D
Dave W. FL
Found my computer off. Wondering if this patch, AM_Delta_Patch_1.263.1607.0 caused it to shutdown???
Found this info in the /MpWUStub file my Windows\Temp folder
Start time: 2018-03-28 15:49:55Z
Process: 1ec8.1d3c6ac6b1197fd
Command: /stub 1.1.14500.5 /payload 1.263.1650.0 /MpWUStub /program H:\WINDOWS\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.263.1607.0.exe WD /q
Administrator: yes
Version: 1.1.14500.5
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: c2cf669da9305da3cc83d3ec269595d69df584836874e7a2c52aeef877291c87 1.1.14600.4
AS base VDM: a7109d65f26c0efb301d2f894c4862e6bf109f0fb389d70913a47fd780e1db0b 1.263.0.0
AV base VDM: 5aa7b21fbf43adcd179e77fcbf18bd2676770dc4a02c07df6ce3410b8a708784 1.263.0.0
AS delta VDM: 521e766f0c0d303c44605103054239e76dd61050a35f409fa3c832d5a251188d 1.263.1607.0
AV delta VDM: 6f6c66fadf95d6d3d704013bdd909fa3dc236952491a72b4bc1e499561c248ed 1.263.1607.0
NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
NIS base VDM: 3894139c40e3cf39212954fbad25b45d3f6d88e1816a90272829627fce153a3c 119.0.0.0
NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
Platform: 8cfa82abe9a30b8af8762b5abf200986c1c4594efb73f4ee46365206045903a7 4.12.17007.18022
============================== AccumulatePackages ==============================
PackageName:*H:\WINDOWS\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.263.1607.0.exe
=============================== PackageDiscovery ===============================
Package files discovered:
Directory: H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
1.263.1607.0_to_1.263.1650.0_mpasdlta.vdm._p: db2765f0a3d6427ebac150ea31a96f2013091f523f7b996c75d59580a1e3b941
1.263.1607.0_to_1.263.1650.0_mpavdlta.vdm._p: 843dc47ecdf4b8ae44e2335bb033a99c776e37325c2e0eb101177fbc94e2c812
AM BDD:
Engine: Not included
AS base VDM: Not included
AV base VDM: Not included
AS delta VDM: 1.263.1650.0
AV delta VDM: 1.263.1650.0
=============================== PatchApplication ===============================
Patched mpasdlta.vdm to 1.263.1650.0
Patched mpavdlta.vdm to 1.263.1650.0
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Package files:
Directory: H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
1.263.1607.0_to_1.263.1650.0_mpasdlta.vdm._p: db2765f0a3d6427ebac150ea31a96f2013091f523f7b996c75d59580a1e3b941
1.263.1607.0_to_1.263.1650.0_mpavdlta.vdm._p: 843dc47ecdf4b8ae44e2335bb033a99c776e37325c2e0eb101177fbc94e2c812
mpasdlta.vdm: 564ad7ebe44bda594404b102dc3690bfca1bae5a343315e0ade23a5767ff94fd 1.263.1650.0
mpavdlta.vdm: af72e8577de75e7a729cf4afb2a75a873ab506f842b8162e20b0f49f6275457c 1.263.1650.0
SignatureLocation changed from H:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CDF952E5-CA45-40D1-AF78-4AF9A50F88F5} to H:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7498F607-24F1-4DA9-8047-F763EF62D6FD}
Signatures updated from H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the AM BDD package.
Original: Updated to:
AS delta VDM: 1.263.1607.0 1.263.1650.0
AV delta VDM: 1.263.1607.0 1.263.1650.0
DeltaUpdateFailure set to 0
BddUpdateFailure set to 0
End time: 2018-03-28 15:50:12Z
--------------------------------------------------------------------------------
And this too, in the MpCmdRun file
------------------------------------------------------------------------------------
MpCmdRun: Command Line: "H:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
Start Time: Tue Mar 27 2018 21:56:11
Run as Network Service
MpCmdRun: End Time: Tue Mar 27 2018 21:56:11
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "H:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe" Scan -ScheduleJob -ScanTrigger 55
Start Time: Wed Mar 28 2018 13:44:44
Starting RunCommandScan.
RunCommandTime Info - Wed Mar 28 2018 13:45:44 Service stopped. Exiting Idle TaskEnd: Idle Task - WdVerification
MpCmdRun: End Time: Wed Mar 28 2018 13:45:44
-------------------------------------------------------------------------------------
MpCmdRun: End Time: Wed Time Info - Wed Mar 28 2018 13:45:44 Service stopped. Exiting Idle TaskEnd: Idle Task - WdCleanup
MpCmdRun: End Time: Wed Mar 28 2018 13:45:44
--------------------------------------------------
Continue reading...
Found this info in the /MpWUStub file my Windows\Temp folder
Start time: 2018-03-28 15:49:55Z
Process: 1ec8.1d3c6ac6b1197fd
Command: /stub 1.1.14500.5 /payload 1.263.1650.0 /MpWUStub /program H:\WINDOWS\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.263.1607.0.exe WD /q
Administrator: yes
Version: 1.1.14500.5
================================ ProductSearch =================================
Microsoft Windows Defender (RS1+):
Status: Active
ProductGUID: 77BDAF73-B396-481F-9042-AD358843EC24
Engine: c2cf669da9305da3cc83d3ec269595d69df584836874e7a2c52aeef877291c87 1.1.14600.4
AS base VDM: a7109d65f26c0efb301d2f894c4862e6bf109f0fb389d70913a47fd780e1db0b 1.263.0.0
AV base VDM: 5aa7b21fbf43adcd179e77fcbf18bd2676770dc4a02c07df6ce3410b8a708784 1.263.0.0
AS delta VDM: 521e766f0c0d303c44605103054239e76dd61050a35f409fa3c832d5a251188d 1.263.1607.0
AV delta VDM: 6f6c66fadf95d6d3d704013bdd909fa3dc236952491a72b4bc1e499561c248ed 1.263.1607.0
NIS engine: b1c03b224d6779738548f04f29e1cbca02f74c714a7383c5d32cc76aadcf86be 2.1.14600.4
NIS base VDM: 3894139c40e3cf39212954fbad25b45d3f6d88e1816a90272829627fce153a3c 119.0.0.0
NIS full VDM: ae4c863d063d86b820d2acce3eb95d9312f54a972a9541a55c71ca4a0322f8f1 119.0.0.0
Platform: 8cfa82abe9a30b8af8762b5abf200986c1c4594efb73f4ee46365206045903a7 4.12.17007.18022
============================== AccumulatePackages ==============================
PackageName:*H:\WINDOWS\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.263.1607.0.exe
=============================== PackageDiscovery ===============================
Package files discovered:
Directory: H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
1.263.1607.0_to_1.263.1650.0_mpasdlta.vdm._p: db2765f0a3d6427ebac150ea31a96f2013091f523f7b996c75d59580a1e3b941
1.263.1607.0_to_1.263.1650.0_mpavdlta.vdm._p: 843dc47ecdf4b8ae44e2335bb033a99c776e37325c2e0eb101177fbc94e2c812
AM BDD:
Engine: Not included
AS base VDM: Not included
AV base VDM: Not included
AS delta VDM: 1.263.1650.0
AV delta VDM: 1.263.1650.0
=============================== PatchApplication ===============================
Patched mpasdlta.vdm to 1.263.1650.0
Patched mpavdlta.vdm to 1.263.1650.0
==================================== Update ====================================
Product name: Microsoft Windows Defender (RS1+)
Package files:
Directory: H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
1.263.1607.0_to_1.263.1650.0_mpasdlta.vdm._p: db2765f0a3d6427ebac150ea31a96f2013091f523f7b996c75d59580a1e3b941
1.263.1607.0_to_1.263.1650.0_mpavdlta.vdm._p: 843dc47ecdf4b8ae44e2335bb033a99c776e37325c2e0eb101177fbc94e2c812
mpasdlta.vdm: 564ad7ebe44bda594404b102dc3690bfca1bae5a343315e0ade23a5767ff94fd 1.263.1650.0
mpavdlta.vdm: af72e8577de75e7a729cf4afb2a75a873ab506f842b8162e20b0f49f6275457c 1.263.1650.0
SignatureLocation changed from H:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CDF952E5-CA45-40D1-AF78-4AF9A50F88F5} to H:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7498F607-24F1-4DA9-8047-F763EF62D6FD}
Signatures updated from H:\WINDOWS\Temp\816E684B-2396-4BAB-9676-F3DE74EAEDE61ec8.1d3c6ac6b1197fd
================================ ValidateUpdate ================================
MpSigStub successfully updated Microsoft Windows Defender (RS1+) using the AM BDD package.
Original: Updated to:
AS delta VDM: 1.263.1607.0 1.263.1650.0
AV delta VDM: 1.263.1607.0 1.263.1650.0
DeltaUpdateFailure set to 0
BddUpdateFailure set to 0
End time: 2018-03-28 15:50:12Z
--------------------------------------------------------------------------------
And this too, in the MpCmdRun file
------------------------------------------------------------------------------------
MpCmdRun: Command Line: "H:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges
Start Time: Tue Mar 27 2018 21:56:11
Run as Network Service
MpCmdRun: End Time: Tue Mar 27 2018 21:56:11
-------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "H:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe" Scan -ScheduleJob -ScanTrigger 55
Start Time: Wed Mar 28 2018 13:44:44
Starting RunCommandScan.
RunCommandTime Info - Wed Mar 28 2018 13:45:44 Service stopped. Exiting Idle TaskEnd: Idle Task - WdVerification
MpCmdRun: End Time: Wed Mar 28 2018 13:45:44
-------------------------------------------------------------------------------------
MpCmdRun: End Time: Wed Time Info - Wed Mar 28 2018 13:45:44 Service stopped. Exiting Idle TaskEnd: Idle Task - WdCleanup
MpCmdRun: End Time: Wed Mar 28 2018 13:45:44
--------------------------------------------------
Continue reading...