Windows Defender Quick Scan repeatedly stops partway through and asks to be restarted, but restarting does not fix it. Microsoft Safety Scanner also stops unexpectedly without showing an error. Malwarebytes found a few potentially unwanted hijack-related files, but its deeper scan of roughly 700,000 items found nothing, and HitmanPro was also clean. DISM and SFC detected and repaired corrupted system files, yet Defender scans still fail afterward. Attempting to reset Defender definitions returned error 0x80070005, indicating access was denied. Is this likely to be malware, a Windows 11 problem, or something else, and what troubleshooting steps should be tried?
3 Answers
Based on the results, this does not strongly point to an active infection. Defender includes real-time protection that checks files as they are opened or used, and the clean deeper scans from Malwarebytes and HitmanPro are reassuring. The potentially unwanted programs should still be removed, but running repeated quick scans is not usually necessary. This may be a Defender or Windows issue rather than malware.
If the system is otherwise behaving normally and the offline or deep scans are clean, there may not be an infection. Keep real-time protection enabled, remove the detected unwanted files, and avoid installing several security tools at the same time because they can interfere with one another. If Defender continues failing after updates and service checks, repairing or resetting the Windows Security app—or performing an in-place Windows repair—would be more appropriate than repeatedly running scans.
The fact that multiple scanners stop unexpectedly suggests the problem may be related to Windows Defender or a recent service/definition issue. Since DISM and SFC already repaired system files but did not resolve it, check for pending Windows updates and reboot after installing them. You can also verify that the Microsoft Defender Antivirus service is running and that no third-party antivirus or security policy is blocking it. Error 0x80070005 generally means the definition reset was denied access, so it does not prove that malware is present.
I mainly ran the extra scans because I was worried Defender stopping meant something was interfering with it. The other scanners being clean makes a Windows bug seem more likely, but I’ll check updates and the Defender service.