Event ID 2004 — Definition Status

  • Article

Applies To: Windows Server 2008

Definition, or signature, updates are released frequently and are designed to help protect computers from new threats. Windows Defender should have a definition database that is less than 14 days old. Old signatures can be used but they do not detect the latest threats.

Event Details

Product: Windows Defender
ID: 2004
Source: Microsoft-Windows-Windows Defender
Version: 1.1
Symbolic Name: MALWAREPROTECTION_SIGNATURE_REVERSION
Message: %1 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
%tSignatures Attempted:%b%4
%tError Code:%b%5
%tError description:%b%6
%tSignatures loading:%b%8
%tLoading signature version:%b%9
%tLoading engine version:%b%10

Resolve

Update Definitions

To determine how to fix this error condition, examine the error code reported in the event message test.

The event message can report the following error codes:

  • ERROR_FILE_NOT_FOUND(0x80070002)
  • ERR_MP_BAD_DATABASE (0x80508002)
  • ERR_MP_BAD_UFS(0x80508004)
  • ERR_MP_BADDB_CONTENT (0x8050A004)
  • ERR_MP_BADDB_HEADER (0x8050A002)
  • ERR_MP_BADDB_NOTSIGNED (0x8050A005)
  • ERR_MP_BADDB_OLDENGINE (0x8050A003)

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

ERROR_FILE_NOT_FOUND

This error code indicates that Windows Defender could not find the necessary definition update files. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.
  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BAD_DATABASE (0x80508002)

This error code indicates that the digital signature on the definition update file is not valid. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.
  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BAD_UFS (0x80508004)

This error code indicates that the digital signature of the definition update file is not valid. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.
  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BADDB_CONTENT (0x8050A004)

This error code indicates that the digital signature of the definition update file is not valid. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.
  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To perform this procedure, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BADDB_HEADER (0x8050A002)

This error code indicates that the digital signature of the definition update file is not valid. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.
  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BADDB_NOTSIGNED (0x8050A005)

This error code indicates that the digital signature of the definition update file is not valid. You should try to update the definitions again.

To update the definitions by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.

  2. Click the down arrow next to the help icon, and then click Check for updates.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

  4. A message will appear in the notification area informing you that the updates have been installed.

  5. If the definition update is not successful, see the following procedure, "To update the definitions manually."

To update the definitions manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

ERR_MP_BADDB_OLDENGINE (0x8050A003)

This error code indicates that the scanning engine needs to be updated.

To update the scanning engine by using Windows Defender:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to the help icon, and then click Check for updates.
  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  4. A message will appear in the notification area informing you that the updates have been installed.

To update the scanning engine manually:

  1. Click Start, and then click Internet.

  2. Download the latest definition update file that is specific to your platform.

  3. Click Run to install this definition update immediately.

  4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

Verify

Windows Defender uses the scanning engine to run Windows Defender scans. To verify that the definition updates are valid and functioning correctly, you should run a Windows Defender quick scan.

To perform this procedure, you must be a member of the Users group, or you must have been delegated the appropriate authority.

To verify that the definitions updated successfully:

  1. Click Start, point to All Programs, and then click Windows Defender.
  2. Click the down arrow next to Scan, and then click Quick Scan.
  3. If the quick scan completes successfully, the scanning engine was updated successfully and is working correctly.

Definition Status

Windows Defender