Event Type: Audit Failure

Anonymous

Hi,

My System is Windows 7 SP1 Home Premium. Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number : 145537

Log Type : Security

Event Type : Audit Failure

Time : 28/06/2016 18:57:39

Source : Microsoft-Windows-Security-Auditing

Category : 12290

Event ID : 6281

User Name :

Computer : Chris-PC

Event Data Length : 0

Record Length : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error. File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion. Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive. IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

0 comments

60 additional answers

Anonymous

2016-07-20T12:47:37+00:00

Hi Ratankeep,

Thank you for maintaining your interest in my problem and thanks for the link.

I have now looked at the performance monitor (another new introduction from you for me) and am investigating how I might use it - a bit more learning required by this 75 year old it seems.

My system continues to work smoothly although the Event Viewer items I reported in my very first post still occur at startup. Sometimes I get a similar set of reports appearing later in the Event Viewer if the computer remains on for a lengthy session. Always, however, the Trusteer Rapport service is reported as installed, the integrity error is then reported and then soon after the the Trusteer Rapport is reported as installed.

As my version of Windows 7 (Home Premium) does not support secpol.msc so I cannot access the local security policy, I wondered if I were to completely remove Trusteer Rapport (previously I tried a repair reinstallation) it would reset the local security policy. Then, if I were to install the latest version of trusteer rapport, would the code integrity check find no problem with the RapportIaso.sys file. Similarly, if I were to completely remove Malwarebytes Anti-Rootkit and then reinstall it, would the integrity check respond without the warning with the fresh files. I suppose the answer is to try these things but I'm not sure if something in the code integrity checker has been changed permanently and the reinstallations would have no affect.

Still the system works away quite happily, even with the warnings, so is further meddling going to be of benefit?

Cheers and regards.
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-20T07:33:59+00:00

Hello,

Thank you for the update.

I am sorry for late response.

I appreciate your efforts.

You may also take a look into performance monitor which is a simple yet powerful visualization tool for viewing performance data, both in real time and from log files. With it, you can examine performance data in a graph, histogram, or report.

Refer:

Using Performance Monitor

https://technet.microsoft.com/en-us/library/cc749115(v=ws.11).aspx

Thank you
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-16T13:43:58+00:00

Hi ElderN,

The problem is not specific to the IBM software as Malwarebytes Anti-Rootkit generates a similar integrity warning in the Event Viewer - I run Malwarebytes Anti-Rootkit only occasionally and it is not set to run from startup - Trusteer Rapport is set to run at startup so it appears in every Event Viewer check I carry out. However, as I have previously stated, within a few seconds to possibly a minute and a half later, the service concerned loads correctly. The sequence is: the Event Viewer reports the service as loading, the service sys file fails the integrity check, the service loads - this is true for both the IBM and the Malwarebytes service. It's a mystery compounded by the lack of means to check within the integrity checker (on Home Premium and lower versions of Windows 7).

Not to worry - it aint broke.

Cheers.
Was this answer helpful?

0 comments No comments
Anonymous

2016-07-16T12:46:53+00:00

I still don't know what the issue your system is having is about and can't reproduce it... I think the issue whatever it is is with the IBM software.

I'm just tagging along to run interference so you don't waste time on things to "try" that are not going to help.
Was this answer helpful?

0 comments No comments