Wednesday, October 26, 2016

KB52417 - Complete list of Event IDs for VirusScan Enterprise

KB52417 - Complete list of Event IDs for VirusScan Enterprise

Event IDs for Range 1000 to 1199  
Event IDEvent SourceEvent TypeePO 5.x Threat CategoryePO 5.xAction TakenMcLogEventSeverityDescription
924ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, AV PUPnone, access denied
259
ErrorThe file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. Detected with Scan Engine %ENGINEVERSION% DAT version %DATVERSION%.
925ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR AV detect, AV PUPCleaned258 WarningThe file %FILENAME% contained %VIRUSNAME% %VIRUSTYPE%. The file was successfully cleaned with Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1026ODS, OAS, Outlook ScanDomino Scan SEVERITY_CRITICAL AV detect, AV PUPnone, access denied259 Error The file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. Unable to clean the file using the current Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1027ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAV detect, AV PUPDeleted258 Warning The file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. The file was successfully deleted.
1028 ODS, OAS SEVERITY_MINORAV detect, AV PUPDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot.
1032 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORAV detect, AV PUPMoved257 Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. The detection was moved to quarantine area. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1034 ODSSEVERITY_INFORMATIONAL ops.task.endNone257 Information The scan completed. No detections were found. Scan engine version used is %ENGINEVERSION% DAT version %DATVERSION%.
1035ODSSEVERITY_INFORMATIONALops.task.cancelNone257InformationThe scan was cancelled at time %GMTTIME%.
1037ODS, OASSEVERITY_CRITICALAV detect, AV PUPnone, access denied259Error The scan found a boot record infected with %VIRUSNAME% %VIRUSTYPE%. Detected using Scan Engine version %ENGINEVERSION% DAT version %DATVERSION%.
1038ODS SEVERITY_CRITICALops.task.endNone259ErrorThe scan found detections. Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1039 ODSSEVERITY_MAJORops.task.endNone259ErrorThe scan found and cleaned detections using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1051ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR AVNone257InformationThe Scan was unable to scan password protected file %FILENAME%. Scan engine version used is %ENGINEVERSION% DAT version %DATVERSION%.
1053 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV.detect.heuristics, av.pupnone, access denied259 Error The file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. Detected with Heuristics, Scan Engine %ENGINEVERSION% DAT version %DATVERSION%.
1054ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR AV.detect.heuristics, av.pupDeleted258WarningHeuristics has detected that file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. The file was deleted.
1055ODS, OASSEVERITY_MINOR AV.detect.heuristics, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (could be a new virus).
1056 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR AV.detect.heuristics, av.pupMoved259Error Heuristics has detected that file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. The file was moved the file to the quarantine area. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1059ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAVNone257InformationThe scan of %FILENAME% has taken too long to complete and is being canceled. Scan engine version used is %ENGINEVERSION% DAT version %DATVERSION%.
1060 ODS, OAS SEVERITY_MAJORAV detect, AV PUPCleaned257InformationThe scan cleaned a boot record infected with the %VIRUSNAME% %VIRUSTYPE%. Detected using Scan Engine version %ENGINEVERSION% DAT version %DATVERSION%.
1061ODS, OASSEVERITY_CRITICALAV detect, AV PUPNone, Access Denied259Error The scan encountered an error attempting to clean a boot record infected with %VIRUSNAME% %VIRUSTYPE%. Detected using Scan Engine version %ENGINEVERSION% DAT version %DATVERSION%.
1064OASSEVERITY_INFORMATIONALops.service.startNone257InformationService was started.
1065OAS SEVERITY_INFORMATIONAL ops.service.endNone257InformationService ended.
1067 ODSSEVERITY_MINORops.service.errorNone258 WarningTask failed to start.
1087OASSEVERITY_INFORMATIONALops.service.startNone257InformationOn-access Scan started at %GMTTIME%. Scan version %ENGINEVERSION% DAT version %DATVERSION%.
1088OAS SEVERITY_INFORMATIONALops.service.endNone257InformationOn-access scan stopped. Scan version %ENGINEVERSION% DAT version %DATVERSION%.
1089Access Protection (OAS)SEVERITY_MINORops.service.errorNone258WarningAn error occurred loading the Access Protection rule file (vscan.bof). The error was %INFO%
1091OAS, Script Scan, Outlook ScanSEVERITY_MAJORAV detect, AV PUPBlocked258WarningScript execution blocked (%INFO%).
1092Access Protection (OAS) SEVERITY_MINORops.service.startdeny create, deny read, deny write, deny execute, deny delete, deny modify, deny terminate257InformationBlocked by access protection rule. Access to object %FILENAME% was blocked by rule %INFO%.
1093Buffer Overflow (OAS)SEVERITY_CRITICAL hip.boBlocked258WarningBlocked by Buffer Overflow Protection %INFO%.
1094Access Protection (OAS)SEVERITY_MINOR fw.detectBlocked257InformationBlocked by port blocking rule (%INFO%).
1095Access Protection (OAS)SEVERITY_MINORops.service.startwould deny create, would deny read, would deny write, would deny execute, would deny delete, would deny modify, would deny terminate257InformationWould be blocked by access protection rule (rule is in warn-only mode) (%INFO%)
1096Access Protection (OAS) SEVERITY_MINOR fw.detectWould block258WarningWould be blocked by port blocking rule (rule is in warn-only mode) (%INFO%).
1099 Buffer Overflow (OAS)SEVERITY_CRITICAL hip.boWould block257 InformationWould be blocked by Buffer Overflow Protection (Buffer Overflow Protection is currently in warn mode) (%INFO%).
1100 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV.detect.heuristics, av.pupNone, Access denied259ErrorThe file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. Detected with Multiple Extension Heuristics.
1101ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV.detect.heuristics, av.pupDeleted258 WarningMultiple Extension Heuristics has detected that file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. The file was deleted. 
1102 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV.detect.heuristics, av.pupMoved259ErrorMultiple Extension Heuristics has detected that file %FILENAME% contains %VIRUSNAME% %VIRUSTYPE%. The file was moved the file to the quarantine area. 
1103 ODS, OASSEVERITY_MINOR AV detect, AV PUPNone257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No action taken. Please run McAfee VirusScan Command Line Scanner to remove this.
1104 ODS, OAS SEVERITY_MINOR AV.detect.heuristics, av.pupDeleted257Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (File has a multiple extension).
1118 McUpdate SEVERITY_INFORMATIONAL ops.update.endNone257InformationThe update was successful. Scan version %ENGINEVERSION% DAT version %DATVERSION%.
1119 McUpdateSEVERITY_WARNINGops.update.endNone258WarningThe update failed; see event log.
1120McUpdateSEVERITY_INFORMATIONALops.updateNone257Information The update is running.
1121McUpdate SEVERITY_WARNING ops.update.cancelNone257 InformationThe update was canceled.
1129Task Managerops.task.cancelNew CellNone257 InformationThe scan was canceled because Microsoft Windows is shutting down.
 
Event IDs for Range 1200 to 1299  
Event IDEvent SourceEvent TypeePO 5.xThreat CategoryePO 5.xAction TakenMcLogEventSeverityDescription
1202 ODSSEVERITY_INFORMATIONALops.task.startNone257InformationOn-demand scan started.
1203ODSSEVERITY_INFORMATIONAL ops.task.endNone257 InformationOn-demand scan complete. Detections %NUMVIRS%, Cleaned %NUMCLEANED%, Deleted %NUMDELETED%, Quarantined %NUMQUARANTINED%.Scan version %ENGINEVERSION% DAT version %DATVERSION%.
1270ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJOR AV detect, av.pupMoved259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, quarantined successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1271ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAV detect, heuristics, av.pupMoved259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, heuristic detection, quarantined successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1272ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAV detect, av.pupMoved259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Undetermined clean error, quarantined successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1273ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJOR AV detect, av.pupMoved259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Encrypted file, quarantined successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1274 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICAL AV detect, av.pupNone, Access Denied259 Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, quarantine failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1275 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, heuristics, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, heuristic detection, quarantine failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1276ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Undetermined clean error, quarantine failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1277ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Encrypted file, quarantine failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1278 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJOR AV detect, av.pupDeleted259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, file deleted successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1279ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORAV detect, heuristics, av.pupDeleted259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, heuristic detection, deleted successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1280 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAV detect, av.pupDeleted259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Undetermined clean error, deleted successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1281ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORAV detect, av.pupDeleted259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Encrypted file, deleted successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1282 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICAL AV detect, av.pupNone, Access Denied259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, delete failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1283ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, heuristics, av.pupNone, Access Denied259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, heuristic detection, delete failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1284ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Undetermined clean error, delete failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1285ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Encrypted file, delete failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1289 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, av.pupNone, Access Denied259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Encrypted file, continued scanning (ODS). Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1290ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, OAS denied access and continued. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1291ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, heuristics, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, heuristic detection, OAS denied access and continued. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1292 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICAL AV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Undetermined clean error, OAS denied access and continued. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1293 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORAV detect, av.pupDeleted259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Quarantine failed, deleted successfully. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1294 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Quarantine failed, delete failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1296 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Move failed, denied access and continued (OAS). Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1297ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJOR New CellAV detect, av.pupMoved259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, quarantined. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1298 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALAV detect, av.pupNone, Access Denied 259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, quarantine failed. Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.

Event IDs for Range 1300 to 1399  
Event ID Event SourceEvent TypeePO 4.xThreat CategoryePO 4.xAction TakenMcLogEvent  Severity Description
1300ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALAV detect, av.pupNone, Access Denied259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, denied access and continued (OAS). Detected using Scan engine version %ENGINEVERSION% DAT version %DATVERSION%.
1301ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MINORAV detect, heuristics, av.pupMoved  259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, Multiple Extension Heuristic detection, quarantined successfully.
1302 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINOR AV detect, heuristics, av.pupNone, Access Denied259 Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, Multiple Extension Heuristic detection, quarantine failed.
1303 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV detect, heuristics, av.pupDeleted 259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. No cleaner available, Multiple Extension Heuristic detection, deleted successfully.
1304 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MINORAV detect, heuristics, av.pupNone, Access Denied259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Multiple Extension Heuristic detection, delete failed.
1305 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MINOR AV detect, heuristics, av.pupNone, Access Denied259 ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Clean error, Multiple Extension Heuristic detection, OAS denied access and continued.
1306ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MINORAV detect, av.pupDeleted259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Quarantine failed, deleted successfully.
1307ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Quarantine failed, delete failed.
1308ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINOR AV detect, heuristics, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Move failed, denied access and continued (OAS)
1309 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINORAV detect, av.pup Moved259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, quarantined.
1310ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MINOR AV detect, av.pupNone, Access Denied259ErrorThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, quarantine failed.
1311 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MINORAV detect, heuristics, av.pupNone, Access Denied259Error The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Delete failed, denied access and continued (OAS).
1312 ODS, OAS SEVERITY_MINOR AV detect, av.pupDeleted257 Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Move failed).
1313ODS, OASSEVERITY_MINORAV detect, av.pupDeleted257 Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Move failed).
1314 ODS, OASSEVERITY_MINORAV detect, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Clean failed because the file is encrypted).
1315ODS, OASSEVERITY_MINORAV detect, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Clean failed because the virus could be new).
1316ODS, OASSEVERITY_MINORAV detect, heuristics, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Clean failed, file has multiple extensions).
1317 ODS, OAS SEVERITY_MINORAV detect, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Clean failed because the detection isn't cleanable).
1318ODS, OAS SEVERITY_MINORAV detect, av.pupDeleted257 InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Will be deleted after the next reboot (Clean failed).
1319Outlook ScanSEVERITY_MINOR AV detect, av.pupDeleted257Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message has been deleted.
1320Outlook ScanSEVERITY_MINORAV detect, heuristics, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (could be a new virus).
1321Outlook ScanSEVERITY_MINORAV detect, heuristics, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Attachment has a multiple extension).
1322Outlook Scan SEVERITY_MINOR AV detect, av.pupDeleted257 InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Clean failed because the file isn't cleanable).
1323 Outlook ScanSEVERITY_MINORAV detect, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Clean failed because the file is encrypted).
1324Outlook ScanSEVERITY_MINORAV detect, heuristics, av.pupDeleted257 InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Clean failed because the virus could be new).
1325Outlook Scan SEVERITY_MINORAV detect, heuristics, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Clean failed, file has a multiple extension).
1326 Outlook Scan SEVERITY_MINOR AV detect, av.pupDeleted257Information The file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Clean failed).
1327Outlook ScanSEVERITY_MINOR AV detect, av.pupDeleted257InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Move failed).
1328 Outlook ScanSEVERITY_MINORAV detect, av.pupDeleted257 InformationThe file %FILENAME% contains the %VIRUSNAME% %VIRUSTYPE%. Email message deleted (Move failed, file has a multiple extension).
1329Noneops.task.errornoneNot Scanned259ErrorOffline Virtual Image Scan of %VIRTUAL_IMAGE_NAME% failed due to a sharing violation
1330OVIops.task.errornoneNot Scanned259ErrorOffline Virtual Image Scan of %VIRTUAL_IMAGE_NAME% failed due to a removable drive conflict
1331OVIops.task.errornoneNot Scanned259ErrorOffline Virtual Image Scan of %VIRTUAL_IMAGE_NAME% failed due to a failure to virtualize the registry
1332OVIops.task.errornoneNot Scanned259ErrorOffline Virtual Image Scan of %VIRTUAL_IMAGE_NAME% failed, the image is in a suspended or running state
1333OVIops.update.endnoneN/A257InformationOffline Virtual Image Scan successfully copied DATs (%DAT_VERSION%) to %VIRTUAL_IMAGE_NAME%
1334OVIops.task.errornoneN/A259ErrorOffline Virtual Image Scan failed to copy DATs to %VIRTUAL_IMAGE_NAME%
1335OVIops.task.startnoneN/A257InformationOffline Virtual Image scan started.
1336OVIops.task.endnoneN/A257InformationOffline Virtual Image scan complete. Detections %NUMVIRS%, Cleaned %NUMCLEANED%, Deleted %NUMDELETED%, Quarantined %NUMQUARANTINED%.Scan version %ENGINEVERSION% DAT version %DATVERSION%.
1337OVIops.task.errornoneNot Scanned257InformationOffline Virtual Image scan failed due to a partition mount failure with %VIRTUAL_IMAGE_NAME%
1338OVIops.task.errornoneNot Scanned257InformationOffline Virtual Image scan failed for %VIRTUAL_IMAGE_NAME%
1339OVIops.task.errornoneNot Scanned257InformationOffline Virtual Image scan failed unable to load required library. Image: %VIRTUAL_IMAGE_NAME%
1340VSASops.service.errornoneN/A257InformationConnect to filer failed.
1341VSASopsnoneN/A257InformationConnect to filer succeeded.
1342OVIops.task.errornoneN/A257InformationOffline Virtual Image scan failed to connect to VM server due to bad IP address
1343OVIops.task.errornoneN/A257InformationOffline Virtual Image scan failed to connect to VM server due to bad username or password
1344OVIops.task.errornoneN/A257InformationOffline Virtual Image scan failed opening VM
1345OVIops.task.errornoneN/A257InformationOffline Virtual Image scan failed to scan VM %1. Another XenServer VM scan is already in progress.
1346OVIops.task.errornoneN/A257InformationOffline Virtual Image scan failed to scan VM %1. Citrix XenServer VM scans can only be run when VirusScan Enterprise for Offline Virtual Images is running on Windows XP.
1347OVIops.task.errornoneN/A257InformationOffline Virtual Image disk access error while scanning VM %1.

Event IDs for Range 4700 - 4799  
Event IDEvent SourceEvent TypeePO 4.x 
Threat Category
ePO 4.xAction TakenMcLogEventSeverityDescription
4700McUpdate SEVERITY_MINORops.service.errorNone 258WarningFailed to connect to CMA updater.
4702McUpdateSEVERITY_MINORops.service.errorNone258Warning Failed to save schedule data into CMA

Event IDs for Range 21400 to 21499  
Event IDEvent SourceEvent TypeePO 5.xThreat CategoryePO 5.xAction TakenMcLogEventSeverityDescription
21400ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORav.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings
21401ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICAL av.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings, clean failed.
21402 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICAL av.pupnone, access denied259 Error%FILENAME% was detected using user defined detection settings,clean and move failed.
21403 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORav.pupMoved259Error%FILENAME% was detected using user defined detection settings, moved to quarantine after clean failed.
21404 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICALav.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings, clean and delete failed.
21405ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORav.pupDeleted259 Error%FILENAME% was detected using user defined detection settings, deleted after clean failed.
21406 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_MAJORav.pupMoved259Error%FILENAME% was detected using user defined detection settings, file moved to quarantine.
21407 ODS, OAS, Outlook Scan, Domino ScanSEVERITY_CRITICAL av.pupnone, access denied259Error %FILENAME% was detected using user defined detection settings, move and delete failed.
21408 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR av.pupDeleted259 Error%FILENAME% was detected using user defined detection settings, deleted after move failed.
21409 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALav.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings, unable to move to quarantine.
21410ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR av.pupDeleted259Error%FILENAME% was detected using user defined detection settings, file deleted.
21411ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICAL av.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings, delete and move failed..
21412 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJORav.pupMoved259Error%FILENAME% was detected using user defined detection settings, moved to quarantine after delete failed.2 ODS, OAS, Outlook Scan, Domino Scan SEVERITY_MAJOR 259 Error %FILENAME% was detected using user defined detection settings, moved to quarantine after delete failed.
21413ODS, OAS, Outlook Scan, Domino Scan SEVERITY_CRITICALav.pupnone, access denied259Error%FILENAME% was detected using user defined detection settings, unable to delete.
21414 ODS, OAS SEVERITY_MINORav.pupDeleted257InformationUser defined detection : Will be deleted after the next reboot (Clean failed because the detection isn't cleanable)
21415ODS, OAS SEVERITY_MINORav.pupDeleted257Information User defined detection : Will be deleted after the next reboot
21416ODS, OAS SEVERITY_MINORav.pupDeleted257InformationUser defined detection : Will be deleted after the next reboot (Move Failed)
21417Outlook Scan SEVERITY_MINORav.pupDeleted257 InformationUser defined detection : Email message deleted
21418Outlook ScanSEVERITY_MINORav.pupDeleted257Information User defined detection : Email message deleted (Clean failed)
21419Outlook Scan SEVERITY_MINORav.pupDeleted257Information User defined detection : Email message deleted (Move failed)
21420 Outlook ScanSEVERITY_MINORav.pupDeleted257Information User defined detection : Email message deleted (Attachment delete failed)testy
Event IDs listed as not available (N/A)
Event IDEvent SourceEvent TypeePO 5.xThreat CategoryePO 5.xAction TakenMcLogEvent SeverityDescription
N/ATask ManagerN/AN/AN/A1006 ErrorTask Manager : Service Error : %1
N/A Task Manager N/A N/AN/A1007 Error Task Manager : Could not open registry keys
N/A Task ManagerN/AN/AN/A1008 ErrorThe McShield service terminated unexpectedly.%n
Please review event 5019 or 5051 for details.
The McShield service will be restarted in %1 seconds
N/AOAS N/A N/AN/A5000Information%n
Number of signatures in EXTRA.DAT : %3%n
Names of threats that EXTRA.DAT can detect : %4
N/A None N/A N/AN/A5001WarningFile Cache couldn't be created.
N/A OASN/AN/AN/A5003 ErrorEvent couldn't be created.
N/A OAS N/AN/AN/A5004Error "Could not contact Filter Driver.%n
Error = %1 : %2
N/A None N/AN/AN/A5005Error Could not create I/O Completion port.
N/ANone N/A N/AN/A5008Error Extra driver is faulty.%n%1
N/ANone N/AN/AN/A5010 Error A scanner could not be started.
N/AOASN/AN/AN/A5011ErrorMemory allocation failed.
N/AOASN/AN/AN/A5019ErrorException in McShield.Exe!%n
Exception details follow :%1
N/ANoneN/AN/AN/A5020Error MCSCAN32.DLL is missing from the engine directory or is corrupted.
N/ANoneN/AN/AN/A5021ErrorThe version of MCSCAN32.DLL in the engine directory is incorrect.
N/AOASN/AN/AN/A5022 ErrorMCSCAN32 Engine Initialization failed.
Engine returned error : %1
N/AOASN/AN/AN/A5025Warning The alert queue has grown too big.%n
Only the alert dialog and the report file will be used for
logging virus alerts until existing alerts in the queue have been processed.
N/AOASN/A N/AN/A5026 InformationFull logging has restarted.
N/A OASN/A N/AN/A5028 Warning%3 McShield service received an invalid filename from the NaiFiltr device driver.%n
Received name = %1%n
Process = %2%n
N/A None N/A N/AN/A5030 Error NaiFiltr driver Register failed with error %1
N/A None N/A N/AN/A5031 Error NaiFiltr driver Hook failed with error %1
N/ANoneN/AN/AN/A5032Error NaiFiltr driver Start failed with error %1
N/ANoneN/AN/AN/A5033ErrorNaiFiltr driver is newer than McShield.exe.%n Actual NaiFiltr version %1%n
McShield.exe expected version %2.xx
N/A NoneN/A N/AN/A5034ErrorNaiFiltr driver is older than McShield.exe.%n Actual NaiFiltr version %1%n McShield.exe expected version %2.xx
N/AOAS N/AN/AN/A5035 Error SSCntrl.sys is still running, this version of %1 uses NaiFiltr.sys.%n
The SSCntrl.sys device has been uninstalled but a reboot is required to remove it from memory.%n The system must be rebooted before %1 will run.%n
N/A OAS N/A N/AN/A5036 WarningCitrix WinFrame specific features are not supported on WinFrame version 1.6.%n
%1 will continue with WinFrame features disabled.%n
Currently supported versions of Terminal Services are those on Windows NT4 SP4+ and Windows 2000.%n
N/AOAS N/AN/AN/A5037 Warning Unrecognized version of Microsoft Terminal Services detected.%n %1 will continue with Terminal Services features disabled.%n Currently supported versions of Terminal Services are those on Windows NT4 SP4+ and Windows 2000.%n
N/AOAS N/AN/AN/A5038 WarningCould not load winsta.dll%n %1 will continue with Terminal Services features disabled.%n
N/A OAS N/AN/AN/A5039Warning The %1 McShield scanning service could not load naiann.dll. Viruses will still be detected but no alerting will occur
N/A OASN/AN/AN/A5040WarningThe %1 McShield scanning service could not load functions from naiann.dll
Viruses will still be detected but no alerting will occur"
N/AOASN/A N/AN/A5041 Warning The %1 McShield scanning service loaded naiann.dll but it reported the wrong version
Viruses will still be detected but no alerting will occur
N/A OASN/A N/AN/A5046 ErrorThe McShield scanning service cannot find any configuration in the registry%n
N/AOASN/A N/AN/A5047 Error The McShield scanning service cannot get the Backup privilege%n
Please check that the account McShield is running under has the "Back up files and directories" right.
N/A OAS N/A N/AN/A5048 Error The McShield scanning service cannot get the Restore privilege%n Please check that the account McShield is running under has the "Back up files and directories" right.
N/A OAS N/A N/AN/A5049 ErrorThe McShield scanning service cannot get the TakeOwnership privilege%n
Please check that the account McShield is running under has the "Take ownership of files and other objects" right.
N/AOASN/AN/AN/A5050 ErrorThe McShield scanning service cannot get the TCB privilege%n Please check that the account McShield is running under has the "Act as part of the operating system" right.
N/AOASN/AN/AN/A5051Error A thread in process %1 took longer than %2 ms to complete a request.%n
The process will be terminated.
Thread id : %3%n
Thread address : %4%n
Thread message : %n%5
N/ANone N/AN/AN/A5052Information The scanning engine installed for this product is becoming close to the end of its designed life. To maintain correct anti-virus capability, it is recommended that the scanning engine be updated as soon as possible.
N/A NoneN/A N/AN/A5053Warning The scanning engine installed for this product is becoming very close to the end of its designed life and its further use can no longer be supported. To maintain correct anti-virus capability, it is now important that the scanning engine is updated as soon as possible.
N/A None N/A N/AN/A5054 Error The scanning engine installed for this product can no longer provide satisfactory virus protection. To provide correct anti-virus capability, it is now necessary to update the scanning engine.
N/A None N/A N/AN/A5055InformationThis software product is becoming close to the end of its designed life. To maintain correct anti-virus capability, it is recommended that the product be updated as soon as possible.
N/A NoneN/A N/AN/A5056Warning This software product is becoming very close to the end of its designed life and its further use can no longer be supported. To maintain correct anti-virus capability, it is now important that the product is updated as soon as possible.
N/A NoneN/A N/AN/A5057ErrorThis software product can no longer provide satisfactory virus protection. To maintain correct anti-virus capability, it is now necessary that the product be updated.
N/A None N/A N/AN/A5059 Error Exception in %1.Exe %n Exception details follow : %2
N/A OAS N/A N/AN/A5060 Error This product cannot be used on a NetApp filer's scanner server. %n NetShield for NetApp is required.
N/A OAS N/A N/AN/A5061 WarningFTL.DLL is missing from the product directory or is corrupted.%n On-Access scanning will continue, but no files or directories will be excluded from the scan.
N/AOAS N/AN/AN/A5062 Warning The version of FTL.DLL in the product directory is incorrect.%n  On-Access scanning will continue, but no files or directories will be excluded from the scan.
N/A None N/A N/AN/A5063ErrorMCSCAN32 : A scan request returned an error.%n Engine returned error : %1%n Scan Location : %3%n Object's name : %2%n
N/A OASN/A N/AN/A5064 Error MCSCAN32 : Failed to read virus names from extra.dat.%n  Engine returned error : %1%n
N/A OASN/A N/AN/A5065Warning The computer was started in safemode. McShield will not apply any Access Protection rules or enable Buffer Overflow Protection.%n


- wong chee tat :)

No comments: