I recently received a new Dell laptop that has Windows 7 Ultimate 64-Bit as the operating system. A friend and I were discussing virus protection software as well as spyware protection software and how Windows 7 handles each. I am a big fan of Windows Defender so I was looking at the configuration on my Windows 7 computer and realized that the Windows Defender service was not starting. I hadn’t even realized this because I typically turn off the Virus, Spyware, and Firewall messaging that Windows complains about if you don’t have each installed the way the OS wants. So needless to say I was surprised that Windows Defender was stopped. It took me awhile to finally figure out how to resolve and I came across a bunch of issues that others may have so below I describe the error, steps I took to resolve, and final resolution.
Error: This operation returned because the timeout period expired. (Error Code: 0x800705b4).
Windows Defender Start Service Error:
I first attempted to launch the Windows Defender application to see if it would complain about something. The application appeared to boot fine but it noted the service was stopped and that it needed to be started. You could attempt to restart the Windows Defender service by clicking the Start button displayed in the image below or by rebooting the computer since the Windows Defender service should be configured to automatically start on boot. When attempting to start the service using the Start button in the below image I received the error noted in the above image.
Windows Defender: Service has stopped
After attempting to start the service failed I decided to run a System File Check hooping that it would notice an issue and resolve the problem. I ran SFC (System File Check) from a command prompt using the below syntax displayed in the image. Make sure that when you launch the Command Prompt you do so as an Administrator. This can be done by typing “command” in the “Search programs and files” box in the Start Menu, right clicking “Command Prompt” that will display after the search, and then selecting “Run as administrator” from the pop up menu.
Windows 7: Run System File Check From A Command Prompt:
Depending on the speed of your computer the System File Check could take awhile to run on Windows 7. Hopefully in your case this will resolve the issue though it did not in my case. This did however lead me to the issue which I will explain more below. When the System File Check was complete it noted that it did find some corrupt files however it was unable to fix them as displayed in the below image.
Windows 7 System File Check Found Corrupted Files:
So the System File Check says to look in the CBS.log file for more details which is the next step I took. Navigate to your CBS.log which on Windows 7 Ultimate 64-Bit is located in the “C:\Windows\Logs\CBS” directory. I imagine the location is similar on all versions of Windows. Open the CBS.log file in your favorite text file editor such as Notepad++ and scroll to the bottom which is where results from the System File Check will be located. If you have trouble locating anything relating to Windows Defender you can look for “Repair results created” or “Beginning Verify and Repair transaction” which indicates the output from SFC. Below is the output from the System File Check in the CBS.log showing the corrupted Windows Defender files.
Windows 7 System File Check Output In CBS.log: MsMpCom.dll – Windows Defender File
- 2010-01-08 14:46:32, Info CSI 000001ac [SR] Beginning Verify and Repair transaction
- 2010-01-08 14:46:32, Info CSI 000001ad [SR] Cannot repair member file [l:18{9}]"MpSvc.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
- 2010-01-08 14:46:32, Info CSI 000001ae Hashes for file member \SystemRoot\WinSxS\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
- Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
- 2010-01-08 14:46:32, Info CSI 000001af [SR] Cannot repair member file [l:22{11}]"MsMpCom.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
- 2010-01-08 14:46:32, Info CSI 000001b0 [SR] Cannot repair member file [l:18{9}]"MpSvc.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
- 2010-01-08 14:46:32, Info CSI 000001b1 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.Microsoft-Windows-Client-Features-Update"
- 2010-01-08 14:46:32, Info CSI 000001b2 Hashes for file member \SystemRoot\WinSxS\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
- Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
- 2010-01-08 14:46:32, Info CSI 000001b3 [SR] Cannot repair member file [l:22{11}]"MsMpCom.dll" of Security-Malware-Windows-Defender, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
- 2010-01-08 14:46:32, Info CSI 000001b4 [SR] This component was referenced by [l:242{121}]"Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.Microsoft-Windows-Client-Features-Update"
- 2010-01-08 14:46:32, Info CSI 000001b5 [SR] Could not reproject corrupted file [ml:520{260},l:74{37}]"\??\C:\Program Files\Windows Defender"\[l:18{9}]"MpSvc.dll"; source file in store is also corrupted
- 2010-01-08 14:46:32, Info CSI 000001b6 Hashes for file member \??\C:\Program Files\Windows Defender\MsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
- Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
- 2010-01-08 14:46:32, Info CSI 000001b7 Hashes for file member \SystemRoot\WinSxS\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpCom.dll do not match actual file [l:22{11}]"MsMpCom.dll" :
- Found: {l:32 b:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=} Expected: {l:32 b:L9X0GvGnpPakMHlK2NngqvuUhzQ/hrQ+6FDyXgqJFIM=}
- 2010-01-08 14:46:32, Info CSI 000001b8 [SR] Could not reproject corrupted file [ml:520{260},l:74{37}]"\??\C:\Program Files\Windows Defender"\[l:22{11}]"MsMpCom.dll"; source file in store is also corrupted
- 2010-01-08 14:46:33, Info CSI 000001b9 Repair results created:
As you can see in the above CBS log output the System File Check was complaining about the MsMpCom.dll file. So I did a search on that file and located it in the Windows Defender directory which is the first displayed below. On Windows 7 64-Bit Windows Defender will have two directories so both are listed below with the one containing MsMpCom.dll displayed first.
Windows 7 Ultimate 64-Bit Windows Defender Directories:
- C:\\Program Files\\Windows Defender
- C:\\Program Files (x86)\\Windows Defender
In the “C:\Program Files\Windows Defender” directory the MsMpCom.dll file was 0 bytes. Obviously this was not correct and my theory is that it probably wasn’t 0 bytes but was corrupted and when I ran System File Check against it the process of trying to fix the file actually made it 0 bytes. Luckily a friend was over with a laptop also running Windows 7 Ultimate 64-bit and I was able to compare my files to his. Turns out two of my Windows Defender DLL files were different sizes than his and I ended up replacing MsMpCom.dll and MpSvc.dll. After replacing the files I rebooted my laptop and Windows Defender started without issue. I still had the service set to start automatically so if you had modified that in troubleshooting verify the service is set to start on boot. Below is an image of Windows Defender running followed by one of Windows Defender after a successful scan.
Windows Defender Scanning A Windows 7 Ultimate 64-Bit Computer:
Successful Windows Defender Update On Windows 7 Ultimate 64-Bit Computer:
I am assuming there are many variations of this same type of problem regarding Windows Defender and Windows 7. Hopefully the above will either resolve your issue or lead you in the right direction towards resolution. Please add comments if you find a different resolution or if you have any comments and/or questions relating to this article.
can you please send me the files too? the system file check did not fix the windows defender. I’m also running WIndows 7 64 bit ultimate on my PC. I would really appreciate your help. Thanks
Hello Ryan,
Send you what files? If you could be more specific I might be able to help.
Thanks.
alex
how do you replace the file MsMpCom.dll and MpSvc.dll ? i’m having the same problem too and i’m very worried about it . i’ve done all the steps u said, but i’m stuck at the CBS file, the access is denied . Then i tried to copy it and reopen it in the copied file, but it needs to replace in the original file right ? Thanks alot for your help.
Hello Candy,
You might make sure that Windows Defender is not attempting to run. Also make sure you are logged in as administrator and then if all else fails try booting into safe mode and trying the steps in the article above again via Safe Mode.
Thanks.
alex
thanks alot for your help. I don’t know much about computer. Is there any chance that my computer got infected by virus ? I’m using the Avast-free antivirus . I scan my laptop everyday and no file infected, but my laptop recently appears to have strange symptoms such as the Action Center say that windows defender needs to scan my computer, then it failed like u said, and i can’t open to adjust my date and time either, etc.. . I don’t know whats wrong with it :(
Thanks
Hello Candy,
It is possible you have a virus. I would try uninstalling avast and installing Microsoft Security Essentials to see if that locates a virus. If that doesn’t work you might try MalwareBytes. Make sure if you install Microsoft Security Essentials that you uninstall Avast as you should only have one of the two installed at a time.
Thanks.
alex
Hey Very much Thanks for the Info.., Guys., I want you to please upload the few files of the Windows defender folder…, I have got Windows 7 Ultimate version.., i have not installed sp1, i don’t want it either.., can u please upload or e-mail the files to me.., it will really be help ful ., Thanks a ton.., tc., Ashwin
Hello ASHWIN,
No problem. Unfortunately we only provide files to people on a very rare basis and we don’t have the time to dig up the files for Windows Defender for you at this time. I am sure you can locate them elsewhere on the Internet.
Thanks.
alex
Hi Alex,
Is it possible for you to send the DLL files..so that even i can try it out..
Thank u.
Ani
Hello ani,
Unfortunately I no longer have the DLL files.
Thanks.
alex
I had the same symptoms for this error and it was driving me crazy as I couldn’t solve it. (W7 x64) as this error came after I installed something and I didn’t remember what it was…
Based on suggestions here, I compared the files with the other comp, which I have. The files were identical. Again after Googling some other forums were suggesting to check the registry. So I checked at [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Parameters] and the key ServiceDll was ponting to %ProgramFiles(x86)%\Windows Defender\mpsvc.dll. The right location should be %ProgramFiles%\Windows Defender\mpsvc.dll.
I corrected the value and after restart the Defender was back on.
Who, which program changed it, I have no clue. But I’m suspicious that behind this change was some Registry Cleaner.
Hello caprihorse,
Glad to hear you got it resolved. Thanks for leaving such detailed feedback.
Thanks.
alex
Great advice. Same thing as you – no idea why it stopped working, but also suspect a registry cleaner. Did what you recommended (and should add that when in the registry to right-click on the file, then select “modify”, then eliminate “(x86)”) and now it works just fine. Thanks a bunch.
Hello GreatOne,
Thanks for expanding on caprihorse’s comment! Always appreciated when people add suggestions and/or more information that can be useful for others!
Thanks.
alex
Thanks Caprihorse! This same thing happened to me as well. Not sure what caused it. I’ve never had a registry cleaner installed on my PC. Didn’t realize anything was wrong until windows update kept failing because it couldn’t update the bitdefender definitions. Checked my registry keys and that was my problem! Changed them and rebooted and everything’s happy now!
Thanks Again!
Grompy
Thank you, you helped me, windows defender is OK
I am experiencing this same issue, but the Defender’s mpsvc.dll file is located in the right directory, and the Registry is point to the correct file. Does anyone have any other ideas?
In my situation, however, I just recently re-installed the Windows 7 OS on my system and, when setting up everything on it, it never would allow me to turn on Defender (I always received this error message every single time I attempted to turn on Defender.)
Hello SameIssue Unresolved,
Could it possibly be related to the version of Windows 7 or maybe a conflicting piece of software that is already running?
Thanks.
alex
Thank you so much Caprihorse, i was racking my brain for ages and have tried different things and plenty of hot fixes applied with no luck, till i came across your reply. I was skeptical at first thinking after trying so many things surely it can not be this easy, but your simple registry edit of the location of Windows defender worked for me. If your having this problem give this a try follow Caprihorse suggestion by changing the location of ServiceDll key.in the registry.