none
System Event Log - Unusual Timestamp sequence RRS feed

  • Question

  • Windows 8.1 Pro 64-bit, Opteron 2280

    These system events

    6009 = OS Version

    6005 = Event Log service has started

    6013 = system uptime

    are being inserted into the system even log (before system was last shutdown) apparently just above event 50037 DHCPv4 Client service is stopped.

    According to the timestamps. The rogue events should appear after Directory-Services-SAM 16962. which has an earlier timestamp than event 6009 which should be the very first entry after the previous shutdown event.

    Viewing events from newest to oldest

    I hadn't noticed this before but it's been there since I installed and activated it last year. At first I thought it might be an infected WLAN driver, but security software (including MSRT) has not picked up anything abnormal.

    Fast Startup is disabled. It made no difference when it was enabled.

    What might be the cause of this behaviour?



    Thursday, December 7, 2017 2:12 PM

All replies

  • Hi,

    Did the rogue events occur every times when you start PC?

    Could you provide the rogue events? Upload them onto OneDrive and share link here.

    Note: If the events contain the privacy information, please hide it.

    And you could also try to use clean boot to see if the event still will be created.

    Here is a link about clean boot.

    How to perform a clean boot in Windows:

    https://support.microsoft.com/en-in/help/929135/how-to-perform-a-clean-boot-in-windows


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Proposed as answer by Vera Hu Monday, December 11, 2017 1:32 AM
    Friday, December 8, 2017 6:44 AM