| Event Id | 1006 |
| Source | Microsoft-Windows-Windows Defender |
| Description | %1 scan has detected spyware or other potentially unwanted software. |
| Event Information | According to Microsoft : Cause : This event is logged when scan has detected spyware or other potentially software. Resolution : Remove spyware or other potentially unwanted software If a Windows Defender scan detects spyware or other potentially unwanted software, you will receive an alert. If you are not sure whether this is spyware or other potentially unwanted software, you can use the Advice section or click View more information about this item online in the alert. The alerts are listed in the Windows Defender history. Note: To perform this procedure, you must be a member of theUsers group, or you must have been delegated the appropriate authority. To remove an application by using Windows Defender: 1.In theScan Results window of Windows Defender under the action column, clickRemove. 2.If this is an application that is not spyware or other potentially unwanted software, clickIgnore to ignore the alert for this scan, or clickAlways Allow to ignore this alert in the current scan and all future Windows Defender scans. 3.ClickApply Actions. 4.UnderScan Results, wait forActions completed to display, and then close Windows Defender. Verify : When Windows Defender takes an action on spyware or other potentially unwanted software, an entry is created in the Windows Defender History. To verify that the spyware or other potentially unwanted software was successfully removed from your computer, you should verify that an entry was created in the Windows Defender History and that the appropriate action was taken. Note : To perform this procedure, you must be a member of theUsers group, or you must have been delegated the appropriate authority. To verify that the spyware or other potentially unwanted software was successfully removed: 1.Click Start, point toAll Programs, and then clickWindows Defender. 2.ClickHistory. 3.UnderPrograms and Actions, verify that the Action Taken column saysRemove. 4.Verify that theStatus column says Succeeded. 5.Close Windows Defender. Note :If you clicked Ignore orAlways Allow for the action in the Windows Defender alert, the Action Taken column will display eitherIgnore orAlways Allow. |
| Reference Links | Event ID 1006 from Source Microsoft-Windows-Windows Defender |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.