Error 0x8050800f - unxepected problem occured

[Guest]

This error (error 0x8050800f) occured during my first scan with Windows
Defender, then windows defender shutdown in the middle of the scan. I noticed
that it had occured after 9pm, which is when I had scheduled the daily scans.
It started up fine again once I restarted.

I was just wondering is it a known problem that I will always get if I am
running a scan at the time a scheduled scan is supposed to start?

 

[Fuzzy John]

I had a very similar error (0x8050800c) when trying to scan after I
installed the program on Win 2000 Pro SP-4 (I first uninstalled MSAS Beta
1).

However after the first scheduled scan the error went away and I was able to
do quick and full system scans.

 

[Guest]

Hi Michelle,

Could you supply some information on what your OS is, etc?
It's pretty amazing you hit that error code, I'd like to figure out how you
did it.

Thanks,
Joe

 

[Guest]

Joe,

Same error here - work up this am with an "0x8050800f" error - scheduled
scan was supposed to run at 2am and the event logs show that it did run, but
this error was thrown (Windows Defender encountered an error: 0x8050800f An
unexpected problem occurred. Install any available updates and then try to
start the program again.).

All "Tuesday" patches had already been applied before this mornings
scheduled scan.

Best,
Mark.

 

[Guest]

Same error here, XP(sp2), all updates installed. It crashes during the
scheduled scan, and when you try to set a state for the false positives with
"apply actions" it looks like it's trying to scan again then errors again
with the same error code/message.

 

[Guest]

Hi Mark, Michelle,

Could you post any event log entries from WD around the time you saw the
800f error? We'd like to figure out what's going on here, and there's very
few ways to hit this, and none of them made sense to us.

Thanks for trying Windows Defender,
Joe

 

[Guest]

No problem Joe - here they are not sure at which point between these the
error happened. Also, the WD notification for TightVNC was expected - it's
installed.

1:38:18 AM
Windows Defender scan has started.
Scan ID: {B0ADFA26-02C9-469B-8E9B-4AE7800BEA92}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
------------------------------------------------------
4:07:48 AM
Windows Defender scan has detected potential malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {B0ADFA26-02C9-469B-8E9B-4AE7800BEA92}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Threat Name: TightVNC
Threat Id: 13052
Threat Severity: 2
Threat Category: 33
Path Found: file:C:\System Volume
Information\_restore{CD4104FB-A398-4CBB-B846-A5BCD2BCF11E}\RP1790\A2219999.exe
Detection Type: Signatures
------------------------------------------------------
4:07:48 AM
Windows Defender scan has finished.
Scan ID: {B0ADFA26-02C9-469B-8E9B-4AE7800BEA92}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Scan Time: 2:29:29
------------------------------------------------------
7:59:46 AM
Windows Defender has taken action to protect this machine from potential
malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {B0ADFA26-02C9-469B-8E9B-4AE7800BEA92}
Scan Type: AntiMalware
User: DOG\Administrator
Threat Name: TightVNC
Threat Id: 13052
Threat Severity: 2
Threat Category: 33
Action: Ignore always
------------------------------------------------------
7:59:46 AM
Windows Defender Configuration has changed. If this is an unexpected event
you should review the settings as this may be the result of malware.
Old value:
New value: HKLM\SOFTWARE\Microsoft\Windows
Defender\Threats\ThreatIDDefaultAction\13052 = 6

 

[Guest]

I'm running Windows XP Home Edition Service Pack 2, automatic updates set to
run all the time, so my PC was up to date with patches.
Intel Pentium D CPU 3.00GHz, 1GB of RAM

Also, I can't find the event log file for Windows Defender. I found the temp
log file it created when checking for updates, but I can't find any others.
I'm probably missing it, but its early in the morning here

I installed it all in the defualt directories, so if you tell me where the
event log is I can copy the events from it for you. Sorry I'm not very
helpful.

 

[Guest]

Event Log Entries from WD when Error0x9050800f occured:
All of it looks normal, apart from the WAN minport thing. I posted the ones
before and after the error, which occured at 8:59. It says the scan
completed, although the UI crashed with an 'unexpected problem' error message.

------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 15/02/2006
Time: 8:55:36 PM
Description:
The WAN Miniport (ATW) Service service terminated unexpectedly. It has done
this 1 time(s).

---------
Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 15/02/2006
Time: 8:55:50 PM
Description:
Windows Defender scan has detected potential malware.
Scan ID: {EED2BE50-1CD9-4F67-9BA1-9FFB6C2DD1B9}
Scan Type: AntiSpyware
Scan Parameters: Custom Scan
Threat Name: RealVNC
Threat Id: 7480
Threat Severity: 2
Threat Category: 33
Path Found: processid:2040;file:C:\Program Files\RealVNC\VNC4\WinVNC4.exe
Detection Type: Signatures

--------
Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 1000
Date: 15/02/2006
Time: 8:56:27 PM
Description:
Windows Defender scan has started.
Scan ID: {A240B179-9B4D-4696-8D95-3AF1D6E073F6}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan

-----
Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 15/02/2006
Time: 8:59:40 PM
Description:
Windows Defender scan has detected potential malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {A240B179-9B4D-4696-8D95-3AF1D6E073F6}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan
Threat Name: RealVNC
Threat Id: 7480
Threat Severity: 2
Threat Category: 33
Path Found:
processid:2040;service:WinVNC4;regkey:HKLM\SYSTEM\CurrentControlSet\Services\WinVNC4;regkey:HKLM\Software\RealVNC;file:C:\Program
Files\realvnc\vnc4\logmessages.dll;file:C:\Program
Files\RealVNC\VNC4\WinVNC4.exe;file:C:\Program Files\realvnc\vnc4\wm_hooks.dll
Detection Type: Signatures

-----
Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 1001
Date: 15/02/2006
Time: 8:59:40 PM
Description:
Windows Defender scan has finished.
Scan ID: {A240B179-9B4D-4696-8D95-3AF1D6E073F6}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan
Scan Time: 0:03:12

The scan finished at the same time it found the RealVNC threat, that I was
expecting as I installed it.
Hope I managed to help instead of just flooding you with information

 

[Guest]

Same error message here 0x8050800f when I logged in this morning (2/18/2006),
but Windows Defender scanned successfully. The scan started at 2:09:47 AM and
ended at 2:14:04 AM (all times US Eastern). According to the Event Viewer,
there are no error messages in either the Application or System logs after
the scan was run. I have received this error message twice since installing
Windows Defender, once with the original virus definition file and once with
the current virus definition file (version 1.13.1276.3 built on 2/15/2006 at
6:01 AM).

System is a 2.4 GHz Pentium 4, with 1 GB RAM, and an 80 GB Hard Drive (50 GB
free space) running Windows XP Professional Build
2600.xpsp_sp2_gdr.050301-1519 (Service Pack 2) with all current patches
installed.

I have Windows Defender installed on both my home PC and my work PC, but
have only received this error message on my home PC. My home PC is run in a
multi-user environment, with one Administrator account (that would be me) and
with 4 limited user accounts for other family members. This morning, all 5
accounts were logged in, though none of the accounts were actually active
when Windows Defender was running.

If you need any additional information, please let me know. Thanks.

 

[Guest]

Same error again this morning (2/19/2006), and again Windows Defender scanned
successfully. The scan started at 2:11:10 AM and ended at 2:29:22 AM. This
time, there is one error message in the Event Viewer. It is in the
Application Log for the prior evening 2/18/2006 at 8:48:08 PM. Error message
is as follows:

Windows Defender Real-Time Protection checkpoint has encountered an error
and failed to start.
User: HAL9000\Paul G
Checkpoint Id: 27
Error Code: 0x80070005
Error description: Access is denied.

This error message was generated for one of the limited user accounts.
Looking more thoroughly through the Application Log, this error is present
every day, since 2/14/2006, which is probably around the same time that I
first installed Windows Defender on my home PC. There are no other error
messages in the Application Log for Windows Defender for any other user
accounts. Think I'll try uninstalling and reinstalling Windows Defender and
see if that helps. I'll post my results here either way. Hope that helps.
Thanks again.

 

[Guest]

Same error when I awoke this am but now no errors in the event log.

Any ideas Joe?

Thanks,
Mark.

 

[Guest]

Joe,

I too have been receiving this error each morning when I log onto my home
machine. I have installed WD on three machines (home, kids, work laptop) and
only the home machine has this error. The machine is a P4 3.00 ghz, 1 gig
ram on an ASUS motherboard. The scan ran successfully at 2am but the error
appeared when I logged on. The machine has two users, myself (admin) and
another. A vpn connection to my work network existed at the time.

Here is the successful scan message:
-------------------------------------------------------------------------
Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 1001
Date: 2/18/2006
Time: 2:03:23 AM
User: N/A
Computer: CARLSONOFFICE
Description:
Windows Defender scan has finished.
Scan ID: {8B0F6130-2A33-4172-BB0B-23398EF8BA62}
Scan Type: AntiSpyware
Scan Parameters: Quick Scan
User: NT AUTHORITY\NETWORK SERVICE
Scan Time: 0:01:06


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------
Here is the error messages when I logged on:

Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 5007
Date: 2/18/2006
Time: 8:28:30 AM
User: N/A
Computer: CARLSONOFFICE
Description:
Windows Defender Configuration has changed. If this is an unexpected event
you should review the settings as this may be the result of malware.
Old value: Default\Real-Time Protection\EnableKnownGoodPrompts = 0
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time
Protection\EnableKnownGoodPrompts = 1


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------
Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 5007
Date: 2/18/2006
Time: 8:28:30 AM
User: N/A
Computer: CARLSONOFFICE
Description:
Windows Defender Configuration has changed. If this is an unexpected event
you should review the settings as this may be the result of malware.
Old value: Default\Real-Time Protection\EnableUnknownPrompts = 0
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time
Protection\EnableUnknownPrompts = 1


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Guest]

I am also getting this same error (0x8050800f). Running Windows XP Home
Edition SP2 with all updates. Any fix for it yet?

 

[Guest]

I went into the event log, and the properties for the error showed this:
"Windows Defender Real-Time Protection agent has detected potential malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {5AD020FE-D4A5-410E-BF78-F7A0D958F60E}
User: HPMZC61\Owner
Threat Name: Unknown
Threat Id:
Threat Severity:
Threat Category:
Path Found: file:C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My
Computer (1) (HPMZC61-Owner).job;file:c:\program
files\mcafee.com\vso\mcmnhdlr.exe;taskscheduler:C:\WINDOWS\tasks\McAfee.com
Scan for Viruses - My Computer (1) (HPMZC61-Owner).job
Threat Classification: Unknown
Detection Type:


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp."

I am running McAfee Antivirus and Firewall if that helps any.

 

[Guest]

Unfortunately, uninstalling and reinstalling Windows Defender had no effect
on these errors. Windows Defender scan started at 1:39:39 and ended at
1:43:10 on 2/20/2006 with no problems. But error 0x8050800f was displayed
once again when I logged in this morning. The only error message in the Event
Viewer is the same error 0x80070005 that I reported on earlier. The
0x80070005 error message has been in the Event Viewer every day so far from
2/14/2006 through 2/19/2006, and the error 0x8050800f has been showing up
every time I logon in the morning on a fairly regular basis. Again, if you
need any further information to resolve these issues, let me know. I suspect
this has something to do with running Windows Defender with multiple user
accounts, since Windows Defender runs flawlessly on my work PC, where there
is always only 1 active user account. Thanks again.

 

[Bill Sanderson]

Right-click My Computer, choose manage.

CLick the plus sign to the left of Event Viewer
Click on the System event log

Go up to View, choose filter, and select WinDefend as the source. Hit
apply.

 

[Guest]

I have found that the only time I see this error is if there is more than one
account active on my machine. I have an account for myself as well as my
wife and a guest account. If only my account is active, the error does not
appear, if 2 are active in, it appears every morning when I log onto my
account. I have the most recent updates.

Hope this helps in chasing down this error.

Regards,

Brian

 

[Guest]

I am also getting error 0x8050800c every time I run Defender. This happens
whenever I run it. So I cannot use Defender to scan my PC.
As a PC engineer, I cannot use Defender for any client until this is fixed.
Do we have a patch yet please?

 

[Bill Sanderson]

This update is in the works--and will come via the normal update process, so
stay tuned.

This error is seen on dynamic disk partitions--it shouldn't be seen on basic
partition, fwiw.

--