Errors and events reference

Article
09/02/2010

Applies To: Forefront Client Security

The following tables list error codes and event IDs used by Client Security. The entries in the Reference column link directly to the topic in the Microsoft Forefront Client Security Troubleshooting Guide (https://go.microsoft.com/fwlink/?LinkId=86100), where the specific issue is discussed. The Troubleshooting Guide includes descriptions of the errors and events, including their causes and resolutions.

Error codes	Reference
3010	Setup wizard issues (https://go.microsoft.com/fwlink/?LinkID=86102)
0x80026C4A	Setup wizard issues (https://go.microsoft.com/fwlink/?LinkID=86102)
1303	Setup wizard issues (https://go.microsoft.com/fwlink/?LinkID=86102)
1920	Public Beta expiry issues (https://go.microsoft.com/fwlink/?LinkID=86103)
1603	Public Beta expiry issues (https://go.microsoft.com/fwlink/?LinkID=86103)
0x80070005	Client Security UI issues (https://go.microsoft.com/fwlink/?LinkID=86104)
0x80080017	Client Security UI issues (https://go.microsoft.com/fwlink/?LinkID=86104)
0x80080005	Troubleshooting definitions (https://go.microsoft.com/fwlink/?LinkId=86105)

Event ID	Reference
81	Post-installation issues (https://go.microsoft.com/fwlink/?LinkID=86106)
3002	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
3004	3004 detection events (https://go.microsoft.com/fwlink/?LinkId=86108)
3006	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
5000	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
5001	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
9029	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
10002	Post-installation issues (https://go.microsoft.com/fwlink/?LinkID=86106)
10004	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
10008	Public Beta expiry issues (https://go.microsoft.com/fwlink/?LinkID=86103)
10016	Post-installation issues (https://go.microsoft.com/fwlink/?LinkID=86106)
10069	Console issues (https://go.microsoft.com/fwlink/?LinkId=86109)
10096	Console issues (https://go.microsoft.com/fwlink/?LinkId=86109)
11724	Events (https://go.microsoft.com/fwlink/?LinkId=86110)
21268	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
21269	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
21711	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
22061	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
25100	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)
26017	Working with Microsoft Operations Manager (https://go.microsoft.com/fwlink/?LinkId=86107)

The following table is a global event list for Forefront Client Security.

Event ID	Event type	Event name	Explanation	User action
1000	Information	MALWAREPROTECTION_SCAN_STARTED	Microsoft Forefront Client Security has started a scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, and user that started the scan. This event commonly occurs when a user or scheduled event starts a scan.	None needed.
1001	Information	MALWAREPROTECTION_SCAN_COMPLETED	Microsoft Forefront Client Security has completed a scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, and the amount of time the scan took to complete. This event commonly occurs when a user-initiated or scheduled scan is complete.	None needed.
1002	Warning	MALWAREPROTECTION_SCAN_CANCELLED	A Microsoft Forefront Client Security scan has been stopped before being completed. This is likely due to a user canceling an in-progress scan. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, and the amount of time the scan took to complete. This event occurs when a user-initiated or scheduled scan is terminated before it completes.	Restart the scan when possible.
1005	Error	MALWAREPROTECTION_SCAN_FAILED	Microsoft Forefront Client Security has encountered an error and terminated. This error record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, the error code, and a description of the error.	Look up the error code and determine the course of action.
1006	Warning	MALWAREPROTECTION_SCAN_MALWARE_DETECTED	A Microsoft Forefront Client Security scan has detected spyware or other potentially unwanted software. This audit record includes the scan ID, type of scan (Antivirus, Antispyware, Antimalware), scan parameters, user that started the scan, name of the potentially malware, threat ID, severity ID, category ID, and path of the potential malware.	Perform the desired action on the threat.
1007	Information	MALWAREPROTECTION_SCAN_MALWARE_ACTION_TAKEN	Microsoft Forefront Client Security has taken action to help protect this machine from spyware or other potentially unwanted software. This audit record includes the scan ID, scan type, scan parameters, user that started the scan, threat name, threat ID, severity ID, category ID, and the action taken (clean, remove, quarantine, ignore, ignore always, or block). This event occurs when an action is taken on detected potential malware.	None needed.
1008	Error	MALWAREPROTECTION_MALWARE_ACTION_FAILED	Microsoft Forefront Client Security has encountered an error while taking action on potential malware. This audit record includes the scan ID, scan type, scan parameters, user that started the scan, threat name, threat ID, severity ID, category ID, action taken (clean, remove, quarantine, ignore, ignore always, or block), error code, and a description of the encountered error.	Look up the error code and determine the course of action.
1009	Information	MALWAREPROTECTION_QUARANTINE_RESTORE	An item was restored from quarantine.	None needed.
1010	Error	MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED	An item was attempted to be restored from quarantine, but the restore could not be completed.	Look up the error code and determine the course of action.
2000	Informational	MALWAREPROTECTION_SIGNATURE_UPDATED	Microsoft Forefront Client Security signature version has been updated. This event occurs when updates are available and downloaded onto the local system. You can configure automatic checking and configuration to change the frequency of definition updates. This audit record includes the definition version after the update, definition version before the update, update source (schedule, user request, or definition update folder), definition type (Antivirus/Antispyware), update type (full definition refresh or minor update), current engine version, and previous engine version.	None needed.
2001	Error	MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED	Microsoft Forefront Client Security has encountered an error trying to update signatures. This audit record includes the current definition version, the definition version before attempting the failed update, error code, and a description of the error. This error could occur due to network connectivity issues while trying to update definitions.	Resolve the connectivity issues and try updating again.
2002	Informational	MALWAREPROTECTION_ENGINE_UPDATED	The Microsoft Forefront Client Security engine version has been updated. This event occurs when Microsoft Forefront Client Security is updated. This audit record includes the current engine version, the engine version before the update, the update source (Schedule, User Request or Definition Update Folder), and the user that started the application. This event occurs when a software update is available and installed.	None needed.
2003	Error	MALWAREPROTECTION_ENGINE_UPDATE_FAILED	The Microsoft Forefront Client Security encountered an error trying to update the engine. This event occurs when Microsoft Forefront Client Security tries to update itself but fails. This error record includes the current engine version, the engine version before the update, the update source (Schedule, User Request or Definition Update Folder), the user that started the application, the error code, and a description of the error. This event commonly occurs due to a connectivity break in the middle of an update.	Resolve the connectivity issues and try updating again.
2004	Error	MALWAREPROTECTION_SIGNATURE_REVERSION	Microsoft Forefront Client Security has encountered an error trying to load the definitions and will attempt reverting back to a known-good set of definitions.	Re-download the latest definitions from the Microsoft Malware Protection Center (https://go.microsoft.com/fwlink/?LinkID=200965).
3000	Informational	MALWAREPROTECTION_RTP_STARTED	Microsoft Forefront Client Security Real-Time Protection agents have started. This audit record includes the user that caused the agents to start. This event commonly occurs when Real-Time Protection starts; if Real-Time Protection is configured to automatically start, this is when the computer starts.	None needed.
3001	Informational	MALWAREPROTECTION_RTP_STOPPED	Microsoft Forefront Client Security Real-Time Protection agents have stopped. This audit record includes the user that caused the agents to stop. This event occurs when someone stops the Real-Time Protection agents.	Verify that the Real-Time Protection agents have been intentionally stopped. Restart Microsoft Forefront Client Security Real-Time Protection to turn the agents on again.
3002	Error	MALWAREPROTECTION_RTP_AGENT_FAILURE	Microsoft Forefront Client Security Real-Time Protection agents have encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.	The event description will contain additional information about the error encountered.
3003	Error	MALWAREPROTECTION_RTP_CHECKPOINT_FAILURE	A Microsoft Forefront Client Security Real-Time Protection checkpoint has encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.	The event description will contain additional information about the error encountered.
3004	Warning	MALWAREPROTECTION_RTP_MALWARE_DETECTED	The Microsoft Forefront Client Security Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or software publisher. Microsoft Forefront Client Security can’t undo changes that you allow.	Perform one of the following actions on the detected threat: Clean Remove Quarantine Ignore Ignore Always Block
3005	Informational	MALWAREPROTECTION_RTP_MALWARE_ACTION_TAKEN	Microsoft Forefront Client Security Real-Time Protection agent has taken action to help protect this machine from spyware or other potentially unwanted software.	None needed.
3006	Error	MALWAREPROTECTION_RTP_MALWARE_ACTION_FAILED	Microsoft Forefront Client Security has encountered an error when taking action on spyware or other potentially unwanted software.	The event description will contain additional information about the error encountered.
3007	Informational	MALWAREPROTECTION_RTP_AGENT_RECOVERED	Microsoft Forefront Client Security Real-time Protection Agent has restarted.	It is recommended that you run a full system scan to detect any items that were missed while the agent was not functioning.
3008	Error	MALWAREPROTECTION_RTP_STARTUP_FAILED	Microsoft Forefront Client Security Real-Time Protection has encountered an error and failed to start. This error event includes the agent that was unable to start, the error code, and a description of the error.	The event description will contain additional information about the error encountered.
Controlled by Service Configuration Manager	Informational	MALWAREPROTECTION_SERVICE_STARTED	The Microsoft Forefront Client Security service has started.	None needed.
Controlled by Service Configuration Manager	Warning	MALWAREPROTECTION_SERVICE_STOPPED	The Microsoft Forefront Client Security service has stopped.	Verify that the Microsoft Forefront Client Security service has been intentionally disabled.
5000	Informational	MALWAREPROTECTION_RTP_ENABLED	Microsoft Forefront Client Security Real-Time Protection scanning for spyware or other potentially unwanted software was enabled.	None needed.
5001	Informational	MALWAREPROTECTION_RTP_DISABLED	Microsoft Forefront Client Security Real-Time Protection scanning for spyware or other potentially unwanted software was disabled.	Verify that the Microsoft Forefront Client Security Real-time protection has been intentionally disabled.
5002	Informational	MALWAREPROTECTION_ONACCESS_ENABLED	Microsoft Forefront Client Security OnAccess scanning for viruses was enabled.	None needed.
5003	Informational	MALWAREPROTECTION_ONACCESS_DISABLED	Microsoft Forefront Client Security OnAccess scanning for viruses was disabled.	Verify that On-Access scanning was intentionally disabled.
5004	Informational	MALWAREPROTECTION_RTP_AGENT_CONFIGURED	The Microsoft Forefront Client Security Real-Time Protection agent configuration has changed. This audit record includes the agent and the configuration element that have been changed. This event commonly occurs due to configuration changes by an administrator or user. This could indicate that malware has caused a configuration change.	Verify that the configuration change was applied intentionally.
5005	Informational	MALWAREPROTECTION_RTP_CHECKPOINT_CONFIGURED	The Microsoft Forefront Client Security Real-Time Protection checkpoint configuration has changed. This audit log includes the checkpoint and configuration element that have changed. This event commonly occurs after an administrator makes configuration changes.	Verify that the configuration change was applied intentionally.
5006	Error	MALWAREPROTECTION_ONACCESS_FILTER_UNLOADED	The Microsoft Forefront Client Security Antivirus OnAccess Filter is unloaded and OnAccess scanning is disabled.	Restart the Antivirus OnAccess Filter service.
5007	Informational	MALWAREPROTECTION_CONFIG_CHANGED	Microsoft Forefront Client Security Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.	Verify the changes are intentional.
5008	Error	MALWAREPROTECTION_ENGINE_FAILURE	Microsoft Forefront Client Security engine has been terminated due to an unexpected error.	The event description will contain additional information about the error encountered.
5009	Informational	MALWAREPROTECTION_ANTISPYWARE_ENABLED	Microsoft Forefront Client Security scanning for spyware and other potentially unwanted software has been enabled.	None needed.
5010	Informational	MALWAREPROTECTION_ANTISPYWARE_DISABLED	Microsoft Forefront Client Security scanning for spyware and other potentially unwanted software is disabled.	Verify that scanning for spyware has been intentionally disabled.
5011	Informational	MALWAREPROTECTION_ANTIVIRUS_ENABLED	Microsoft Forefront Client Security scanning for viruses has been enabled.	None needed.
5012	Informational	MALWAREPROTECTION_ANTIVIRUS_DISABLED	Microsoft Forefront Client Security scanning for viruses has been disabled.	Verify that scanning for viruses has been intentionally disabled.

Errors and events reference

Additional resources