What does NTSTATUS 0xC0000906 (STATUS_VIRUS_INFECTED) mean?

STATUS_VIRUS_INFECTED

What STATUS_VIRUS_INFECTED means

STATUS_VIRUS_INFECTED (0xC0000906) means an operation did not complete because the file was identified as containing a virus or potentially unwanted software. The result is about the security verdict on the file involved in the operation; it is not limited to launching an executable.

Evidence to preserve

• Record the exact file path or object, the operation that was blocked, and the first component that returned the status.
• Correlate the event with the security product's detection name, action, quarantine or remediation result, and timestamp.
• If the file is expected to be trusted, preserve its provenance and identity before replacing or submitting it for analysis.

Safe recovery

Use the security product's supported remediation or replace the file from a known-good source. Do not disable protection merely to make the operation succeed. If a false positive is suspected, resolve the detection through the product's normal verification or submission workflow while keeping the original evidence.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values