Appendix 6. Application events in the Windows Event Log

201

End User License Agreement violated

203

License has almost expired

–

204

License expires soon

–

206

Databases are missing or corrupted

–

207

Databases are extremely out of date

–

208

Databases are out of date

–

209

Application autorun is disabled

–

210

Automatic updates are disabled

–

211

Self-Defense is disabled

–

212

Task cannot run

–

213

The operation with application resources is blocked by Self-Defense

–

214

Protection components are disabled

–

215

Computer is running in safe mode

–

216

There are unprocessed files

–

217

Report cleared

218

Application settings changed

219

Group policy applied

220

Group policy disabled

–

221

Task started

–

222

Task stopped

–

223

Task completed

–

224

Restart the application to complete the update

–

225

Computer restart required

226

The license allows the use of components that have not been installed

–

227

Installed components match the license

–

229

Activation error

230

Incorrect reserve activation code

–

231

Active threat detected Advanced Disinfection must be started

–

232

Advanced Disinfection started

–

233

Advanced Disinfection completed

–

235

Application started

236

Application stopped

237

Application crashed during previous session

240

License expires soon

238

Subscription settings have changed

239

Subscription has been renewed

335

Object restored from Backup

336

Cannot restore object from Backup

245

Processing of some OS functions is disabled

250

Encrypted connection terminated

708

Task settings applied successfully

–

335

Object restored from Backup

2000

Enter a user name and password

–

2001

Suspicious network activity detected

–

2020

Participation in KSN is enabled

–

2021

Participation in KSN is disabled

–

2022

KSN servers available

–

2023

KSN servers unavailable

–

2024

The application works and processes data under relevant laws and uses the appropriate infrastructure

227

All application components that are defined by the license have been installed and run in normal mode

–

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

307

Object deleted

–

308

A backup copy of the object was created

–

311

Cannot create a backup copy

–

313

Cannot be deleted

–

323

Object will be deleted on restart

–

329

Object renamed

–

331

Blocked

–

452

Process terminated

–

453

Cannot terminate the process

–

455

Rollback completed

–

458

Registry value restored

–

459

Registry value deleted

–

453

File/code execution blocked

–

302

Malicious object detected

–

331

Blocked

–

455

Rollback completed

–

323

Object will be deleted on restart

–

307

Object deleted

–

329

Object renamed

–

457

File restored

–

458

Registry value restored

–

459

Registry value deleted

–

301

Object processed

–

302

Malicious object detected

–

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

306

Object disinfected

–

307

Object deleted

–

308

A backup copy of the object was created

–

310

Cannot create a backup copy

–

312

Disinfection not possible

–

313

Cannot be deleted

–

314

Object not processed

–

315

Object skipped

–

317

Processing error

318

Archive detected

–

319

Packed object detected

–

320

Object encrypted

–

321

Object corrupted

–

322

Password-protected archive detected

–

323

Object will be deleted on restart

–

324

Object will be disinfected on restart

–

327

Overwritten by a copy that was disinfected earlier

–

332

Information about detected object

–

335

Object restored from Backup

–

336

Cannot restore object from Backup

340

Object is on the Private KSN allowlist

401

Application placed in the trusted group

–

402

Application placed in restricted group

–

403

Host Intrusion Prevention was triggered

–

452

Process terminated

–

453

Cannot terminate the process

–

302

Malicious object detected

317

Processing error

336

Cannot restore object from Backup

340

Object is on the Private KSN allowlist

301

Object processed

–

306

Object disinfected

–

307

Object deleted

–

308

A backup copy of the object was created

–

310

Cannot create a backup copy

–

312

Disinfection not possible

–

313

Cannot be deleted

–

314

Object not processed

–

315

Object skipped

–

318

Archive detected

–

319

Packed object detected

–

320

Object encrypted

–

321

Object corrupted

–

322

Password-protected archive detected

–

323

Object will be deleted on restart

–

324

Object will be disinfected on restart

–

325

Overwritten by a copy that was disinfected earlier

–

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

329

Object renamed

–

335

Object restored from Backup

–

452

Process terminated

–

453

Cannot terminate the process

–

332

Information about detected object

–

301

Object processed

–

302

Malicious object detected

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

317

Processing error

318

Archive detected

–

319

Packed object detected

–

321

Object corrupted

–

322

Password-protected archive detected

–

329

Object renamed

–

362

Dangerous link blocked

1201

Previously opened dangerous link detected

1211

Previously opened malicious link detected

363

Dangerous link opened

341

Object download was blocked

–

370

Link is on the Private KSN allowlist

370

Object is on the Private KSN allowlist

332

Information about detected object

–

301

Object processed

–

306

Object disinfected

–

302

Malicious object detected

317

Processing error

340

Object is on the Private KSN allowlist

307

Object deleted

–

308

A backup copy of the object was created

–

312

Disinfection not possible

–

314

Object not processed

–

318

Archive detected

–

319

Packed object detected

–

321

Object corrupted

–

322

Password-protected archive detected

–

329

Object renamed

–

303

Detected legitimate software that can be used by intruders to damage your computer

–

332

Information about detected object

–

601

Network activity allowed

–

602

Network activity blocked

–

651

Network attack detected

–

2050

Keyboard authorized

–

2051

Keyboard not authorized

2052

Keyboard authorization error

301

Object processed

–

302

Malicious object detected

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

314

Object not processed

–

315

Object skipped

–

317

Processing error

318

Archive detected

–

319

Packed object detected

–

320

Object encrypted

–

321

Object corrupted

–

322

Password-protected archive detected

–

1512

The object scan result has been sent to a third-party application

–

329

Object renamed

–

332

Information about detected object

–

340

Object is on the Private KSN allowlist

2200

AMSI request blocked

701

Application startup allowed

–

702

Application startup prohibited

–

703

Application startup prohibited in test mode

–

704

Application startup allowed in test mode

–

707

Error in task settings. Task settings not applied

–

710

Prohibited process was started before Kaspersky Endpoint Security for Windows was started

–

708

Task settings applied successfully

–

801

Operation with the device allowed

–

802

Operation with the device prohibited

–

803

Temporary access to device activated

808

File operation performed

–

809

Network connection blocked

–

751

Access allowed

–

752

Access blocked

–

753

Warning about undesirable content

–

754

Undesirable content was accessed after a warning

–

751

Allowed page opened

–

501

Complaint of blocked application activity

–

2201

Process action skipped

–

2200

Process action blocked

904

Error applying file encryption/decryption rules

912

File encryption/decryption error

1305

Error encrypting/decrypting device

931

Error creating encrypted package

951

Error enabling portable mode

953

Error disabling portable mode

1311

Failed to load encryption module

1340

The task for managing Authentication Agent accounts ended with an error

1312

Policy cannot be applied

1342

FDE upgrade failed

1343

FDE upgrade rollback successful

1345

Failed to install or upgrade Kaspersky Disk Encryption drivers in the WinRE image

1346

Failed to uninstall Kaspersky Disk Encryption drivers from the WinRE image

1370

BitLocker recovery key was changed

901

Started applying file encryption/decryption rules

–

902

Finished applying file encryption/decryption rules

–

903

Interrupted applying file encryption/decryption rules

–

905

Resumed applying file encryption/decryption rules

–

910

File encryption/decryption started

–

911

File encryption/decryption completed

–

913

File has not been encrypted because it is an exclusion

–

914

File encryption/decryption interrupted

–

1301

Device encryption/decryption started

–

1302

Device encryption/decryption completed

–

1307

Device is not encrypted

–

1303

Device encryption/decryption interrupted

–

1304

Device encryption/decryption resumed

–

1309

Drive encryption/decryption process has been switched to passive mode

–

1308

Device encryption/decryption process has been switched to active mode

–

1306

User has opted out of the encryption policy

–

940

File access blocked

950

Portable mode enabled

–

952

Portable mode disabled

–

1330

New Authentication Agent account created

–

1337

Account not added. This account already exists

–

1338

Account not modified. This account does not exist

–

1339

Account not deleted. This account does not exist

–

1331

Authentication Agent account deleted

–

1332

Authentication Agent account password changed

–

1334

Failed Authentication Agent login attempt

–

1333

Successful Authentication Agent login

–

1335

Hard drive accessed using the procedure of requesting access to encrypted devices

–

1336

Failed attempt to access the hard drive using the procedure of requesting access to encrypted devices

–

1310

Encryption module loaded

–

1344

Full Disk Encryption upgrade rollback completed with an error

1341

FDE upgrade successful

1332

Authentication Agent account password changed

–

2100

Kaspersky Anti Targeted Attack Platform server unavailable

–

2105

Application startup was blocked

2106

Document opening was blocked

2104

Tasks from the Kaspersky Anti Targeted Attack Platform server are being processed

–

2103

Processing of tasks from the Kaspersky Anti Targeted Attack Platform server is inactive

–

2101

Endpoint Sensors connected to server

–

2102

Connection to the Kaspersky Anti Targeted Attack Platform server restored

–

2112

All processes started from a file image or stream were terminated

2113

Application started

2111

File or stream was deleted by the Kaspersky Anti Targeted Attack Platform server administrator

2110

File was restored from quarantine on the Kaspersky Anti Targeted Attack Platform server by the administrator

2109

File is quarantined on the Kaspersky Anti Targeted Attack Platform server by administrator

2107

Network activity of all third-party applications is blocked

2108

Network activity of all third-party applications is unblocked

302

Malicious object detected

335

Object restored from Backup

336

Cannot restore object from Backup

340

Object is on the Private KSN allowlist

301

Object processed

–

329

Object renamed

–

306

Object disinfected

–

307

Object deleted

–

308

A backup copy of the object was created

–

310

Cannot create a backup copy

–

312

Disinfection not possible

–

313

Cannot be deleted

–

314

Object not processed

–

315

Object skipped

–

317

Processing error

–

318

Archive detected

–

319

Packed object detected

–

320

Object encrypted

–

321

Object corrupted

–

322

Password-protected archive detected

–

323

Object will be deleted on restart

–

324

Object will be disinfected on restart

–

327

Overwritten by a copy that was disinfected earlier

–

303

Detected legitimate software that can be used by intruders to damage your computer or personal data

–

2002

System module signature check failed

–

101

An internal error has occurred

1001

Update source selected

–

1002

Proxy server selected

–

1003

File download

–

1004

File downloaded

–

1005

File installed

–

1006

File updated

–

1007

File rolled back due to update error

–

1008

Updating files

–

1009

Distributing updates

–

1010

Rolling back files

–

1011

Error updating component

–

1012

Error distributing component updates

–

1013

Creating the list of files to download

–

1014

Local update error

–

1016

Operation canceled by the user

–

1017

Cannot start two tasks at the same time

–

1018

Error verifying application databases and modules

–

1019

Error in interaction with Kaspersky Security Center

–

1020

No available updates

–

1021

Not all components were updated

–

1022

Update distribution completed successfully

–

1023

Update completed successfully, update distribution failed

–

2153

Patch installation failed

–

2156

Patch rollback failed

–

2150

Downloading patches

–

2151

Installing patches

–

2152

Patch installed

–

2154

Rolling back patch

–

2155

Patch rolled back

–

223

Task completed

–

221

Task started

–

222

Task stopped

–

2252

The object cannot be deleted

–

2253

Wipe task statistics

–

2251

Object deleted

–