Windows Defender 0x8050800d

[Steve Schwab]

Here's the Event 1005 info from Event Viewer. I get the error every night
during the quick scan. System: Vista64 Ultimate SP2 Other Security is NOD32
antivirus.

I have already tried clearing the history logs and have run sfc/scannow.
There's not much written about this on line so I don't know where to go from
here.

Log Name: System
Source: Microsoft-Windows-Windows Defender
Date: 6/22/2009 2:35:16 AM
Event ID: 1005
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer:
Description:
Windows Defender scan has encountered an error and terminated.
Scan ID: {D83CB49A-6F16-45D6-8B06-600BC1792BFD}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan
User: NT AUTHORITY\NETWORK SERVICE
Error Code: 0x8050800d
Error description: Some history items could not be displayed. Please wait
a few minutes and try again. If that doesn't work, clear the history and then
try again.

 

[Bill Sanderson]

If you do a manual quickscan, do you get this error? If so, can you try
turning off Nod32's real-time protection for the duration of a manual
quickscan, to see whether that makes a difference?
It seems to me that if all users of Nod32 had this issue, it would be more
"visible", so I may be on the wrong track... I do wonder if something
"protective" has set some unusually tight permissions on the registry,
perhaps.

I don't think I can spot your OS version from this post--if this is XP, I
would do a repair reinstall of Windows Defender over itself. If it is
Vista, I think the sfc /scannow you have already done is the near
equivalent.

 

[Ǝиçεl]

Just out of curiosity, are installed Multilingual User Interface (MUI)
language packs or Language Interface Packs (LIPs)


Ǝиçεl
-=-

 

[Steve Schwab]

Thanks for the quick reply Bill,
Yes I can do a manual quickscan without issue. No problem with NOD32 running
either. I am running Vista64 Ultimate SP2 fully updated.

 

[Steve Schwab]

Pretty sure I don't have the MUI or LIPs installed.

 

[Bill Sanderson]

You are on Ultimate, so they are available--you should either be able to
see, or have hidden 31 or 32 of these critters, I think.

I'm finding it curious that this is happening only on a scheduled scan.

Windows Defender should re-schedule the job on each startup, and the job can
be viewed if you explore scheduled tasks, and turn on view hidden tasks in
the menus at the top.

What user is the Defender scheduled task running under? I can't easily look
to compare, but I would expect it to be "system."

Schedule tasks are under Control Panel, System and Security, Administrative
Tools--at the bottom on the right, with standard menus (oops--that’s windows
7--anyway--probably in that area!)

 

[Steve Schwab]

Well, I rescheduled the task to run last evening when I could watch it. I did
not get the error. However the task started at 6:00:00 and completed at
6:00:00 with an exit code of 0. I have since rescheduled the scan for 2:00
am. It ran this morning without error but started and completed at 2:00:00.
The user is SYSTEM.

If I run a manual quick scan it takes 1:12 (that's 1 minute, 12 sec). I
looked at an XP machine and a nightly scheduled scan took about 27 secs. So
I'm not sure if I'm actually completing the scheduled scan or not. I'm
assuming the exit code of 0 means successful completion.

 

[Bill Sanderson]

Yes - 0 is successful completion. Quickscans vary widely in the time they
take, but less than 5 minutes is the norm.

It sounds like the scans are successful--you can find more information in
the Windows Event logs--Either system or application--not sure which--there
should be event log entries for the start of the scan and completion, and
anything found.