Event Type: Audit Failure

Anonymous
2016-06-30T20:24:37+00:00

Hi,

My System is Windows 7 SP1 Home Premium.  Recently the Event Viewer has shown the following Audit failure after every fresh startup after the system has been powered off:

Record Number     : 145537

Log Type          : Security

Event Type        : Audit Failure

Time              : 28/06/2016 18:57:39

Source            : Microsoft-Windows-Security-Auditing

Category          : 12290

Event ID          : 6281

User Name         :

Computer          : Chris-PC

Event Data Length : 0

Record Length     : 352

Event Description : Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.    File Name: \Device\HarddiskVolume3\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys 

I have been in touch with IBM Trusteer Support but they have been unable to help - their initial suggestion was as follows:

In order to resolve this issue, please follow the steps below:
1. Run → Enter secpol.msc in the search box.
*Please note, that an error message may appear. Disregard it and wait for a few seconds until the "Local Security Policy" window appears. 
2.Open “Local Policies”.
3.Open “Audit Policy”.
4.Enter “Auditor privilege use”
5.Verify both check-boxes are unchecked.
6. Restart your computer.

However Windows 7 Home Premium does not have the the group policies editor 'secpol.msc' so I am unable to carry out their suggestion.   Because of this they advised I contact Microsoft.

I have ruled out 'disk error' by running HD Tune which found no errors on the hard drive.  IBM appear to have ruled out a problem with my malware protection (Avast 2016 anti-virus and Comodo Firewall) after I had sent the details to them.

The problem has occurred over the last few days (starting Monday 27 June 2016).

Any advice and suggestions would be much appreciated, thank you.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2016-07-31T03:11:24+00:00

Hello,

Thank you for keeping us updated.

It seems that the issue is resolved.

I appreciate your efforts and time.

Please do let us know if you need any assistance in regards to Windows.

Thank you

Was this answer helpful?

0 comments

60 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-07-11T12:09:42+00:00

    Hi ElderN,

    Thanks for your interest in my problem.  I have only a couple of files causing the the integrity problem in the Event Viewer at the moment.  The Trusteer Report file is cited on every startup, Malwarebytes Anti-Malware, being an on-demand scanner does not appear on startup but did have its driver file cited when I did a scan two days ago.  I tried to recreate that today but the Event Viewer showed no problems with it.  I also had an Event Viewer problem with Malwarebytes Anti-Rootkit two days ago but as with Malwarebytes Anti-Malware, it is an on-demand tool so is not reported during system startup but only when it is loaded. I repeated loading the Anti-Rootkit program today and Event Viewer did react by reporting the driver file as failing the integrity check just a few seconds after loading the service.  Up to now, no other files are being reported.

    I do not have a One Drive account but will give you a link for a folder containing the two files in question in my Dropbox account.  The link is:

    https://www.dropbox.com/sh/rrzs9twqkv75jha/AACouU0cEcZfxZKkmtqks7LIa?dl=0

    The two files are located at the following locations on my system:

    1)  C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\baseline\RapportIaso.sys

    2)  C:\Windows\System32\Drivers\mbamchameleon.sys

    Regards

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-07-11T09:38:56+00:00

    Would you be able to upload a few of those files to your OneDrive - maybe 3-5 files that are consistently reported as having the issue when you have that event.

    I had some idea and installed that software but don't have some of the folder/paths for the files you indicate but I'm not sure what I'm doing anyway...

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-11T09:11:04+00:00

    Hi Rantandeep,

    Unfortunately I have no restore points for the time before the problem first occurred.  I do have a Macrium Reflect backup image file of my C: partition but it is about six weeks old.  If absolutely necessary, I could use that but I hope there may be another way of resolving the issue before I take that step.  Whether the hassle of that sort of restoration is worth it, I'm not sure as the problem in the Event Viewer doesn't seem to be causing any difficulties in the general running of the computer.

    I hope there may be something as simple as a registry edit that could resolve the issue as clearly the files picked up by the integrity check are actually OK.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-11T08:59:58+00:00

    Hello,

    Thank you for responding.

    You may refer this article:

    http://www.dell.com/support/article/us/en/04/SLN85604?c=us&l=en&s=bsd&cs=04

    Please reply with results.

    Thank you

    Was this answer helpful?

    0 comments