Event Type: Audit Failure

Hi,

Further Update:

I have discovered the problem on my computer is not unique to Trusteer Rapport.  Yesterday I ran a Malwarebytes Anti-Malware scan and a Malwarebytes Anti-Rootkit scan and the Event Viewer reported these in similar fashion.

Looking at the Event Viewer logs, the pattern appears to be as the following sequence of events:

1)     the installation of the service starts and is recognised by the Event Viewer;

2)     the Event Viewer reports a code integrity problem etc.;

3)     the installation of the service is carried out again without problem.

The sequence of the three events may take from less than a minute to a minute and a half to complete with no other events appearing within that time slot.

The only Windows update I have installed since last month's Patch Tuesday updates was KB3162593 (Microsoft Silverlight update) - the Event Viewer problem seems to have started at about the time I installed the update.  It seems unlikely but could there be a link?

Please, I have had no feedback since Kumar's post and really would like to get to grips with this issue so if anyone has any ideas and advice I would be very grateful.

UPDATE of Situation:

Hi Kumar,

Thinking I had little to lose, I have tried fully uninstalling and reinstalling Trusteer Rapport.  If anything the situation has worsened with the following two reports appearing in the Event Viewer after bootup:

1)     Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name:    \Device\HarddiskVolume3\Program Files\Trusteer\Rapport\bin\RapportEI.sys

2)     Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name:    \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_1609041.sys 

Interestingly the original file is no longer reported.  IBM Trusteer seem to be at a loss regarding help and have urged me to contact Microsoft, which I have through this forum.  I am equally at a loss not knowing if the cause is with Trusteer Rapport or with  or the Microsoft Security Audit system.

Is it safe to continue using Trusteer Rapport, it seems to be working despite the Event Viewer reports?

Regards.

P.S.

Update to this update:Would you believe it but after next startup of the system, Event  Viewer  reported the original file once more but no longer reported the the two mentioned in this post.

Hi Kumar,

Thanks for your extensive reply.

I have carried out all of what you have suggested other than for my Avast 2016 anti-virus program I Have run a repair install rather than a full uninstall and reinstallation.  I have also run CCleaner and sfc /scannow (administrator privileges) but still the problem persists.

Despite the Event Viewer warning, Trusteer Rapport appears to run normally and I have noticed no other problems.  A Malwarebytes scan shows no threats and the Avast full system scan also reports no threats.

Perhaps this is something I will have to live with - if I did not regularly check the Event Viewer I would be none the wiser.  The problem seems to have occurred after the latest round of Windows updates but that is not to cite a Windows update as the cause because the security software has updated too.

Hello,

With the issue description, I understand that you are getting the error message after every start. I will certainly help you to fix the problem.

Event viewer logs shows that File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys

Trusteer Rapport is an anti-malware program offered by many banks to protect their customers online banking experience as a free add on - in some cases is required by the bank, to be installed prior to using their online services.

There might be problem with the security software or left over file in the startup causing this issue.

I would suggest you to temporarily disable the security software and check if it helps.

Method 1

On your Computer screen Task Bar next to System Clock, you will see the third-party Security Software Icon.

1. Click on the third-party Security Software Icon, you will see a pop up.

2. In that pop and select the option to disable, click on it.

When you disable Antivirus:

Important Note: Antivirus software can help protect your computer against viruses and other security threats. In most cases, you shouldn't disable your antivirus software. If you have to temporarily disable it to install other software, you should re-enable it as soon as you're done. If you're connected to the Internet or a network while your antivirus software is disabled, your computer is vulnerable to attacks.

If problem persist you may also try to reinstall the security software if you have any and check if it helps.

Method 2 CHKDSK 

The first possible reason for the issue could be hard drive errors. To check if your hard drive is causing the issue we can try running chkdsk command.

To run CHKDSK command

Click the Start, type cmd, cmd.exe will be shown above - right click on cmd.exe and select Run as administrator.

OK the UAC prompt if shown. That will open an elevated command prompt. (It will show Administrator in the caption.)

Then enter the chkdsk command

chkdsk c: /f (or other drive letter if applicable)

Confirm to run on next startup and reboot.

Computer can’t run a disk check while actively using Windows, but you can schedule it to start automatically the next time your computer is turned on.

When the disk check is finished, your computer will automatically reboot. The disk check will fix any problems it encounters in your hard

Disclaimer:

Important: While performing chkdsk on the hard drive if any bad sectors are found on the hard drive when chkdsk tries to repair that sector if any data available on that might be lost

Hope this helps. Please let us know the results. Feel free to write us back for any further assistance, we’ll be glad to assist you.

Regards