Export (0) Print
Expand All

Errors and events reference

Published: December 16, 2009

Applies To: Forefront Client Security

The following tables list error codes and event IDs used by Client Security. The entries in the Reference column link directly to the topic in the Microsoft Forefront Client Security Troubleshooting Guide (http://go.microsoft.com/fwlink/?LinkId=86100), where the specific issue is discussed. The Troubleshooting Guide includes descriptions of the errors and events, including their causes and resolutions.

 

Error codes Reference

3010

Setup wizard issues (http://go.microsoft.com/fwlink/?LinkID=86102)

0x80026C4A

Setup wizard issues (http://go.microsoft.com/fwlink/?LinkID=86102)

1303

Setup wizard issues (http://go.microsoft.com/fwlink/?LinkID=86102)

1920

Public Beta expiry issues

(http://go.microsoft.com/fwlink/?LinkID=86103)

1603

Public Beta expiry issues

(http://go.microsoft.com/fwlink/?LinkID=86103)

0x80070005

Client Security UI issues (http://go.microsoft.com/fwlink/?LinkID=86104)

0x80080017

Client Security UI issues (http://go.microsoft.com/fwlink/?LinkID=86104)

0x80080005

Troubleshooting definitions (http://go.microsoft.com/fwlink/?LinkId=86105)

 

Event ID Reference

81

Post-installation issues

(http://go.microsoft.com/fwlink/?LinkID=86106)

3002

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

3004

3004 detection events

(http://go.microsoft.com/fwlink/?LinkId=86108)

3006

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

5000

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

5001

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

9029

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

10002

Post-installation issues

(http://go.microsoft.com/fwlink/?LinkID=86106)

10004

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

10008

Public Beta expiry issues

(http://go.microsoft.com/fwlink/?LinkID=86103)

10016

Post-installation issues

(http://go.microsoft.com/fwlink/?LinkID=86106)

10069

Console issues

(http://go.microsoft.com/fwlink/?LinkId=86109)

10096

Console issues

(http://go.microsoft.com/fwlink/?LinkId=86109)

11724

Events

(http://go.microsoft.com/fwlink/?LinkId=86110)

21268

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

21269

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

21711

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

22061

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

25100

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

26017

Working with Microsoft Operations Manager

(http://go.microsoft.com/fwlink/?LinkId=86107)

The following table is a global event list for Forefront Client Security.

 

Event ID Event type Event name Explanation User action

1000

Information

MALWAREPROTECTION_SCAN_STARTED

Microsoft Forefront Client Security has started a scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, and user that started the scan. This event commonly occurs when a user or scheduled event starts a scan.

None needed.

1001

Information

MALWAREPROTECTION_SCAN_COMPLETED

Microsoft Forefront Client Security has completed a scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, and the amount of time the scan took to complete. This event commonly occurs when a user-initiated or scheduled scan is complete.

None needed.

1002

Warning

MALWAREPROTECTION_SCAN_CANCELLED

A Microsoft Forefront Client Security scan has been stopped before being completed. This is likely due to a user canceling an in-progress scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, and the amount of time the scan took to complete. This event occurs when a user-initiated or scheduled scan is terminated before it completes.

Restart the scan when possible.

1005

Error

MALWAREPROTECTION_SCAN_FAILED

Microsoft Forefront Client Security has encountered an error and terminated. This error record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, the error code, and a description of the error.

Look up the error code and determine the course of action.

1006

Warning

MALWAREPROTECTION_SCAN_MALWARE_DETECTED

A Microsoft Forefront Client Security scan has detected spyware or other potentially unwanted software. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, name of the potentially malware, threat ID, severity ID, category ID, and path of the potential malware.

Perform the desired action on the threat.

1007

Information

MALWAREPROTECTION_SCAN_MALWARE_ACTION_TAKEN

Microsoft Forefront Client Security has taken action to help protect this machine from spyware or other potentially unwanted software. This audit record includes the scan ID, scan type, scan parameters, user that started the scan, threat name, threat ID, severity ID, category ID, and the action taken (clean, remove, quarantine, ignore, ignore always, or block). This event occurs when an action is taken on detected potential malware.

None needed.

1008

Error

MALWAREPROTECTION_MALWARE_ACTION_FAILED

Microsoft Forefront Client Security has encountered an error while taking action on potential malware. This audit record includes the scan ID, scan type, scan parameters, user that started the scan, threat name, threat ID, severity ID, category ID, action taken (clean, remove, quarantine, ignore, ignore always, or block), error code, and a description of the encountered error.

Look up the error code and determine the course of action.

1009

Information

MALWAREPROTECTION_QUARANTINE_RESTORE

An item was restored from quarantine.

None needed.

1010

Error

MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED

An item was attempted to be restored from quarantine, but the restore could not be completed.

Look up the error code and determine the course of action.

2000

Informational

MALWAREPROTECTION_SIGNATURE_UPDATED

Microsoft Forefront Client Security signature version has been updated. This event occurs when updates are available and downloaded onto the local system. You can configure automatic checking and configuration to change the frequency of definition updates. This audit record includes the definition version after the update, definition version before the update, update source (schedule, user request, or definition update folder), definition type (Antivirus/Antispyware), update type (full definition refresh or minor update), current engine version, and previous engine version.

None needed.

2001

Error

MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED

Microsoft Forefront Client Security has encountered an error trying to update signatures. This audit record includes the current definition version, the definition version before attempting the failed update, error code, and a description of the error. This error could occur due to network connectivity issues while trying to update definitions.

Resolve the connectivity issues and try updating again.

2002

Informational

MALWAREPROTECTION_ENGINE_UPDATED

The Microsoft Forefront Client Security engine version has been updated. This event occurs when Microsoft Forefront Client Security is updated. This audit record includes the current engine version, the engine version before the update, the update source (Schedule, User Request or Definition Update Folder), and the user that started the application. This event occurs when a software update is available and installed.

None needed.

2003

Error

MALWAREPROTECTION_ENGINE_UPDATE_FAILED

The Microsoft Forefront Client Security encountered an error trying to update the engine. This event occurs when Microsoft Forefront Client Security tries to update itself but fails. This error record includes the current engine version, the engine version before the update, the update source (Schedule, User Request or Definition Update Folder), the user that started the application, the error code, and a description of the error. This event commonly occurs due to a connectivity break in the middle of an update.

Resolve the connectivity issues and try updating again.

2004

Error

MALWAREPROTECTION_SIGNATURE_REVERSION

Microsoft Forefront Client Security has encountered an error trying to load the definitions and will attempt reverting back to a known-good set of definitions.

Re-download the latest definitions from the Microsoft Malware Protection Center (http://go.microsoft.com/fwlink/?LinkID=200965).

3000

Informational

MALWAREPROTECTION_RTP_STARTED

Microsoft Forefront Client Security Real-Time Protection agents have started. This audit record includes the user that caused the agents to start. This event commonly occurs when Real-Time Protection starts; if Real-Time Protection is configured to automatically start, this is when the computer starts.

None needed.

3001

Informational

MALWAREPROTECTION_RTP_STOPPED

Microsoft Forefront Client Security Real-Time Protection agents have stopped. This audit record includes the user that caused the agents to stop. This event occurs when someone stops the Real-Time Protection agents.

Verify that the Real-Time Protection agents have been intentionally stopped. Restart Microsoft Forefront Client Security Real-Time Protection to turn the agents on again.

3002

Error

MALWAREPROTECTION_RTP_AGENT_FAILURE

Microsoft Forefront Client Security Real-Time Protection agents have encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.

The event description will contain additional information about the error encountered.

3003

Error

MALWAREPROTECTION_RTP_CHECKPOINT_FAILURE

A Microsoft Forefront Client Security Real-Time Protection checkpoint has encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.

The event description will contain additional information about the error encountered.

3004

Warning

MALWAREPROTECTION_RTP_MALWARE_DETECTED

The Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or software publisher. Microsoft Forefront Client Security can’t undo changes that you allow.

Perform one of the following actions on the detected threat:

  • Clean

  • Remove

  • Quarantine

  • Ignore

  • Ignore Always

  • Block

3005

Informational

MALWAREPROTECTION_RTP_MALWARE_ACTION_TAKEN

Microsoft Forefront Client Security Real-Time Protection agent has taken action to help protect this machine from spyware or other potentially unwanted software.

None needed.

3006

Error

MALWAREPROTECTION_RTP_MALWARE_ACTION_FAILED

Microsoft Forefront Client Security has encountered an error when taking action on spyware or other potentially unwanted software.

The event description will contain additional information about the error encountered.

3007

Informational

MALWAREPROTECTION_RTP_AGENT_RECOVERED

Microsoft Forefront Client Security Real-time Protection Agent has restarted.

It is recommended that you run a full system scan to detect any items that were missed while the agent was not functioning.

3008

Error

MALWAREPROTECTION_RTP_STARTUP_FAILED

Microsoft Forefront Client Security Real-Time Protection has encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.

The event description will contain additional information about the error encountered.

Controlled by Service Configuration Manager

Informational

MALWAREPROTECTION_SERVICE_STARTED

The Microsoft Forefront Client Security service has started.

None needed.

Controlled by Service Configuration Manager

Warning

MALWAREPROTECTION_SERVICE_STOPPED

The Microsoft Forefront Client Security service has stopped.

Verify that the Microsoft Forefront Client Security service has been intentionally disabled.

5000

Informational

MALWAREPROTECTION_RTP_ENABLED

Microsoft Forefront Client Security Real-Time Protection scanning for spyware or other potentially unwanted software was enabled.

None needed.

5001

Informational

MALWAREPROTECTION_RTP_DISABLED

Microsoft Forefront Client Security Real-Time Protection scanning for spyware or other potentially unwanted software was disabled.

Verify that the Microsoft Forefront Client Security Real-time protection has been intentionally disabled.

5002

Informational

MALWAREPROTECTION_ONACCESS_ENABLED

Microsoft Forefront Client Security OnAccess scanning for viruses was enabled.

None needed.

5003

Informational

MALWAREPROTECTION_ONACCESS_DISABLED

Microsoft Forefront Client Security OnAccess scanning for viruses was disabled.

Verify that On-Access scanning was intentionally disabled.

5004

Informational

MALWAREPROTECTION_RTP_AGENT_CONFIGURED

The Microsoft Forefront Client Security Real-Time Protection agent configuration has changed. This audit record includes the agent and the configuration element that have been changed. This event commonly occurs due to configuration changes by an administrator or user. This could indicate that malware has caused a configuration change.

Verify that the configuration change was applied intentionally.

5005

Informational

MALWAREPROTECTION_RTP_CHECKPOINT_CONFIGURED

The Microsoft Forefront Client Security Real-Time Protection checkpoint configuration has changed. This audit log includes the checkpoint and configuration element that have changed. This event commonly occurs after an administrator makes configuration changes.

Verify that the configuration change was applied intentionally.

5006

Error

MALWAREPROTECTION_ONACCESS_FILTER_UNLOADED

The Microsoft Forefront Client Security Antivirus OnAccess Filter is unloaded and OnAccess scanning is disabled.

Restart the Antivirus OnAccess Filter service.

5007

Informational

MALWAREPROTECTION_CONFIG_CHANGED

Microsoft Forefront Client Security Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.

Verify the changes are intentional.

5008

Error

MALWAREPROTECTION_ENGINE_FAILURE

Microsoft Forefront Client Security engine has been terminated due to an unexpected error.

The event description will contain additional information about the error encountered.

5009

Informational

MALWAREPROTECTION_ANTISPYWARE_ENABLED

Microsoft Forefront Client Security scanning for spyware and other potentially unwanted software has been enabled.

None needed.

5010

Informational

MALWAREPROTECTION_ANTISPYWARE_DISABLED

Microsoft Forefront Client Security scanning for spyware and other potentially unwanted software is disabled.

Verify that scanning for spyware has been intentionally disabled.

5011

Informational

MALWAREPROTECTION_ANTIVIRUS_ENABLED

Microsoft Forefront Client Security scanning for viruses has been enabled.

None needed.

5012

Informational

MALWAREPROTECTION_ANTIVIRUS_DISABLED

Microsoft Forefront Client Security scanning for viruses has been disabled.

Verify that scanning for viruses has been intentionally disabled.

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft