We're seeing millions of events lately per day. McAfee KB84679 sounded just like it, but after applying that fix we are still seeing terabytes of events per day. ePO is filling up, and I am playing "whack-a-mole" trying to write new filter rules to block events. Have you seen anything similar that I can key off of and stop this event storm? Solidcore 188.8.131.520 on about 15,000 endpoint workstations, almost all Win7.