When I open event viewer in Windows 11, I see too many errors and warnings in the summary of administrative events section, is this normal?
Question Is It Normal to Have Hundreds of Errors and Warnings in Event Viewer?
- Thread starter lokamoka820
- Start date
Windows 11
11 Replies
1,759 Views
Help answer the author's question with clear explanations and useful steps.
VERY VERY NORMAL. That's the BEST SINGLE TRICK that scammers use on older users and people who are not tech savy. They contact you, ask you to open up event viewer and point to the number of errors then they either state that it's due to you haveing a virus or that your system is corrupted. So the only way to fix it is to let them remote into your PC or sell you specific scareware software. Although this method is not being used as often as it used to be back in the 2010's. Now Ransomware is the king .
Its the reason I never look in the Event Viewer. 
The security related Event ID's that you need to make Custom Views for are below. When you define a custom view, you can just click on it to list out occurances of that particular event ID.
For instance, when a malware tries to install a service, it generates a 4697 event ID.
And when malware makes a new scheduled task, it generates a 4698 event ID.
You need to periodically examine your logs to make sure nothing has gotten thru. Anti-malware detection can Fail. All the malware-writer has to do is tweak his code a little, and it will escape automatic detection.
For instance, when a malware tries to install a service, it generates a 4697 event ID.
And when malware makes a new scheduled task, it generates a 4698 event ID.
You need to periodically examine your logs to make sure nothing has gotten thru. Anti-malware detection can Fail. All the malware-writer has to do is tweak his code a little, and it will escape automatic detection.
Last edited:
Scammers tried that trick on me many years ago, I just kept them on hold pretending to agree to to what they wanted me to do. After a while they just hung up realising that I was wasting their time.
So I have to compare my logs with all this IDs? Isn't this a long process?The security related Event ID's that you need to make Custom Views for are below. When you define a custom view, you can just click on it to list out occurances of that particular event ID.
For instance, when a malware tries to install a service, it generates a 4697 event ID.
And when malware makes a new scheduled task, it generates a 4698 event ID.
You need to periodically examine your logs to make sure nothing has gotten thru. Anti-malware detection can Fail. All the malware-writer has to do is tweak his code a little, and it will escape automatic detection.
length of the process is directly proportional to your knowledge of writing macros/python. It can be easy do it once and just feed it or a grueling process of importing into Excel and filter.
Good to know that I can automate the process with Python, this will make it easier.
You can easily search through your eventlog with Nirsoft's FullEventLogView. 
(error is because I disabled DNS cache service)
(error is because I disabled DNS cache service
)
You always recommend nifty software, thank you.You can easily search through your eventlog with Nirsoft's FullEventLogView.
View attachment 284369
(error is because I disabled DNS cache service
Recently browsing
Members who viewed this thread in the last 5 minutes
You may also like...
-
-
New Update GNOME 50 released, this is what’s new - S
-
-
