Windows Defender Real Time Protection will not turn on after antivirus removal

[chuckandbuckle]

Hello,


I recently removed Charter Communications Antivirus with the intent of having Windows Defender's Antivirus take its place. I found a previous thread that provided a list of possible solutions and the steps in which to take in order to have Window's Defender to operate.


The steps provided are listed below, along with all the information regarding to what happened during / after each step was taken.


Please help. My response to each step taken is Bold & Underlined beneath each step.



When you encounter these problems, here are some things you can try:

1. Restart your PC

Many times the issue is resolved by simple restart.


This did nothing


2. Remove existing antivirus and antispyware software

If your PC still has another antivirus installed or if one was installed previously then you should use appropriate removal tool to remove all third party antivirus and antispyware programs. You can download removal tools from here:

List of antivirus product removal tools


I installed a ESET product but it did not find any Antivirus or Antispyware programs. Restarted computer but nothing


3. Scan your PC for malwares

This wiki lists out some malware scanners recommended here:

List of Malware Removal Tools


I installed a ESET program to scan for malware. None found, restarted computer but nothing


Start your PC in Safe Mode to perform a scan. http://windows.microsoft.com/en-us/windows-8/windows-startup-settings-safe-mode orhttp://www.howtogeek.com/107511/how-to-boot-into-safe-mode-on-windows-8-the-easy-way/


4. SFC scan

System File Checker (SFC) tool repairs corruption in system files. Use this tool to verify whether Windows Defender is corrupted or not. Follow this KB article:

https://support.microsoft.com/en-us/kb/929833


I also performed this scan, but the system stated all clear. Restarted computer but nothing


5. Clean Boot

Start your PC in clean boot status to ensure any 3rd party application is not conflicting with Windows Defender. Here is a support article that will help you:

How to perform a clean boot to troubleshoot a problem in Windows


I did start the system in Clean Boot Status but Real Time Protection still didnt turn on.


6. Restart Security Center Service

As reported in this and this thread, restarting Security Center service can help in solving the problem. To restart Security Center service, follow these steps:

1. Press Windows key + R. This will open Run. Alternatively, you can go to Start and search for 'Run'.
2. In Run dialog box, type 'services.msc' and hit enter.
3. In Services, search for 'Security Center'.
4. Right click on 'Security Center' and click on 'Restart'.

I restarted the Security Center and then the computer but that didn't work.


7. Delete conflicting Registry Entry

Some malwares adds malicious entries in registry that blocks real antiviruses from running. To remove these entries, follow these steps:

1. Press Windows key + R. This will open Run. Alternatively, you can go to Start and search for 'Run'.
2. In Run dialog box, type 'regedit' and hit enter. This will open Registry Editor.
3. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options.
4. In this key, if you find any entry for MSASCui.exe, MpCmdRun.exe or MsMpEng.exe then right click on it and click on Delete. If you do not find any of these entry then it is normal and you don't need to do anything.

I found the entry MsMpEng.exe and deleted it. Then restarted the computer but nothing.


8. Enabling Windows Defender from Group Policy

Important: You must proceed with this step only after trying all the steps mentioned above.


If you are facing an error like "This app is turned off by Group Policy" then Windows Defender can be manually enabled via registry. Windows Defender is disabled by Windows if it detects presence of another antivirus. Therefore, before enabling it manually, it must be ensured that there are no conflicting softwares and system is not infected. To enable Windows Defender manually, follow these steps:

1. Press Windows key + R. This will open Run. Alternatively, you can go to Start and search for 'Run'.
2. In Run dialog box, type 'regedit' and hit enter. This will open Registry Editor.
3. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
4. If you see a registry entry named DisableAntiSpyware, then change its value to 0. If you don't find this registry key then add this it. To do that, right click on Windows Defender key and go to New > DWORD. Give this DWORD name 'DisableAntiSpyware' and value 0. Registry will then look like this:
   

I went into the registry editor and found the Disable Anti Spyware entry, but it would not let me change the value to 0. Below is a screen shot of the Registry Entry



Continue reading...