Hijin25 12 Posted June 18, 2017 Share Posted June 18, 2017 I have these audit error logs in the event viewer. Code integrity determined that the page hashes of an image file are invalid. The file could be incorrectly signed without page hashing or be corrupted due to an unauthorized modification. Invalid hashes could indicate a possible disk device error. File name: \ Device \ HarddiskVolume2 \ Program Files \ ESET \ ESET Smart Security \ Modules \ em023_64 \ 9584 \ em023_64.dll.raw Code integrity determined that the page hashes of an image file are invalid. The file could be incorrectly signed without page hashing or be corrupted due to an unauthorized modification. Invalid hashes could indicate a possible disk device error. File name: \ Device \ HarddiskVolume2 \ Program Files \ ESET \ ESET Smart Security \ Modules \ em023_64 \ 10375 \ em023_64.dll.raw What do they mean? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,072 Posted June 18, 2017 Administrators Share Posted June 18, 2017 Try checking your disk for errors by running chkdsk. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 19, 2017 Author Share Posted June 19, 2017 Run the scandisk and found no errors. I forgot to mention that the audit information indicates that each error was repeated 6 times, 12 records in a 2 minute interval. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 20, 2017 Author Share Posted June 20, 2017 I have uploaded the file "em023_64.dll.raw" to Virustotal and notes that the digital signature was not verified. Https://www.virustotal.com/es/file/4a11c562321f74256b6ed5f8877bc1a0d3d80b4aaa2a61354a066e74a6bdec6/analysis/ Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 21, 2017 ESET Moderators Share Posted June 21, 2017 Hello Hijin25, that is strange as those file are not loaded to run. We use them during the module updates, those are merged with small updates received and than they are build into the .dlls, which has valid digital signature. May I ask you to provide me with the exported log files, you mentioned to check? Thank you, P.R. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 21, 2017 Author Share Posted June 21, 2017 Excuse me, English is not my native language, I did not quite understand. What is it that I must share? Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 22, 2017 ESET Moderators Share Posted June 22, 2017 Hello Hijin25, we are interested in the exported log, where you found the mentioned entries. Thank you, P.R. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 22, 2017 Author Share Posted June 22, 2017 Forgive my ignorance, how do I export the record to share it? Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 23, 2017 ESET Moderators Share Posted June 23, 2017 Hello, Start -> type "Event Viewer" -> Windows logs; the one is probably in the Security logs, right click on it and select Save all events as, name the file, select location and confirm. Regards, P.R. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 23, 2017 Author Share Posted June 23, 2017 I hope this is what they need. Audit.rar Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 28, 2017 ESET Moderators Share Posted June 28, 2017 Hello Hijin25, from the log it seems that System process is accessing the files, not sure what for. Are you able to reproduce the issue on demand i.e. perform some steps that leads to mentioned log entries? We would need to know why is the System process trying to do so, if you can please capture events in the system by Process monitor as described here: http://support.eset.com/kb6308/ and send me a message with download link to the log to check. Thank you, P.R. Link to comment Share on other sites More sharing options...
Hijin25 12 Posted June 30, 2017 Author Share Posted June 30, 2017 Thank you for your attention, I regret the delay in responding. I think I've found the cause, audit errors appear during the full scan of Malwarebytes 2.2.1.1043. Link to comment Share on other sites More sharing options...
Recommended Posts