If you are still on Windows 7, you may have already noticed that there is an anti-malware named : Windows Defender.
However, it's also possible that you have never seen it since the installation of an anti-virus often tends to deactivate this anti-malware built into Windows 7 to prevent Windows Defender and your new anti-virus come into conflict.

1. Windows Defender no longer wants to update
2. Troubleshoot installing Windows Defender definitions updates
3. Update Windows Defender on Windows 7

1. Windows Defender no longer wants to update

In our case, our anti-virus automatically disables Windows Defender.
However, if in your case Windows Defender is still on, you may have already had a message from Windows 7 asking you to update Windows Defender.

So, you click on this message and Windows Defender appears.
Checking for updates for Windows Defender starts.

Windows Defender can find definition updates from the Microsoft Security Portal.

Windows Defender even tries to download them.

Then, Windows Defender shows you that it's not up to date with an orange message asking you to check for updates.
In the "Update Status" section, you will also see this :

Plain Text

The program cannot install definition updates. Error detected: 0x800b0109.
A certificate chain was processed but ended with a root certificate that is not trusted by the trust provider.

2. Troubleshoot installing Windows Defender definitions updates

If you do your research on the Internet, you may come to "Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware" Microsoft's page at some point.
On this page, you will see this paragraph where Microsoft explains that definition updates for Windows Defender are now signed with SHA-2 encryption as of October 21, 2019.

By clicking on the "2019 SHA-2 ..." link on the page mentioned above, you will arrive on the "2019 SHA-2 Code Signing Support requirement for Windows and WSUS" page on the Microsoft site.
On this page, you will find a table indicating that the "KB4474419" and "KB4490628" updates allow you to install the support of the SHA-2 encryption for the digital signature of code (= of programs, drivers, ...).

With these informations, you know that you need to install "KB4474419" and "KB4490628" updates to fix this issue on Windows 7.
To download them manually, go to the Microsoft Update Catalog (official site) :

• KB4474419 updates
• KB4490628 updates

On this site, find the updates corresponding to the "Windows 7" product and each time choose the update for your Windows 7 architecture :

• x86 : 32-bit
• x64 : 64-bit

Once the updates are downloaded, you will have 2 ".msu" files like this.

Double click on the "windows6.1-kb4474419-...msu" file to install it and validate by clicking on Yes.

Wait while this update is installed.

After the update is installed, click Close.

Start the installation of the other update (KB4490628).

Now, click on "Restart now" to finish installing these 2 Windows updates.

While Windows is shutting down, this message will be displayed :

Plain Text

Step 1 of 2
Configuring Windows Updates
xx% completed
Do not turn off your computer

Then, the computer will restart and the Windows 7 logo will appear.

Then, this message will be displayed :

Plain Text

Step 2 of 2
Preparing to configure Windows.
Do not turn off your computer

Then, this other message will appear.

Plain Text

Step 2 of 2
Configuring Windows Updates
xx% completed
Do not turn off your computer.

3. Update Windows Defender on Windows 7

Once back in Windows 7, search "Defender" in the start menu and launch the "Windows Defender" program.

Click on the "Check for updates now" button.

Wait while checking for updates.

Windows Defender downloads new definition updates from the Microsoft Security Portal.

Then, Windows Defender installs the new downloaded updates.

As you can see, the "Your program is up-to-date" message is displayed and the spyware definition downloaded is one day old.
Which means Microsoft continues to provide updates for Windows Defender on Windows 7.