple of hours later, I observed the issue on my Windows 7 production machine. Here are a few details about that mysterious issue.
A more detailled error description
If Microsoft Security Essentials (MSE) is installed under Windows 7, definition updates (signature updates) are offered via Windows Update. In normal cases, only one definition update will be shown within Windows Update window.
But some users are facing the scenario shown in the above screenshot. There is a definition update for MSE listed twice – on build 1.249.1294.0 and on 1.249.211.0. Entering the update history, there are several failed entries (see the screenshot below).
Addendum: I found an Microsoft Answers forum thread Microsoft Security Essentials Update Definition Number 1.249.211.0 Keeps On Coming Back, where another user has documented this issues (with screenshots from an English Windows 7 with MSE).
A possible fix
In most cases, Microsoft suggests to uninstall Microsoft Security Essentials (MSE) und reinstall MSE again. But within the Microsoft Answers forum thread Microsoft Security Essentials Update Definition Number 1.249.211.0 Keeps On Coming Back, a user reported, that this wasn't helpful. He wrote, that runing Windows Update Troubleshooter (see this MS page) solved his issue.
Another (temporary) fix may be to hide the faulty definition update. Then the other updates are installed successful.
Checking the details in update history
One of my German readers reported details from his update history in Windows 7. His failed definition update installs created the following events:
Ergeignisanzeige
Ereignis ID:20, Quelle: Windows Update Client
Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.251.1.0)
Error 0x80070643 is a more generic error and stands for ERROR_INSTALL_FAILURE. Then I've checked the details for a definition update failed with an install error on my Windows 7 machine. I received the error code 0x80070643.
Ereignis ID:20, Quelle: Windows Update Client
Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.251.1.0)
It says, Windows Update Client detected an install error 0x80070643 during installing definition update (signature update) for Microsoft Security Essentials KB2310138. Error code 0x80070650 stands for ERROR_INVALID_FIELD (the field isn't present).
Searching the web did not reveal any helpful hint (this article covers error 0x80070645). So I guess, there is either a missing update package referenced within the update's meta data. Or the meta data entries are damaged or wrong. Because, the issue has been observed since a week, I guess, something is broken on Microsoft's side. Any insights or suggestions from your side?
Addendum: I posted my findings at Microsoft Answers forum within the thread Microsoft Security Essentials Update Definition Number 1.249.211.0 Keeps On Coming Back, and escalated the issue. Let's see, which feedback we receive.
Since 8/19 I've been having almost daily issues with Microsoft Security Essentials Definition Updates that keep reintroducing definition 1.249.211.0 It was originally offered and installed on 7/26/17. As of 8/19 when a newer definition update is offered in Windows Update, definition 1.249.211.0 is offered again at the same time. At certain times 1.249.211.0 is installed again, and the new definition update fails. At other times both of the definitions install successfully.
In my case 1.249.211.0 has thus far been installed 9 separate times since 8/19.
Yesterday 8/27 the 1.249.211.0 MSE definition reappeared in Windows Update once again, but rather than install it I hid it. This morning a new definition, 1.251.140.0 was offered and installed without the presence of 1.249.211.0 .
A warning message of "WARNING: failed to calculate prior restore point time with error 0x80070002; setting restore point" is also shown on the WindowsUpdate.log
Is/was there an additional third party AV tool installed?
No, only MSE is installed under Win 7. Problem/error can be reproduced by manually update the definition multiple times in a short time using MSE. You will see the definition 1.249.211.0 reinstall/reappear at Control Panel\System and Security\Windows Update\View update history. As of this writing, the definition alternates between 1.251.256.0 and 1.249.211.0 with each manual update.
I have this issue continuing w/ 1.249.211.0. Always 552kb.
Also w/1.251.1xxx.0, where the xxx ratchets up by 20. Always 532kb.
A slow dial-up connection proves these two updates are not being lost to my computer, and therefore needing to be repeatedly found by "check for updates" and re-installed. They are there, but Microsoft Security Essentials cannot see them until it starts to again download them…which happens instantaneously.
So, there has to be a consideration that if MSE can't see them, some form of malware somehow disables them as soon as the computer starts to do something besides update MSE definitions.
Maybe MS is trying to solve this. I got a completely new-t0-me check box from them yesterday asking if it would be OK for them to look at a file on my computer–ieprotectstream 265D3430A246DB7C82C8CE6D5F19C734. (Maybe MSE noticed somehow I'd successfully installed 1.249.211.0 some 50 or 80 times since 7/25/17.)
my computer–ieprotectstream 265D3430A246DB7C82C8CE6D5F19C734.