Computer virus

Question

I believe my computer has a virus. It trys to install this update but can't. KB2267602 (Version 1.445.664.0) - Current Channel (Broad)

Answer 1

Hi Mike Reinman,

I understand why this situation can be concerning, especially when an update fails and raises worries about a possible virus. I’d like to reassure you that the update you’re seeing (KB2267602) is a regular Microsoft Defender security intelligence update, and a failure to install it on its own does not necessarily indicate an infection.

To help clarify what’s going on, please try the steps below in order:

Step 1: Run a Microsoft Defender scan

Open Windows Security from the Start menu and select Virus & threat protection. Choose Quick scan to check the most common locations where threats are found. If you’d like additional reassurance, you can select Scan options > Full scan, which checks all files and running programs. This helps confirm whether any active threats are currently present on the system.

Step 2: Manually check Defender protection updates

In Windows Security > Virus & threat protection, select Protection updates, then choose Check for updates. This uses Microsoft Defender’s built‑in update mechanism, which is separate from standard Windows Update and often works even when a specific KB update shows as failed.

Step 3: Run a Microsoft Defender Offline scan (optional)

If you’re still concerned, you can run a Microsoft Defender Offline scan from Scan options in Windows Security. This scan restarts the computer and checks for threats before Windows fully loads, which can help rule out harder‑to‑detect malware.

After completing the steps above, return to Protection updates and review the Security intelligence version and Last updated date. If the date is recent, Defender is actively protecting your system, even if one update attempt previously failed.

Step 4: Repair Windows system files

If the update continues to fail, the issue may be related to corrupted or missing Windows system files that Defender relies on. Windows includes built‑in tools to safely check and repair these files.

Open Command Prompt as administrator

• Type cmd in the search box
  • Right‑click Command Prompt and select Run as administrator

1. Run the following DISM command:

      DISM /Online /Cleanup-Image /RestoreHealth
   

   This checks the Windows component store and repairs it if needed. The process may take several minutes and may appear to pause—this is normal.
2. After DISM completes, run:

      sfc /scannow
   

   These scans protected system files and replaces any corrupted versions.

Once both commands finish, please restart the computer and check Windows Update again to see if the Defender update installs successfully.

If the scans come back clean and the security intelligence shows as recently updated, the issue is most likely related to the update process itself rather than malware. These Defender updates are released frequently, and it’s not uncommon for an individual update attempt to fail and then resolve on a later check.

Please let me know the results of the scans and whether the update succeeds after these steps. I’ll be happy to assist you further if the issue continues.

---

If you have any further questions about this answer, please click "Comment".

Note: If you would like to receive email notifications on this topic, please follow the steps in our documentation to enable email notifications.

Answer 2

The failed installation of KB2267602 (Microsoft Defender Antivirus platform/definitions) does not by itself confirm a virus infection. It is a common Windows Security/Defender update and can fail for non‑malicious reasons.

From the provided context, when malware is actually present (for example, the Win32/Conficker worm), removal involves:

1. Installing the relevant security update from a clean machine if the infected PC cannot reach Microsoft sites.
2. Transferring the update via read‑only media (CD preferred; USB only if switched to read‑only and checked for Autorun.inf infection).
3. Resetting local and domain administrator passwords to strong new values.
4. Checking the registry for suspicious services under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost → netsvcs value, and comparing against a known‑clean system to identify malware‑added services.

If there is concern that the system is infected:

• Use a known‑clean computer to download any required security updates or tools.
• Transfer them using media that can be made read‑only and verify no Autorun.inf has been added.
• After remediation, change all administrator passwords.

If the issue is only that KB2267602 fails to install and there are no other signs of infection, the failure is not enough evidence from this context to classify the system as infected.

---

References:

• Virus alert about the Win32/Conficker worm