Jump to content

Event ID 5038 Security-Auditing

Recommended Posts

Event ID 5038  Security-Auditing

I upgraded to latest version and i get Event ID 5038 Security-Auditing in Event log.
I uninstalled first the old version of ESET internet security and installed this latest version.
There are no problems with my disks. I have tested them thoroughly. Everything seems to work just fine.

I get this everytime i start my computer now after the upgrade.
How do i fix this error and what is it about?

Windows 10 Pro x64 18363. 752 version 1909
ESET Internet Security


Event ID 5038 Security-Auditing

Code Integrity has determined that the image hash for a file is invalid. The file may have been damaged by an unauthorized change or it may indicate a failure on the disk drive.

File Name: \ Device \ HarddiskVolume6 \ Program Files \ ESET \ ESET Security \ eamsi.dll

- System

   - Provider

    [Name] Microsoft-Windows-Security-Auditing
    [Guide] {54849625-5478-4994-a5ba-3e3b0328c30d}
    EventID 5038
    Version 0
    Level 0
    Task 12290
    Opcode 0
    Keywords 0x8010000000000000
   - TimeCreated

    [SystemTime] 2020-03-25T12: 53: 17.121712100Z
    EventRecordID 285207
   - Execution

    [ProcessID] 4
    [ThreadID] 460
    Channel Security


- EventData

   param1 \ Device \ Hard DiskVolume6 \ Program Files \ ESET \ ESET Security \ eamsi.dll


Link to comment
Share on other sites

This issue has already been reported in the forum. There is a hash problem with eamsi.dll. It does not affect its functionality in any way and the .dll is being loaded into applicable processes.

Link to comment
Share on other sites

  • 1 month later...

I've also had this issue with my desktop, but interestingly not my laptop.  

The desktop has NVIDEA which I've noticed has had this issue in the past, also the datestamp on the EAMSI.DLL is different on the two machines. 

Link to comment
Share on other sites

  • 1 month later...

To add a little more to this crazyness.

I am running ESET Endpoint Security 7.3.2036.0  And I am getting this hash error on a brand new imaged machine, where SCCM installed ESET in the process.

I then attempt to access a website that uses ADFS such as portal.office365.com, and I am unable to login.  This 5038 is generated everytime I try to access one of these websites.

I then uninstalled eset endpoint security and the agent, and then manually install the same version of ESET 7.3.2036.0 and I no longer get this error message in event viewer, I also am able to successfully authenticate when accessing an ADFS website.


Very ODD.

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...