Jump to content

Security audit error.


Recommended Posts

I have these audit error logs in the event viewer.

Code integrity determined that the page hashes of an image file are invalid. The file could be incorrectly signed without page hashing or be corrupted due to an unauthorized modification. Invalid hashes could indicate a possible disk device error.

File name: \ Device \ HarddiskVolume2 \ Program Files \ ESET \ ESET Smart Security \ Modules \ em023_64 \ 9584 \ em023_64.dll.raw

Code integrity determined that the page hashes of an image file are invalid. The file could be incorrectly signed without page hashing or be corrupted due to an unauthorized modification. Invalid hashes could indicate a possible disk device error.

File name: \ Device \ HarddiskVolume2 \ Program Files \ ESET \ ESET Smart Security \ Modules \ em023_64 \ 10375 \ em023_64.dll.raw

What do they mean?

Link to comment
Share on other sites

Run the scandisk and found no errors. I forgot to mention that the audit information indicates that each error was repeated 6 times, 12 records in a 2 minute interval.

Link to comment
Share on other sites

  • ESET Moderators

Hello Hijin25,

that is strange as those file are not loaded to run.

We use them during the module updates, those are merged with small updates received and than they are build into the .dlls, which has valid digital signature.

May I ask you to provide me with the exported log files, you mentioned to check? 

Thank you, P.R.

Link to comment
Share on other sites

  • ESET Moderators

Hello,

Start -> type "Event Viewer" -> Windows logs; the one is probably in the Security logs, right click on it and select Save all events as, name the file, select location and confirm.

Regards, P.R.

Link to comment
Share on other sites

  • ESET Moderators

Hello Hijin25,

from the log it seems that System process is accessing the files, not sure what for.

Are you able to reproduce the issue on demand i.e. perform some steps that leads to mentioned log entries?

We would need to know why is the System process trying to do so, if you can please capture events in the system by Process monitor as described here: http://support.eset.com/kb6308/ and send me a message with download link to the log to check.

Thank you, P.R.

Link to comment
Share on other sites

Thank you for your attention, I regret the delay in responding.

I think I've found the cause, audit errors appear during the full scan of Malwarebytes 2.2.1.1043.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...