Microsoft Defender users are reporting widespread scan failures after a recent security intelligence update, with Quick and Full scans crashing the antivirus engine and Offline scans reportedly freezing near completion.
Reports from system administrators, home users, and Microsoft's support forum indicate the issue is tied to recent Defender updates rather than malware compromising affected PCs.
The failures began surfacing on August 18 across Reddit communities and Microsoft's support forums. Users said Defender would begin a scan, abruptly stop, and display a “Threat service has stopped. Restart it now” warning. Restarting the service generally did not resolve the problem.
Administrators using Microsoft Defender for Endpoint reported the same behavior across multiple machines, including clean Windows installations. One sysadmin said MsMpEng.exe, Defender's antimalware process, was crashing on several endpoints, while another recorded WinDefend service timeouts during Quick Scans.
Microsoft Defender is the antivirus and endpoint protection technology built into Windows 10 and Windows 11 and is also used across enterprise environments through Defender for Endpoint. Because it is enabled by default on hundreds of millions of Windows PCs, a faulty engine or intelligence update can affect both consumers and centrally managed corporate systems.
The most detailed reports point to Defender engine versions 1.1.26070.7 and 1.1.26080.2, combined with Security Intelligence versions including 1.457.222.0, 1.457.225.0, 1.457.226.0, 1.457.227.0, and 1.457.230.0.
Several users inspecting Windows Event Viewer reported crashes involving mpengine.dll, including exception code 0xC0000005, an access-violation error. Others found Quick and Full scans failing within seconds or near completion, while Microsoft Defender Offline scans repeatedly stalled around 90–93%.
The symptoms also appeared on freshly reinstalled Windows systems only after Defender updates were applied, strengthening indications that the problem originated with an update rather than persistent malware or corrupted Windows installations.
Security researcher Aryeh Goretsky reported that users upgrading to Security Intelligence Update 1.457.236.0 reported that the crashes disappeared. Multiple Reddit users independently reported the same result.
Some commenters speculated that the faulty update might be connected to changes addressing a recently disclosed Defender vulnerability dubbed “ShieldBreak.” However, no evidence supplied in the reports establishes such a connection.
For affected users, the safest first step is to run Windows Update and verify that Defender's Security Intelligence version has reached 1.457.236.0 or newer.
Administrators can also check the installed versions with PowerShell using Get-MpComputerStatus. If Defender remains stuck on an affected definition set, Microsoft's MpCmdRun.exe utility can remove dynamic signatures and request a fresh update:
MpCmdRun.exe -RemoveDefinitions -DynamicSignaturesfollowed by:
MpCmdRun.exe -SignatureUpdateUsers should avoid reinstalling Windows or making invasive registry changes solely because scans are failing. Reports so far indicate real-time malware protection may remain active even when manually initiated scans crash, although organizations should verify endpoint health and use an alternative trusted scanner where additional assurance is required.
Microsoft had not provided an official explanation in the material reviewed, but the availability of the newer 1.457.236.0 intelligence package appears to provide the immediate fix reported by affected users.
Leave a Reply