SVCHOST file 64bit vs 32bit and SONAR SEP 12.1

Created: 16 Apr 2012 | Updated: 16 Apr 2012 | 2 comments

JackIII

I have a number of windows 7 PCs both 32bit and 64bit. Only the 64bit win 7 PCs generate the event below.

c:\windows\system32\svchost.exe(Microsoft® Windows® Operating System)
/0000000000000000000000000000000000000000000000000000000000000002

System Change Hostfile

Microsoft Corporation

6.1.7600.16385

c:\windows\system32\svchost.exe

My question is why only the 64bit win 7 PCs generate this event while the 32bit win 7 PCs do not?

Thank you

Discussion Filed Under:

Comments 2 Comments • Jump to latest comment

Thomas K Accredited

This might be related to a known issue with 12.1.

Ooyala Community Manager - Take our Video Poll

Mithun Sanghavi Symantec Employee Technical Support Accredited

Hello,

I completely Agree with Thomas.

Also, look at these Articles:

Symantec Endpoint Protection 12.1: Blocked System Change Events produce unexpected messages

Symantec Endpoint Protection 12.1: Manager Risk distribution summary report lists "Microsoft Windows Operating System" as a risk name

Hope that helps!!

Mithun Sanghavi
Symantec Technical Support Engineer, SEP
MIM | MCSA | MCTS | STS | ITIL v3

Twitter: @mithun_sanghavi

Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<&a