Share via


Windows Defender Events

 

Updated: November 9, 2015

Windows Defender Events

EventID

Symbol

Description

2000

MALWAREPROTECTION_SIGNATURE_UPDATED

The antimalware definitions updated successfully.

2001

MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED

The antimalware definition update failed.

2002

MALWAREPROTECTION_ENGINE_UPDATED

The antimalware engine updated successfully.

2003

MALWAREPROTECTION_ENGINE_UPDATE_FAILED

The antimalware engine update failed.

2004

MALWAREPROTECTION_SIGNATURE_REVERSION

There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions.

2005

MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE

The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update.

2006

MALWAREPROTECTION_PLATFORM_UPDATE_FAILED

The platform update failed.

2007

MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE

The platform will soon be out of date. Download the latest platform to maintain up-to-date protection.

2010

MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED

The antimalware engine used the Dynamic Signature Service to get additional definitions.

2011

MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED

The Dynamic Signature Service deleted the out-of-date dynamic definitions.

2012

MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED

The antimalware engine encountered an error when trying to use the Dynamic Signature Service.

2013

MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL

The Dynamic Signature Service deleted all dynamic definitions.

2020

MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED

The antimalware engine downloaded a clean file.

2021

MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED

The antimalware engine failed to download a clean file.

2030

MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED

The antimalware engine was downloaded and is configured to run offline on the next system restart.

2031

MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED

The antimalware engine was unable to download and configure an offline scan.

2040

MALWAREPROTECTION_OS_EXPIRING

Antimalware support for this operating system version will soon end.

2041

MALWAREPROTECTION_OS_EOL

Antimalware support for this operating system has ended. You must upgrade the operating system for continued support.

2042

MALWAREPROTECTION_PROTECTION_EOL

The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware.

1000

MALWAREPROTECTION_SCAN_STARTED

An antimalware scan started.

1001

MALWAREPROTECTION_SCAN_COMPLETED

An antimalware scan finished.

1002

MALWAREPROTECTION_SCAN_CANCELLED

An antimalware scan was stopped before it finished.

1003

MALWAREPROTECTION_SCAN_PAUSED

An antimalware scan was paused.

1004

MALWAREPROTECTION_SCAN_RESUMED

An antimalware scan was resumed.

1005

MALWAREPROTECTION_SCAN_FAILED

An antimalware scan failed.

1006

MALWAREPROTECTION_MALWARE_DETECTED

The antimalware engine found malware or other potentially unwanted software.

1007

MALWAREPROTECTION_MALWARE_ACTION_TAKEN

The antimalware platform performed an action to protect your system from malware or other potentially unwanted software.

1008

MALWAREPROTECTION_MALWARE_ACTION_FAILED

The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.

1009

MALWAREPROTECTION_QUARANTINE_RESTORE

The antimalware platform restored an item from quarantine.

1010

MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED

The antimalware platform could not restore an item from quarantine.

1011

MALWAREPROTECTION_QUARANTINE_DELETE

The antimalware platform deleted an item from quarantine.

1012

MALWAREPROTECTION_QUARANTINE_DELETE_FAILED

The antimalware platform could not delete an item from quarantine.

1013

MALWAREPROTECTION_MALWARE_HISTORY_DELETE

The antimalware platform deleted history of malware and other potentially unwanted software.

1014

MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED

The antimalware platform could not delete history of malware and other potentially unwanted software.

1015

MALWAREPROTECTION_BEHAVIOR_DETECTED

The antimalware platform detected suspicious behavior.

1116

MALWAREPROTECTION_STATE_MALWARE_DETECTED

The antimalware platform detected malware or other potentially unwanted software.

1117

MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN

The antimalware platform performed an action to protect your system from malware or other potentially unwanted software

1118

MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED

The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed.

1119

MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED

The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message.

1150

MALWAREPROTECTION_SERVICE_HEALTHY

If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state.

3002

MALWAREPROTECTION_RTP_FEATURE_FAILURE

Real-time protection encountered an error and failed.

3007

MALWAREPROTECTION_RTP_FEATURE_RECOVERED

Real-time protection recovered from a failure. We recommend running a full system scan when you see this error.

5000

MALWAREPROTECTION_RTP_ENABLED

Real-time protection is enabled.

5001

MALWAREPROTECTION_RTP_DISABLED

Real-time protection is disabled.

5004

MALWAREPROTECTION_RTP_FEATURE_CONFIGURED

The real-time protection configuration changed.

5007

MALWAREPROTECTION_CONFIG_CHANGED

The antimalware platform configuration changed.

5008

MALWAREPROTECTION_ENGINE_FAILURE

The antimalware engine encountered an error and failed.

5009

MALWAREPROTECTION_ANTISPYWARE_ENABLED

Scanning for malware and other potentially unwanted software is enabled.

5010

MALWAREPROTECTION_ANTISPYWARE_DISABLED

Scanning for malware and other potentially unwanted software is disabled.

5011

MALWAREPROTECTION_ANTIVIRUS_ENABLED

Scanning for viruses is enabled.

5012

MALWAREPROTECTION_ANTIVIRUS_DISABLED

Scanning for viruses is disabled.

5100

MALWAREPROTECTION_EXPIRATION_WARNING_STATE

The antimalware platform will expire soon.

5101

MALWAREPROTECTION_DISABLED_EXPIRED_STATE

The antimalware platform is expired.