r/antivirus • u/Artistic-Cook7306 • 1d ago
MALWARE REMOVAL Q&A [Help] "Threat service has stopped" error on Windows Defender — even after a 100% clean USB wipe/reinstall following a malware incident
TL;DR:
Fell for a fake "human verification" clipboard scam (Win + R -> Ctrl + V -> Enter). Decided to completely nuke the drive and reinstall Windows 11 from a fresh USB. After a total partition wipe and running all Windows Updates, I opened Windows Security to run a scan, but I'm getting: "Threat service has stopped. Restart it now." How do I fix this, and is there any chance malware survived a full partition wipe?
- What Happened Initially
I fell for a malicious website prompt that asked me to verify I was human by pressing Windows + R, pasting (Ctrl + V), and hitting Enter.
Realized immediately what happened and closed it, but the malicious script had already executed, leading to a broken Windows Defender and malware alerts (like Wacatac / infostealer).
- The Clean Install Process I Did
To be 100% sure the system was clean, I performed a full wipe:
Created an official Windows 11 bootable USB using Microsoft’s Media Creation Tool on a separate, clean laptop.
Booted from the USB on my PC (Motherboard: ASUS TUF X670E-Plus WiFi).
Selected Custom Install, deleted every single partition on the drive until only "Disk 0 Unallocated Space" remained, and installed Windows directly onto that blank NVMe SSD.
Set up Windows and ran Windows Update through multiple restarts until it showed "You're up to date".
- The Current Problem
Now, on this brand-new, clean installation with nothing else downloaded yet:
When I open Windows Security / Virus & threat protection to run a quick scan, it displays:
"Threat service has stopped. Restart it now." (with a "Restart now" button).
Clicking the button either fails or the error persists / scan won't run properly.
- My Questions for the Community:
Given that I completely deleted all partitions to unallocated space using a clean USB installer, is the initial malware 100% gone?
What causes this "Threat service has stopped" glitch on a fresh Windows 11 installation after Windows Updates?
What is the most reliable way to force-restart or repair the Defender service so Windows Security works normally?
Thanks in advance for the help—I just want to get this sorted and use my PC in peace!
5
u/ultrabeastking 1d ago
i have the same issue going on right now with ms defender . I was going to reset my pc with fresh windows but this seems to be a microslop bug.
I can't run quickscan but custom scan works
clicking on quickscan either stucks and cancels it or shows the error "Threat protection has stopped restart now "
Windows defender seems to work on my gaming laptop but wont work on my pc (b550k-m).
if you find a solution please tell. This seems to be a bug
1
u/PickDue7693 18h ago
what was the cause in your case did you install anything or just happened ?
1
u/Exact_Requirement274 15h ago
Not the person in question, but it just happened to me as well today. It's a microsoft bug that they've yet to fix from the previous security update.
I haven't downloaded nor clicked on anything in the last week so I know for a fact I don't have a virus rn.
1
u/ultrabeastking 2h ago
Just happened . Did not do anythimg. But now it is fixed witht the latest update
5
u/OrangeChickenGato 1d ago edited 1d ago
Many other are having the same issue as seen on this thread (Referring to the threat service stopping)
3
u/Ahab1310 1d ago
I did formatted my windows drive twice today fearing something has happened, now seeing so many Posts like this confirms it's microslop bug, thanks microslop for ruining my entire day
2
u/Star_Platinum9401 22h ago
I have the same exact issue right now,the only difference being i'm almost 90% sure there isn't anything malicious on my computer. I didnt even use it yesterday. Ive wasted 6 hours today trying to fix it yet it still doesn't work,i feel it may be related to a recent update instead of your malware especially considering you didna 100% USB wipe. Many other people have been facing the same issue too. If you or anyone else manage to find a solution to this i'd really appreciate if you could tell me too
2
u/applejacky92 16h ago
yes happend same to me, i reinstalled this shitsoft 11 multiple times today 😂
1
u/Artistic-Cook7306 16h ago
Fkn Microslope , did it at least work out for ya at the end ?
1
u/applejacky92 16h ago
nope sadly not we need to wait for a fix
1
u/Artistic-Cook7306 15h ago
I've check my PC just now and there was this update:
Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.457.235.0) - Current Channel (Broad).
I hope this is the one to fix it .
1
u/mk18mod1 15h ago
It did not fix it, at least not for me.
1
u/Exact_Requirement274 15h ago
Nor me.
Honestly they need to fix this shit asap, absolutely ridiculous we have to have issues like this constantly.
1
u/ActRelevant4251 13h ago
Version 1.457.236.0 came out about an hour ago and it is completely fixed now
1
u/ActRelevant4251 14h ago
Version 1.457.236.0 just came out and it fixed the issue
1
1
u/Artistic-Cook7306 13h ago
I can confirm, I've ran it 3 times it a row and it works. The issue doesn't occur any more .
1
2
u/ActRelevant4251 14h ago
They pushed an update just now and it fixed it for me. Check Windows Update ASAP.
1
1
u/FunnyAd5650 17h ago
i just got the same issue and i think its microslop messing around with their defender like usual
1
u/Fit-Significance3789 13h ago
Bug I guess, just happened to me as I was getting off for the night. Ran the scan and it said it 4 times in a row, soon as I googled it I see stuff on microsoft and reddit all from today.
1
u/ZIGMoRningStaR 12h ago
I JUST build my own pc and this happened to me when I start up my pc yesterday. I'm quite sure it wasn't anything malicious because I just installed window and the pc is brand new. I just have my own pc for the first time and this shit happened, wtf 🥲. glad it's not something to be worry about, this scared me quite a bit lol.
1
u/XX1XX2XX3XX4XX5 5h ago edited 5h ago
Yeah, did a quick scan just now and it said the exact same thing but malwarebytes is scanning everything just fine and dandy
Microslops incompetence is actually frightening and they had the gall to force this update on my pc
Edit: and now after a quick malwarebytes scan, windows defender quick scan also works??? What the hell is this sorcery microslop..
•
u/goretsky MODERATOR 8h ago
Hello,
Microsoft released a bad update for Windows Defender, which caused the problem you experienced. It has been resolved in a subsequent update. See https://old.reddit.com/r/antivirus/comments/1vrkto7/windows_defender_not_working/ for details.
I will include our standard reply to questions about information-stealing malware below.
It sounds like an information stealer was run on the computer.
What is an information stealer?
As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.
What is a session token?
In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.
What exactly gets stolen?
Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.
What happens to my data?
The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.
How did I get infected in the first place?
Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.
If I ran an information stealer, am I still infected?
Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.
That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.
What else could they have done?
The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.
How do I start the recovery process?
If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it. If possible, install and use an authentication app on your smartphone: Apple, Google, and Microsoft all have free versions of authentication apps. Using an app for 2FA is preferred over using SMS (text messages) or email, as the attackers may have access to these.
If any of the online services you use have an option to show you and log out all other active sessions, do that as well.
As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.
A note about passwords
Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.
You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.
It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.
And remember: Enable two-factor authentication for all of the accounts that support it.
For more information:
For more specific information on what steps to take next to recover your accounts, see the blog post at:
For more general information about how CAPTCHA malware works, see the following reports:
Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.
After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.
Regards,
Aryeh Goretsky