Event message when Windows Defender scans a computer: "Event 3004 (MALWAREPROTECTION_RTP_MALWARE_DETECTED)"

Article translations Article translations
Article ID: 925545 - View products that this article applies to.



Windows Live OneCare is no longer available for sale

Existing subscribers will continue to be supported throughout the term of their subscriptions. Existing subscribers can reinstall by following the steps to download a trial, and can still add a PC to their existing OneCare circle.

Learn more about end of sale for OneCare.

On September 29th 2009, Microsoft introduced Microsoft Security Essentials, a FREE consumer anti-malware solution for Genuine Windows based PCs.

Learn more about Microsoft Security Essentials or download from Microsoft directly at: http://www.microsoft.com/security_essentials/default.aspx.



Expand all | Collapse all

Symptoms

When Microsoft Windows Defender scans a computer for possible malicious third-party programs and other forms of malware, you may receive the following event message:

Event 3004 (MALWAREPROTECTION_RTP_MALWARE_DETECTED)

Windows OneCare Live Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows OneCare Live can't undo changes that you allow.

Cause

This event message is created when the Real-Time Protection agent has detected changes in the system that could mean the presence of malicious third-party programs or other potentially unwanted software. The Real-Time Protection agent may also have detected third-party programs that could potentially be malicious programs. However, Windows Defender could not positively identify these programs.

Resolution

If Windows Defender cannot positively identify a program as potentially malicious, you can report this program to Microsoft. Microsoft will determine whether the program is malicious. For more information about how to report potentially malicious programs, visit the following Microsoft Web site:
http://www.microsoft.com/windows/products/winfamily/defender/resources.mspx?tab=report%20potential%20spyware

Properties

Article ID: 925545 - Last Review: April 24, 2013 - Revision: 5.0
Applies to
  • Windows Defender
Keywords: 
kbretire kbmsnpartnerportal kbdefenderrtwswept kbtshoot kbexpertisebeginner kbprb KB925545
Retired KB Content Disclaimer
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com