Jump to content

Recommended Posts

Event ID 5038  Security-Auditing


I upgraded to latest version 13.1.16.0 and i get Event ID 5038 Security-Auditing in Event log.
I uninstalled first the old version of ESET internet security and installed this latest version.
There are no problems with my disks. I have tested them thoroughly. Everything seems to work just fine.

I get this everytime i start my computer now after the upgrade.
How do i fix this error and what is it about?


Windows 10 Pro x64 18363. 752 version 1909
ESET Internet Security 13.1.16.0

 

Event ID 5038 Security-Auditing


Code Integrity has determined that the image hash for a file is invalid. The file may have been damaged by an unauthorized change or it may indicate a failure on the disk drive.

File Name: \ Device \ HarddiskVolume6 \ Program Files \ ESET \ ESET Security \ eamsi.dll


- System

   - Provider

    [Name] Microsoft-Windows-Security-Auditing
    [Guide] {54849625-5478-4994-a5ba-3e3b0328c30d}
 
    EventID 5038
 
    Version 0
 
    Level 0
 
    Task 12290
 
    Opcode 0
 
    Keywords 0x8010000000000000
 
   - TimeCreated

    [SystemTime] 2020-03-25T12: 53: 17.121712100Z
 
    EventRecordID 285207
 
    correlation
 
   - Execution

    [ProcessID] 4
    [ThreadID] 460
 
    Channel Security
 
    Computer
 
    Security

 

- EventData

   param1 \ Device \ Hard DiskVolume6 \ Program Files \ ESET \ ESET Security \ eamsi.dll

 

Share this post


Link to post
Share on other sites

This issue has already been reported in the forum. There is a hash problem with eamsi.dll. It does not affect its functionality in any way and the .dll is being loaded into applicable processes.

Share this post


Link to post
Share on other sites

Ok thanks for the answer.

Share this post


Link to post
Share on other sites

I've also had this issue with my desktop, but interestingly not my laptop.  

The desktop has NVIDEA which I've noticed has had this issue in the past, also the datestamp on the EAMSI.DLL is different on the two machines. 

Share this post


Link to post
Share on other sites

To add a little more to this crazyness.

I am running ESET Endpoint Security 7.3.2036.0  And I am getting this hash error on a brand new imaged machine, where SCCM installed ESET in the process.

I then attempt to access a website that uses ADFS such as portal.office365.com, and I am unable to login.  This 5038 is generated everytime I try to access one of these websites.

I then uninstalled eset endpoint security and the agent, and then manually install the same version of ESET 7.3.2036.0 and I no longer get this error message in event viewer, I also am able to successfully authenticate when accessing an ADFS website.

 

Very ODD.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...