| Event Id | 64002 |
| Source | Windows File Protection |
| Description | File replacement was attempted on the protected system file acctres.dll. This
file was restored to the original version to maintain system stability. The file
version of the system file is 6.0.2600.0. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. |
| Event Information | This is an event generated by Windows File Protection. This feature will
protect your Operating System from deleting important system files such as SYS,
DLL, EXE, and OCX. True type fonts are also protected files (.ttf). The windows
file protection service is an "invisible" service that is enabled by
default and runs constantly in the background after a successful logon. (It does
not load in safe mode.). In case of deletion or renaming of these types of files
will be restored form the directory "Dllcache"(%SYSTEMROOT%\system32\dllcache)
and an Event ID 64002 will logged in to Event Viewer. Following article will more information about this event. |
| Reference Links | Windows file protection. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.