Microsoft Antimalware Engine Scan

Applies To: Windows Server 2008 R2

A scan is used to invoke the scanning engine and look for spyware and other potentially unwanted software on your computer. Windows Defender can run a quick scan, a full system scan, or a customized scan on a computer:

  • Quick scan - checks only the places on your computer's hard disk that spyware or other potentially unwanted software are most likely to infect.
  • Full scan - checks all of the files on your hard disk and all currently running programs.
  • Customized scan - checks only the drives, files, and folders that you specify.

Events

Event ID Source Message

1000

Microsoft-Windows-Windows Defender

%1 scan has started.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9

1001

Microsoft-Windows-Windows Defender

%1 scan has finished.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9
%tScan Time:%b%11:%12:%13

1002

Microsoft-Windows-Windows Defender

%1 scan has been stopped before completion.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9

1003

Microsoft-Windows-Windows Defender

%1 scan has been paused.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9

1004

Microsoft-Windows-Windows Defender

%1 scan has resumed.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9

1005

Microsoft-Windows-Windows Defender

%1 scan has encountered an error and terminated.
%tScan ID:%b%3
%tScan Type:%b%5
%tScan Parameters:%b%7
%tUser:%b%8\%9
%tError Code:%b%11
%tError description:%b%12

Microsoft Antimalware Engine

Core Security