Event ID 64004-Windows File Protection

Event ID 64004-Windows File Protection

Post by Steve Derb » Fri, 17 Oct 2003 19:29:31

Browsing my event viewer, I see that in the last 4 days,
while I have been away, this event shows up *hundreds*,
maybe thousands of times. It seems the system (or
somebody) has been systematically going through Windows
2000 protected system files, and either not finding, or
finding and replacing, system files it says have no
signature. The system is running fine...I'm mostly
curious if this is something Windows would do on it's own,
or if it is and indication of some kind of virus or worm.
Any info would be most appreciated.


1. event id: 6015 event id: 9031 event id: 3028

2. Event ID 7000, Event ID 7009, Event ID 7031

We're reviewing our Server System logs and we're encountering the following
message mainly concerned with Event ID 7031.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031

The ReportServer service terminated unexpectedly. It has done this 3
time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service.

Is there any explaination to this event? I have a few guesses - a report
timing out (event id 7000 and 7009), or the reporting service db was
unavailable for some reason.

Any help is appreciated.



3. Re[2]: Got lost with event ID, command ID, window ID, wxEVT_USER_FIRST, wxID_LOWEST, wxID_Highest ?

4. Got lost with event ID, command ID, window ID, wxEVT_USER_FIRST, wxID_LOWEST, wxID_Highest ?

5. Windows cannot access the file C:\WINDOWS\system32\wuaueng.dll, Event ID 1005

6. HealthService event ID 1103 and Health Service Modules event ID 10102

7. Event ID 1004 and Event ID 1001 - W2K7 sp1 rollup 3

8. Event ID 9098 followed by Event ID 2114

9. Event ID : 6015 ; Event ID 3009

10. event ID 3002 on tcp.sys integrity and event ID 10 on WMI sesclu

11. catalog global - Event ID: 1126 or Event ID 1655

12. Event ID 13508 amd 16650, Event id 5504

13. MSExchange Transport : Event ID 977 followed by Event ID 978

14. Event ID 36 Source W3SVC / Event ID 10004 Source DCOM

15. Event ID: 17052 and Event ID: 322