Event Log Message: Event ID 5038 Code integrity determined that the image hash of a file is not valid. File: symamsi64.dll

Products

• Endpoint Security
• Endpoint Security Complete

Issue/Introduction

• Windows Security Event log shows an error:

  Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
  
  File Name:	symamsi64.dll

   

• Potential failed logins with the error “The security log on this system is full. Only administrators can log on to fix the problem”
  
  
• What is symamsi64.dll?
  • symamsi64.dll is one of the binary files that has registered as the Antimalware Scan Interface (AMSI) provider. AMSI is a built-in Windows security feature that acts as a bridge between applications (like PowerShell, Office macros, or VBScript) and antivirus/security software installed on the machine. When a script is executed, Windows calls upon the registered AMSI provider to scan the script's content for malicious behavior before allowing it to run.

  • This is one of several hooks used to monitor the OS level operations for behavior monitoring to assist with protection from ransomware, zer0-days, slow infectors and assist with machine learning detections and tuning. 

  • The DLL monitors various calls that can help stop droppers from living off the land attempts, memory hallowing, process jumping etc to keep normal Windows operations from being hijacked or used to output malware code.

Environment

Symantec Endpoint Security

Cause

Windows uses Signing Levels to enforce system security and control which AMSI provider can load into which processes. The binary (symamsi64.dll) is signed at Level 8, meaning Windows allows it to load into AM-PPL processes, but not OS-protected processes which are Signing Level 11 or higher.

When an OS-protected process attempts to run a script or macro Windows attempts to load symamsi64.dll, and code integrity checks are run. This generates the Windows Security Event log error. This process is managed natively by the Windows operating system, which dictates the loading sequence and integrity requirements for all AMSI providers.

Resolution

This is an expected behavior controlled and enforced by Microsoft. The event indicates that Windows is functioning as currently designed by preventing a lower-level signed DLL from loading into a highly protected OS process.

SEP 16 (Endpoint Security Agent) functionality is not impacted.

You can disable the logging of these Events in Windows, or set the Windows Logs to auto-rotate

Option 1: Disable the Code Integrity events

1. Open Event Viewer
2. Expand Applications and Services Logs > Microsoft -> Windows -> CodeIntegrity -> Operational -> Right Click > Disable Log
   

Additionally, if concerns over the number of events, or a Failed login due to the log being full, you can set the log to auto-rotate.

Option 2: Configure "Maximum Log Size" and "Overwrite events as needed (oldest events first)"

1. Open the Microsoft Event Viewer
2. Expand Applications and Services Logs > Microsoft -> Windows -> CodeIntegrity -> Operational -> Right Click > Properties
3. Set the maximum log value size to the desired value (1028 KB is the default)
4. If desired, set the "Overwrite events as needed (oldest events first)" setting.
   

Additional Information

How to fix The security log on this system is full. Only administrators can log on to fix the problem