| Event Id | 3004 |
| Source | Microsoft-Windows-Windows Defender |
| Description | %1 Real-Time Protection agent has detected spyware or other potentially unwanted software. |
| Event Information | According to Microsoft : Cause : This event is logged when windows defender real time protection agent has taken action to protect the machine from spyware. Resolution : Remove or allow spyware or other potentially unwanted software If Real-Time Protection (RTP) detects spyware or other potentially unwanted software, Windows Defender will present you with an alert. If you are not sure whether RTP identified spyware or other potentially unwanted software, you can use the Advice section or click View more information about this item online in the alert. The alerts are listed in the Windows Defender History. Note : To perform this procedure, you must be a member of theUsers group, or you must have been delegated the appropriate authority. To remove spyware or other potentially unwanted software by using Windows Defender: 1.In theScan Results window of Windows Defender under the action column, click Remove. However, if the identified application is not spyware or other potentially unwanted software, click Ignore to ignore the alert for this scan, or click Always Allow to ignore this alert in the current scan and all future Windows Defender scans. 2.ClickApply Actions. 3.UnderScan Results, wait forActions completed to display, and then close Windows Defender. Verify : When Windows Defender takes an action on spyware or other potentially unwanted software, an entry is created in the Windows Defender History. To verify that the spyware or other potentially unwanted software was successfully removed from your computer, you should verify that an entry was created in the Windows Defender History and that the appropriate action was taken. Note : To perform this procedure, you must be a member of theUsers group, or you must have been delegated the appropriate authority. To verify that the spyware or other potentially unwanted software was successfully removed: 1.ClickStart, point toAll Programs, and then clickWindows Defender. 2.ClickHistory. 3.Under Programs and Actions, verify that theAction Taken column saysRemove. 4.Verify that theStatus column saysSucceeded. 5.Close Windows Defender. |
| Reference Links | Event ID 3004 from Source Microsoft-Windows-Windows Defender |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.