Couple questions. Does this event ID appear once or recurring? Also, in the Liveupdate policy do you have content or product updates checked, or is it just definitions? If you have LiveUpdate downloading product updates, I would turn it off as a test, clear the event log and see if the Event ID error returns. At least you'll know where it's coming from and at that point you can formulate a game plan