Issue
Windows Event Viewer shows Code Integrity errors (Event ID 3033) for ThreatDown DLL files on Windows endpoints. The events are logged under Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational and often appear in large numbers.
The event text looks like the following:
- Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
- Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\FRHook.dll that did not meet the Windows signing level requirements.
Cause
These events are expected Windows behavior for any non-Microsoft Antimalware Scan Interface (AMSI) provider.
mbamsi64.dll and FRHook.dll are ThreatDown DLLs validly signed by ThreatDown. A matching Event ID 3089 in the same log confirms the signature. The events do not indicate a fault, tampering, or a loss of protection.
Resolution
No action is required. These events can be safely ignored for mbamsi64.dll and FRHook.dll. ThreatDown protection continues to work normally.