Event Type: Audit Failure

Anonymous
2016-06-30T20:24:37+00:00

Hi,

My System is Windows 7 SP1 Home Premium.  Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number     : 145537

Log Type          : Security

Event Type        : Audit Failure

Time              : 28/06/2016 18:57:39

Source            : Microsoft-Windows-Security-Auditing

Category          : 12290

Event ID          : 6281

User Name         :

Computer          : Chris-PC

Event Data Length : 0

Record Length     : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.    File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys 

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion.   Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive.  IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2016-07-31T03:11:24+00:00

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

Was this answer helpful?

0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-07-16T11:33:55+00:00

    Thank you Ratandeep and ElderN,

    You are both showing much fortitude in remaining on my case.  Regarding disabling driver signature enforcement, although I get the integrity warning about RapportIaso.sys in the Event Viewer, the driver loads successfully just afterwards.  The same was true for the Malwarebytes Anti-Rootkit file.  Rapport and Malwarebytes Anti-Rootkit have both worked correctly since the problem first occurred.

    I'm getting out of my comfort zone with all of this so I may soon call it it a day and put up with the warning but that is not to say I have not appreciated both your efforts on my behalf.  Even if the integrity warning is not resolved, I have picked up a lot and learned a few things so it won't have been a waste of time.  I will let you know when I finally give up.

    Cheers and regards.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-07-16T10:11:56+00:00

    Certainly the log is accessible:

    There don't appear to be any unsigned drivers (Unsigned:  0).

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-16T10:04:05+00:00

    Hello,

    Thank you for your reply.

    Unfortunately, log file is not accessible.

    You may also try starting Windows 7 in "Disable Driver Signature Enforcement" mode which allows drivers containing improper signatures to be installed.

    Afterwards, you may check the issue.

    Refer:

    https://support.microsoft.com/en-us/help/17419/windows-7-advanced-startup-options-safe-mode

    Thank you

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-16T09:41:39+00:00

    Those instructions in that link are for Windows XP and you are running Windows 7.

    The sigverif,exe program in Windows XP is not the same as Windows 7 so step 2 here will not work:

    To use the Sigverif.exe tool, follow these steps:

    1. Click Start, click Run, type sigverif in the Open box, and then click OK.
    2. Click Advanced, click Look for other files that are not digitally signed, click Browse, locate the Windows\System32\Drivers folder, and then click OK two times.
    3. Click Start.

    In Windows XP the Advanced options for sigverif  looks like this:

    As you may have discovered, there is no Look for other files that are not digitally signed in the Windows 7 version of sigverif.exe.

    Another wild goose chase.

    Was this answer helpful?

    0 comments