Windows Defender closes itself immediately after start

[lopm46]

Hi,

I'm not able to run the Windows Defender app, it just close itself immediately. However, Windows defender seems running.

What I did :
- Disable every third-party softwares with msconfig on safe mode
- SFC /scannow --> no corruptions
- DISM /ScanHealth /CheckHealth /RestoreHealth --> nothing
- Perform a Repair Upgrade Using the Windows 10 ISO file from the Media Tool Kit
- Problems starting Windows Defender in Windows 8/8.1/10
- Repair Windows with Tweaking.com - Windows Repair tool
- SFCFix didnt find anything

See the attach files for logs.

Procmon log

Windows 19043.1165 up-to-date

 

[lopm46]

ZHPDiag scan

 

[andrewlen]

Hi,

Do you have any other third party AV or Anti Malware software installed on your machine? Sometimes, security-related software can install on your machine without your consent. McAfee scanner is notorious for that type of behaviour and ends up on countless machines when an Adobe Reader update is installed just as one example. That can often end up causing conflicts with existing AV software.

A quick way to determine that is to download something like Belarc Advisor, install and run it. It will generate a comprehensive list of all software programs installed on your machine which you can then upload here for a second pair of eyes to look over. Caution: Only upload the Software Versions and Usage section contents, not the entire report as the report will also contain sensitive information such as the Licensing details of your software.

If you would like to do that, I'd be happy to take a look to see if I can note any installed software that could be causing a conflict with Microsoft Defender.

Once that's ruled out, you could look at reinstalling Defender on your copy of Windows 10.

Regards, Andrew

 

[lopm46]

Hi,

Thanks for your answer.

I don't have any AV currently installed.

See the attach file for the Belarc software report.

 

[britechguy]

It would also help to have the make and model of the machine that's experiencing this difficulty.

 

[andrewlen]

Hi,

Apologies for the delay in my reply. Either I wasn't notified of your last post or I happened to miss it.

I've looked through your Belarc Advisor log and have identified a couple of possibilities.

i No Company Name - Spybot Anti-Beacon version 3.7.0.0

Can you try temporarily disabling Spybot Anti-Beacon and then attempt to open Defender again?

i Piriform - CCleaner version 5.63.0.7540 (32/64-bit

How often is CCleaner being used? Do you have it set to automatically clean the Windows registry or clean the registry when running CCleaner manually?

Finally, at this point, I would suggest doing a non-destructive upgrade of Windows 10. You can follow the steps in the following article I wrote that was published back in 2018. The steps haven't changed.

Non Destructive Repair of Windows 10 - Answers to commonly asked questions

Just skip down to the Starting your Upgrade Repair of Windows 10 title and go from there.

I know you've said you've already done that step, but I'd suggest doing it again.

Hope that's helpful.

Regards, Andrew

 

[shamblerdk]

Finally, at this point, I would suggest doing a non-destructive upgrade of Windows 10. You can follow the steps in the following article I wrote that was published back in 2018. The steps haven't changed.

He already explained that he did that in his original post.



Rootkits such as ZeroAccess (version 1) is known for attempting (and most often succeeding) in closing down AV software. I'd use a couple of the many rootkit scanners out there, just to be sure. Most antivirus websites have one available.

 

[andrewlen]

I realise he'd already done that and said that in my post, but I'm trying to be systematic in my approach.

 

[britechguy]

As an aside, when it comes to the Windows 10 (and I'm sure, Windows 11) ISO files, I strongly prefer using the Media Creation Tool (have no idea what the Media Took Kit is, but Microsoft gives so many methods) to create "the freshest" copy of the ISO available. I've found that even building one hours to days after a prior one can get a different size ISO as they update the various component stores used by the MCT to build them.

I've also had some occasions where I have suggested Doing a Windows 10 Repair Install or Feature Update Using the Windows 10 ISO file, followed by doing one again. There are those rare occasions where, for whatever reason, this works out some weird kink that was not worked out with the first one. Most often it's when the first round is an actual Feature Update, rather than a Repair Install. Also if a "stale" ISO was used the first time around. While none of these things "should" matter, sometimes they have.