Event ID 1005 — Microsoft Antimalware Engine Scan

  • Article

Applies To: Windows Server 2008

A scan is used to invoke the scanning engine and look for spyware and other potentially unwanted software on your computer. Windows Defender can run a quick scan, a full system scan, or a customized scan on a computer:

  • Quick scan - checks only the places on your computer's hard disk that spyware or other potentially unwanted software are most likely to infect.
  • Full scan - checks all of the files on your hard disk and all currently running programs.
  • Customized scan - checks only the drives, files, and folders that you specify.

Event Details

Product: Windows Defender
ID: 1005
Source: Microsoft-Windows-Windows Defender
Version: 1.1
Symbolic Name: MALWAREPROTECTION_SCAN_FAILED
Message: %1 scan has encountered an error and terminated.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9
%tError Code:%b%11
%tError description:%b%12

Resolve

Fix Microsoft Antimalware Engine

To determine how to fix this error condition, examine the error code reported in the event message test.

The event message can report the following error codes:

  • ERR_MP_NOT_FOUND (0x80508019)
  • ERR_MP_NO_MEMORY (0x80508007)
  • ERR_BAD_INPUT_DATA (0x8050800C)
  • ERR_MP_BAD_CONFIGURATION (0x80508020)

To perform these procedures, you must be a member of the Administrators**** group, or you must have been delegated the appropriate authority.

ERR_MP_NOT_FOUND (0x80508019)

This error code indicates that a file or location (for example, a folder or drive) included in the scan does not exist. You should ensure that all drives being scanned are online or have disks inserted. Optionally, you can exclude the files or locations that are not available.

To exclude files or locations in Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click Tools, and then click Options.
  3. Under Advanced Options, click Add.
  4. Browse to the file or location to be excluded, and then click OK.
  5. Repeat steps 2 - 4 for each file or location to be excluded.

ERR_MP_NO_MEMORY (0x80508007)

This error code indicates that your computer is low on resources. You should free up some memory on your computer.

To free up memory on your computer:

  1. Right-click the taskbar, and then click Task Manager.
  2. Click the Applications tab and make sure that the status of all tasks is Running. If any tasks have the status Not responding, you can end the task by clicking End Task.
  3. Click the Processes tab.
  4. Click Memory and investigate processes that are using a lot of memory.
  5. If there are no tasks with the status Not responding or processes that are using a lot of memory, you should restart the computer to free up memory.

Note: You can only end processes that were created by you when logged on as a member of the Users group. To end processes that are running in the context of the SYSTEM account, you must log on to the computer as a member of the Adminstrators group.

ERR_MP_BAD_INPUT_DATA (0x8050800C)

This error code indicates that an internal error has occurred. You should restart your computer.

ERR_MP_BAD_CONFIGURATION (0x80508020)

This error code indicates that there is a configuration issue with Windows Defender. You should update Windows Defender by using Windows Update.

To update Windows Defender by using Windows Update:

  1. Click Start, and then click Control Panel.
  2. Under Security, click Check for Updates.
  3. Select the updates related to Windows Defender, and then click Install.
  4. If there are no updates available for Windows Defender, you should restart your computer to fix the scanning engine.

Verify

A full scan in Windows Defender uses the scanning engine to check all of the files on your hard disk and all currently running programs. If the scanning engine is not working correctly, the full scan will fail.

To perform this procedure, you must be a member of the Users group, or you must have been delegated the appropriate authority.

To verify that the scanning engine is working correctly:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to Scan, and then click Full Scan.
  3. If the full scan completes successfully, the scanning engine is working correctly.

Microsoft Antimalware Engine Scan

Windows Defender