Defender scans dying halfway through? It wasn't malware, and it's already fixed

Plenty of people spent Tuesday afternoon convinced they had an infection. Defender would begin a scan, run for a while, then simply disappear - straight back to the Virus & threat protection screen showing "Last scan: Not available" and the line "Threat service has stopped. Restart it now." Malware switching off your antivirus looks exactly like that. Then the same failure showed up on freshly installed machines with nothing wrong with them.

It wasn't malware. It was Defender's own definition update. The crash logged a 0xc0000005 access violation pointing at mpengine.dll, which is the scanning engine itself, and it hit Windows 10 and Windows 11 alike. Reports tie it to the security intelligence packages Microsoft shipped while closing the ShieldBreak bypass we covered last week - a fix that broke the tool doing the fixing.

Microsoft has already dealt with it. Security intelligence version 1.457.236.0 or newer restores scanning, and those definitions come down through Windows Update automatically, several times a day, with no reboot involved. A few machines needed the package after that, 1.457.238.0, before scans ran to completion. If yours is still misbehaving, open Windows Security, go to Virus & threat protection, click Check for updates under Protection updates, then run a quick scan and watch it finish.

The lesson worth keeping is the diagnostic one. "My antivirus has stopped working" and "I have a virus" look identical from the outside, and the boring explanation is the right one more often than not. Tendvane's security-posture check reports whether real-time protection is genuinely on and when your definitions last updated, which beats guessing at it.