Defender Error 0x80501001

[Guest]

After a full scan using Defender Beta 2, I attempt to remove one identified
potentially unwanted item and get the following message:
Encountered an error: 0x80501001. One or more actions could not be completed
successfully.
When I hit OK, it says; 'Windows Defender encountered errors while taking
action. Try scanning your computer again'.

I've tried reinstalling Defender, but still the same.
Any ideas?

 

[Bill Sanderson]

There may be a fuller explanation in the log record associated.

These are in the System event log.

You can find them this way:

Start, run eventvwr.msc

Highlight the System event log in the left column, then go to View, Filter,
and set Source to "windefend."

Check through the log records--you can open them by double-clicking on them
in the right pane--there should be a record associated with that event on
attempting to clean, as well as an event associated with the original
detection. There's a copy to clipboard button which will allow you to post
both those messages back to another message in this thread.

I'm expecting this to relate to either a location in a place something can't
be removed from--a System Restore location, for example, or, that the
original detection is contained in an archive file--zip, cab, arj, etc--but
I'm not quite sure from that error message.

 

[Guest]

I recieved the same error message as this fellow, and since he hasn't replied
with his error log yet, I decided to reply with mine.

1:

Event Type: Error
Event Source: WinDefend
Event Category: None
Event ID: 1008
Date: 3/24/2006
Time: 1:45:21 PM
User: N/A
Computer: TURDFERGUSON
Description:
Windows Defender has encountered an error when taking action on potential
malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {17987663-87EC-46CC-AB4D-8F033F58D38F}
Scan Type: AntiMalware
User: TURDFERGUSON\Orien
Threat Name: WhenU.SaveNow
Threat Id: 10810
Threat Severity: 2
Threat Category: 1
Action: Remove
Error Code: 0x80508026
Error description: Windows Defender cannot remove a potentially harmful
item from the contents of an archived file. To remove the item, you need to
delete the archive or you can search for options for removing spyware in Help
and Support.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

2:

Event Type: Error
Event Source: WinDefend
Event Category: None
Event ID: 1008
Date: 3/24/2006
Time: 12:51:37 PM
User: N/A
Computer: TURDFERGUSON
Description:
Windows Defender has encountered an error when taking action on potential
malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {347BFBC7-F7EA-482C-9738-508C6A28CC05}
Scan Type: AntiMalware
User: TURDFERGUSON\Orien
Threat Name: WhenU.SaveNow
Threat Id: 10810
Threat Severity: 2
Threat Category: 1
Action: Remove
Error Code: 0x80508026
Error description: Windows Defender cannot remove a potentially harmful
item from the contents of an archived file. To remove the item, you need to
delete the archive or you can search for options for removing spyware in Help
and Support.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

3:

Event Type: Error
Event Source: WinDefend
Event Category: None
Event ID: 1008
Date: 3/24/2006
Time: 12:20:25 PM
User: N/A
Computer: TURDFERGUSON
Description:
Windows Defender has encountered an error when taking action on potential
malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {5891A033-48E7-4F22-AE31-6E868CA39D45}
Scan Type: AntiMalware
User: TURDFERGUSON\Orien
Threat Name: WhenU.SaveNow
Threat Id: 10810
Threat Severity: 2
Threat Category: 1
Action: Remove
Error Code: 0x80508026
Error description: Windows Defender cannot remove a potentially harmful
item from the contents of an archived file. To remove the item, you need to
delete the archive or you can search for options for removing spyware in Help
and Support.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Any advice you could give would be welcome. Thanks.

 

[Bill Sanderson MVP]

The text in those messages is clear why Windows Defender isn't doing the
removal. However--you haven't posted the original detection messages--those
will show the full path and filename of what's being detected--and that's
what you need to go after this yourself, manually.


Go back to the time of the scan, and find the yellow-triangle messages that
show the original detection(s)--these will have full paths and filenames in
them--use that information to find the actual objects involved in this
detection, and consider renaming or moving them.

Is this detection on a full or quick scan?
--