I recently received a new Dell laptop that has Windows 7 Ultimate 64-Bit as the operating system. A friend and I were discussing virus protection software as well as spyware protection software and how Windows 7 handles each. I am a big fan of Windows Defender so I was looking at the configuration on my Windows 7 computer and realized that the Windows Defender service was not starting. I hadn’t even realized this because I typically turn off the Virus, Spyware, and Firewall messaging that Windows complains about if you don’t have each installed the way the OS wants. So needless to say I was surprised that Windows Defender was stopped. It took me awhile to finally figure out how to resolve and I came across a bunch of issues that others may have so below I describe the error, steps I took to resolve, and final resolution.

Error: This operation returned because the timeout period expired. (Error Code: 0x800705b4).

Windows Defender Start Service Error:

I first attempted to launch the Windows Defender application to see if it would complain about something. The application appeared to boot fine but it noted the service was stopped and that it needed to be started. You could attempt to restart the Windows Defender service by clicking the Start button displayed in the image below or by rebooting the computer since the Windows Defender service should be configured to automatically start on boot. When attempting to start the service using the Start button in the below image I received the error noted in the above image.

Windows Defender: Service has stopped

After attempting to start the service failed I decided to run a System File Check hooping that it would notice an issue and resolve the problem. I ran SFC (System File Check) from a command prompt using the below syntax displayed in the image. Make sure that when you launch the Command Prompt you do so as an Administrator. This can be done by typing “command” in the “Search programs and files” box in the Start Menu, right clicking “Command Prompt” that will display after the search, and then selecting “Run as administrator” from the pop up menu.

Windows 7: Run System File Check From A Command Prompt:

Depending on the speed of your computer the System File Check could take awhile to run on Windows 7. Hopefully in your case this will resolve the issue though it did not in my case. This did however lead me to the issue which I will explain more below. When the System File Check was complete it noted that it did find some corrupt files however it was unable to fix them as displayed in the below image.

Windows 7 System File Check Found Corrupted Files:

So the System File Check says to look in the CBS.log file for more details which is the next step I took. Navigate to your CBS.log which on Windows 7 Ultimate 64-Bit is located in the “C:\Windows\Logs\CBS” directory. I imagine the location is similar on all versions of Windows. Open the CBS.log file in your favorite text file editor such as Notepad++ and scroll to the bottom which is where results from the System File Check will be located. If you have trouble locating anything relating to Windows Defender you can look for “Repair results created” or “Beginning Verify and Repair transaction” which indicates the output from SFC. Below is the output from the System File Check in the CBS.log showing the corrupted Windows Defender files.

Windows 7 System File Check Output In CBS.log: MsMpCom.dll – Windows Defender File

2010-01-08 14:46:32, Info                  CSI    000001ac [SR] Beginning Verify and Repair transaction
2010-01-08 14:46:32, Info                  CSI    000001ad [SR] Cannot repair member file [l:18{9}]"MpSvc.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2010-01-08 14:46:32, Info                  CSI    000001ae Hashes for file member SystemRootWinSxSamd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6cMsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
  Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
2010-01-08 14:46:32, Info                  CSI    000001af [SR] Cannot repair member file [l:22{11}]"MsMpCom.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-01-08 14:46:32, Info                  CSI    000001b0 [SR] Cannot repair member file [l:18{9}]"MpSvc.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2010-01-08 14:46:32, Info                  CSI    000001b1 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.Microsoft-Windows-Client-Features-Update"
2010-01-08 14:46:32, Info                  CSI    000001b2 Hashes for file member SystemRootWinSxSamd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6cMsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
  Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
2010-01-08 14:46:32, Info                  CSI    000001b3 [SR] Cannot repair member file [l:22{11}]"MsMpCom.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2010-01-08 14:46:32, Info                  CSI    000001b4 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.Microsoft-Windows-Client-Features-Update"
2010-01-08 14:46:32, Info                  CSI    000001b5 [SR] Could not reproject corrupted file [ml:520{260},l:74{37}]"??C:Program FilesWindows Defender"[l:18{9}]"MpSvc.dll"; source file in store is also corrupted
2010-01-08 14:46:32, Info                  CSI    000001b6 Hashes for file member ??C:Program FilesWindows DefenderMsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
  Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
2010-01-08 14:46:32, Info                  CSI    000001b7 Hashes for file member SystemRootWinSxSamd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6cMsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
  Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
2010-01-08 14:46:32, Info                  CSI    000001b8 [SR] Could not reproject corrupted file [ml:520{260},l:74{37}]"??C:Program FilesWindows Defender"[l:22{11}]"MsMpCom.dll"; source file in store is also corrupted
2010-01-08 14:46:33, Info                  CSI    000001b9 Repair results created:

As you can see in the above CBS log output the System File Check was complaining about the MsMpCom.dll file. So I did a search on that file and located it in the Windows Defender directory which is the first displayed below. On Windows 7 64-Bit Windows Defender will have two directories so both are listed below with the one containing MsMpCom.dll displayed first.

Windows 7 Ultimate 64-Bit Windows Defender Directories:

C:\Program Files\Windows Defender
C:\Program Files (x86)\Windows Defender

In the “C:\Program Files\Windows Defender” directory the MsMpCom.dll file was 0 bytes. Obviously this was not correct and my theory is that it probably wasn’t 0 bytes but was corrupted and when I ran System File Check against it the process of trying to fix the file actually made it 0 bytes. Luckily a friend was over with a laptop also running Windows 7 Ultimate 64-bit and I was able to compare my files to his. Turns out two of my Windows Defender DLL files were different sizes than his and I ended up replacing MsMpCom.dll and MpSvc.dll. After replacing the files I rebooted my laptop and Windows Defender started without issue. I still had the service set to start automatically so if you had modified that in troubleshooting verify the service is set to start on boot. Below is an image of Windows Defender running followed by one of Windows Defender after a successful scan.

Windows Defender Scanning A Windows 7 Ultimate 64-Bit Computer:

Successful Windows Defender Update On Windows 7 Ultimate 64-Bit Computer:

I am assuming there are many variations of this same type of problem regarding Windows Defender and Windows 7. Hopefully the above will either resolve your issue or lead you in the right direction towards resolution. Please add comments if you find a different resolution or if you have any comments and/or questions relating to this article.

Related posts:

1. Pandora Internet Radio: That activation code is expired. Please try again with another code. You may get the below error when attempting to activate...
2. Canon ImageRunner Error Code Reset These are the steps to resetting error codes on the...
3. Twitterific: The connection to Twitter failed with ‘Operation could not be completed (YAJL error 3.)’ I was recently on a trip and trying to update...
4. Vista command line ipconfig – The requested operation requires elevation. With some of the security changes in Vista you can...
5. phpMyAdmin: Script timeout passed, if you want to finish import, please resubmit same file and import will resume. When attempting to import a gzip sql file into MySQL...

This entry was posted on Saturday, January 9th, 2010 at 10:04 PM and is filed under Errors. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.