Windows Defender error

Discussion:

(too old to reply)

Groundhog Gus

2014-07-01 05:05:24 UTC

System is a 64 bit system. Upon startup, Defender respons with:

Application failed to initialize: 0x800106ba.

For 2 weeks now I have tried all suggestions from wed sites including
Microsoft with no success. Believe it has something to do with
KB915597 (Definition 1). Update insists on trying to install it but
comes up with failure. I just looked at performance monitor and it
tells me that on June 10, KB915597 was installed and installed
successfully. Yet if I look at installed updates thru control
panel, it does not show up at all. How do I fix this sucker so
it will once more run successfully?? TIA

Paul

2014-08-03 07:30:21 UTC

Permalink

Post by Groundhog Gus
Application failed to initialize: 0x800106ba.
For 2 weeks now I have tried all suggestions from wed sites including
Microsoft with no success. Believe it has something to do with
KB915597 (Definition 1). Update insists on trying to install it but
comes up with failure. I just looked at performance monitor and it
tells me that on June 10, KB915597 was installed and installed
successfully. Yet if I look at installed updates thru control
panel, it does not show up at all. How do I fix this sucker so
it will once more run successfully?? TIA

Most of the answers I see when Googling this, involve
a file like "Windefend" running in a svchost. One fix
consists of a ton of lines of Regedit-like information,
but it doesn't look like a .reg file and isn't in a format
I'm familiar with.

http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_programs/reinstalling-windows-defender-wvista/32fddb1c-1d24-408c-aa8f-0ac82baa237a

You can see in that chunk of registry info, that the
Windefend service is supposed to run inside "LocalSystem"
svchost. The sysinternals.com Process Explorer can look
at the contents of Svchost, and tell you what is inside
each one. That won't help right now, because my guess is
the necessary service did not start.

When you see "25,00,53,00,79,00,73" in those registry entries,
don't panic. A chunk like "25,00" makes a single letter of the alphabet.
For English speakers, the second byte happens to be unused and
is always 00. So it's really a character sequence like 25 53 79 73
once we remove the unneeded bytes. You use a table like this one,
and the hexadecimal section, and convert those four, to human-readable
form. The first part I can see here, is an environment variable,
delimited by a percent sign. When the system sees those, it translates
the variable (using runtime info), to something like "C:\Windows"
or the like.

http://www.manpagez.com/man/7/ascii/

25 53 79 73 = "%Sys"

The info will make a lot more sense, when the translatable
portions are converted back into something you can actually
read. This evolution in software, also happens to make
it a bitch to find text on a disk drive. I had to write my
own program to help me do some of this stuff (there are
so many ways to store simple text, and no programs promise
to do a good job of finding all of them).

*******

In any case, what they attempt in this thread, is a lot
simpler... I like this for a first attempt, before going
"Registry crazy".

(Post #9, 08 May 2009)
http://www.vistax64.com/vista-security/113342-windows-defender-error-0x800106ba.html

That involves just checking if the service is
set to automatic or something. But that big wad of
regedit material, looks like it is also part of
what would be installed, when the Windows Defender service
is first installed on the computer. The registry related
stuff would be for cases, where malware had destroyed
that part of the registry. The Services fix, is for cases
where the registry is (mostly) intact, but the service
has been disabled somehow.

Another fix I saw, was referring to using regsvr32 on
a list of files, but so far I'm not seeing evidence that's
necessary right away.

So I can see hints of a solution - the problem is, they're
not coming from Microsoft staff. In Vista, apparently Windows
Defender is not designed to be removed. Yet, by using OneCare,
the user can have code present on the machine, which can turn
off Defender, and then the fun begins. So it's a tool, where
some joker thought it would be cool to make it unmaintainable
(normally you uninstall then reinstall to attempt to fix stuff).
And without manual fix info from Microsoft staff, it's pretty
hard to piece together a manual peocedure for every last step
needed to put it back on the rails after it gets tipped over.

Yet another suggestion, was to try "sfc /scannow", but no
one provided any feedback that it did anything. That would
attempt to repair core system files. But it would not be
able to put back the registry glue, that installs the
service and associates Windefend with the appropriate
svchost. And sfc /scannow would likely not regsvc32 anything
that needs to be registered. Normally, if this was a Windows
Feature, and you uninstalled it and reinstalled it, you'd
get a lot of the appropriate operations for free.

Paul

Groundhog Gus

2014-08-03 14:11:35 UTC

Permalink

Post by Paul

Most of the answers I see when Googling this, involve
a file like "Windefend" running in a svchost. One fix
consists of a ton of lines of Regedit-like information,
but it doesn't look like a .reg file and isn't in a format
I'm familiar with.
http://answers.microsoft.com/en-us/windows/forum/windows_vista-windows_
programs/reinstalling-windows-defender-wvista/32fddb1c-1d24-408c-aa8f-0
ac82baa237a
You can see in that chunk of registry info, that the
Windefend service is supposed to run inside "LocalSystem"
svchost. The sysinternals.com Process Explorer can look
at the contents of Svchost, and tell you what is inside
each one. That won't help right now, because my guess is
the necessary service did not start.
When you see "25,00,53,00,79,00,73" in those registry entries,
don't panic. A chunk like "25,00" makes a single letter of the
alphabet. For English speakers, the second byte happens to be unused
and is always 00. So it's really a character sequence like 25 53 79 73
once we remove the unneeded bytes. You use a table like this one,
and the hexadecimal section, and convert those four, to human-readable
form. The first part I can see here, is an environment variable,
delimited by a percent sign. When the system sees those, it translates
the variable (using runtime info), to something like "C:\Windows"
or the like.
http://www.manpagez.com/man/7/ascii/
25 53 79 73 = "%Sys"
The info will make a lot more sense, when the translatable
portions are converted back into something you can actually
read. This evolution in software, also happens to make
it a bitch to find text on a disk drive. I had to write my
own program to help me do some of this stuff (there are
so many ways to store simple text, and no programs promise
to do a good job of finding all of them).
*******
In any case, what they attempt in this thread, is a lot
simpler... I like this for a first attempt, before going
"Registry crazy".
(Post #9, 08 May 2009)
http://www.vistax64.com/vista-security/113342-windows-defender-error-0x
800106ba.html
That involves just checking if the service is
set to automatic or something. But that big wad of
regedit material, looks like it is also part of
what would be installed, when the Windows Defender service
is first installed on the computer. The registry related
stuff would be for cases, where malware had destroyed
that part of the registry. The Services fix, is for cases
where the registry is (mostly) intact, but the service
has been disabled somehow.
Another fix I saw, was referring to using regsvr32 on
a list of files, but so far I'm not seeing evidence that's
necessary right away.
So I can see hints of a solution - the problem is, they're
not coming from Microsoft staff. In Vista, apparently Windows
Defender is not designed to be removed. Yet, by using OneCare,
the user can have code present on the machine, which can turn
off Defender, and then the fun begins. So it's a tool, where
some joker thought it would be cool to make it unmaintainable
(normally you uninstall then reinstall to attempt to fix stuff).
And without manual fix info from Microsoft staff, it's pretty
hard to piece together a manual peocedure for every last step
needed to put it back on the rails after it gets tipped over.
Yet another suggestion, was to try "sfc /scannow", but no
one provided any feedback that it did anything. That would
attempt to repair core system files. But it would not be
able to put back the registry glue, that installs the
service and associates Windefend with the appropriate
svchost. And sfc /scannow would likely not regsvc32 anything
that needs to be registered. Normally, if this was a Windows
Feature, and you uninstalled it and reinstalled it, you'd
get a lot of the appropriate operations for free.
Paul

Paul, used the "sfc/scannow" option a few weeks ago and that did the
trick. Evidently one of the files in Defender was/were corrupt. Anyway
it's now back to normal and working just fine. Thx