Win Defend Evt. Viewer error 3003

[Guest]

Application error just recently started showing up on one of two user's
account in WXP home edi. No problems w/ Win Defend before. Microsoft shows
no known Event Error. But WD is scanning fine, main screen shows all working
normal and I've run full scan, all updates, & done Registry clean-up. Error
states "RT checkpoint #23 has encoutered an error & failed to start, access
denied - Main Computer (user's name) Code 800x70005" Anyone have any
knowledge about this particular event error and how to go about clearing it
up? Thanks

Shiann

 

[Bill Sanderson MVP]

Shiann - I'm skeptical about the applicability of Engel's citation, in this
case.

I believe that if that issue were the cause of your error message, you would
have seen it some time abo, since the article was last revised in July of
2006.

In any case, it probably isn't clear to you what to do with the information
in that article.

If you want to try it, to see whether it helps, you need to call Microsoft
PSS. You need to call the number for paid support in your locale, and
simply state that you are seeing symptoms that appear to be related to
article 904423, and you are requesting the hotfix related to that KB
article.

You shouldn't be asked for credit information, and you should be given a way
to obtain the hotfix--probably a password to an archive that may be mailed
to you.

Don't discuss any other issues with the PSS support staff--just state your
case as simply as possible, and ask for the hotfix.

For my part, I don't have a clear answer to this one yet. Engel's
prescription to turn off the service will undoubtedly remove the error
message, but it also removes the protection. I'd rather leave the error
message out there as a reminder that the protection is failing, until we can
see what the issue is.

Do make sure that you've applied all critical updates.

 

[Guest]

Hi Bill,

I don't see any mention about services, maybe your post was re-directed?
--

 

[Bill Sanderson MVP]

You are working several threads relating to this same error. Shiann has
replied to at least one other besides this one. The error message relates
to the real-time-protection service stopping. In that other thread, you
correlated the error with the particular setting in tools, options, and
recommended turning off that protection. That was a useful connection to
make between the error message, and the particular part of Windows Defender
that is erroring out, but I'm not willing to turn off that protection --if
it is stopping on its own because of some condition, I'd rather let it do
that.

If you search these groups on "3003" you'll find both threads, and see what
I mean, I believe.

--

 

[Guest]

Hi Bill,

Yea, that post (3003) was in the year 2006 in August to "wli2k2".
Error Code: 0x8000ffff
Error description: Catastrophic failure

I have to give credit to Shiann, going back all this months, but Shiann pick
up the wrong Error code.

Now let see and wait.

 

[Guest]

Sorry about confusion, I was redirected to post my question elsewhere. The
KB art. didn't quite fit my issue altho error #s the same & I decided not to
do System Restore and will call support instead. Thanks for all the input.

 

[Bill Sanderson MVP]

Let us know how this turns out? I'm not clear how to use the two free
support incidents that come with the product, so others would benefit from
your describing the experience here, I suspect. And we can hope that you'll
get a solution to this specific issue which you can post for others.

--

 

[Guest]

See Windows Support results in above thread. Oh, The technician checks to
see if you qualify for the 2 free support incidents. I did.

 

[Joe Faulhaber[MSFT]]

Hi Shiann,

Every time I've seen this error, it's because one of the registry keys WD is
monitoring has permissions that prevent real-time protection from reading
the key for the current user. Which key it is would take some digging, but
other keys in the checkpoint (checkpoint 23 is Shell Open Commands) are
still monitored.

This should be safe to ignore, but you can call for support if you're still
concerned.

Thanks for using Windows Defender,
Joe

 

[Guest]

Thanks for your input on this. I figured it was problem such as you state
and have no clue how to amend it anyway. WD is doing what it's suppose to do
otherwise. Think I'll just let an update patch take care of it. Microsoft
is aware of this particular error. I apoligize for not checking in sooner.

 

[Guest]

Is there any new word on this? I have this event 3003 on plenty of
workstations on several domains. Its been around for quite a while.The main
difference I see is that my domain users DO NOT have admin rights on their
workstations. This is obviously making a difference, cuasing error messages
relating to Real Time Protection not being loaded:

Windows Defender Real-Time Protection checkpoint has encountered an error
and failed to start.
User: SBSERVER\agongora
Checkpoint ID: 27
Error Code: 0x80070005
Error description: Access is denied.

Whether or not my regular uses are indeed STILL being protected, I do not
know. I can only assume that they are NOT becuase the RTP cannot load.

What would be great is for MS to tell us what specific registry keys need to
be give rights so that a standard user account can run RTP.

 

[Guest]

Is there any new word on this? I have this event 3003 on plenty of
workstations on several domains. Its been around for quite a while.The main
difference I see is that my domain users DO NOT have admin rights on their
workstations. This is obviously making a difference, cuasing error messages
relating to Real Time Protection not being loaded:

Windows Defender Real-Time Protection checkpoint has encountered an error
and failed to start.
User: SBSERVER\agongora
Checkpoint ID: 27
Error Code: 0x80070005
Error description: Access is denied.

Whether or not my regular uses are indeed STILL being protected, I do not
know. I can only assume that they are NOT becuase the RTP cannot load.

What would be great is for MS to tell us what specific registry keys need to
be give rights so that a standard user account can run RTP.