You are currently offline, waiting for your internet to reconnect

Event message when Windows Defender scans a computer: "Event 3004 (MALWAREPROTECTION_RTP_MALWARE_DETECTED)"

Retired KB Content Disclaimer
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.

Windows Live OneCare is no longer available for sale

Existing subscribers will continue to be supported throughout the term of their subscriptions. Existing subscribers can reinstall by following the steps to download a trial, and can still add a PC to their existing OneCare circle.

Learn more about end of sale for OneCare.

On September 29th 2009, Microsoft introduced Microsoft Security Essentials, a FREE consumer anti-malware solution for Genuine Windows based PCs.

Learn more about Microsoft Security Essentials or download from Microsoft directly at:

When Microsoft Windows Defender scans a computer for possible malicious third-party programs and other forms of malware, you may receive the following event message:


Windows OneCare Live Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. Windows OneCare Live can't undo changes that you allow.

This event message is created when the Real-Time Protection agent has detected changes in the system that could mean the presence of malicious third-party programs or other potentially unwanted software. The Real-Time Protection agent may also have detected third-party programs that could potentially be malicious programs. However, Windows Defender could not positively identify these programs.
If Windows Defender cannot positively identify a program as potentially malicious, you can report this program to Microsoft. Microsoft will determine whether the program is malicious. For more information about how to report potentially malicious programs, visit the following Microsoft Web site:
spyware antispyware trojan

Article ID: 925545 - Last Review: 04/24/2013 03:08:00 - Revision: 5.0

  • Windows Defender
  • kbretire kbmsnpartnerportal kbdefenderrtwswept kbtshoot kbexpertisebeginner kbprb KB925545