EventID 11 ;guard32.dll String acaptuser32.dll

Hi All
I have a problem in the eventviewer and it relates to the installed firewall;
[i]+ System

  • Provider

[ Name] Microsoft-Windows-Wininit
[ Guid] {206F6DEA-D3C5-4D10-BC72-989F03C8B84B}

EventID 11

Version 0

Level 3

Task 0

Opcode 0

Keywords 0x4000000000000000

  • TimeCreated

[ SystemTime] xx

EventRecordID 23379


  • Execution

[ ProcessID] 440
[ ThreadID] 464

Channel System

Computer xx

  • Security

[ UserID] S-1-5-18

  • EventData

    StringCount 2
    String C:\Windows\system32\guard32.dll
    String acaptuser32.dll
    Would someone be able to give a hand to solve this?


It’s not a “problem” as such. Event 11 is just a warning that a DLL is being globally injected by using the “AppInit” method, something that Microsoft no longer recommends and thus warns about.

GUARD32.DLL is part of CIS and ACAPTUSER.DLL is part of Adobe’s 3D Capture, they’re not related.

Thanks for your prompt reply, very much appreciated.
Is there a way to turn this off somewhere?

You can disable it somewhere.

When disabling the injection of guard32.dll you will get more alerts from CIS.

What is having you worried about the event being logged by Windows?

Just the fact of having an error in the event viewer and possible slow downs on boot-up?

I seriously doubt that would slow down boot performance.

Thanks. I’ll consider this solved.