Security Audit Failure (Event Viewer) tcpip.sys hash not valid/cor

[Guest artfuldodga]

Code integrity determined that the image hash of a file is not valid. The

file could be corrupt due to unauthorized modification or the invalid hash

could indicate a potential disk device error.

 

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys

 

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 8/11/08 3:35p

Event ID: 5038

Task Category: System Integrity

Level: Information

Keywords: Audit Failure

User: N/A

Computer: XPS1530-PC

Description:

Code integrity determined that the image hash of a file is not valid. The

file could be corrupt due to unauthorized modification or the invalid hash

could indicate a potential disk device error.

 

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing"

Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

<EventID>5038</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>12290</Task>

<Opcode>0</Opcode>

<Keywords>0x8010000000000000</Keywords>

<TimeCreated SystemTime="2008-11-08T19:05:00.227Z" />

<EventRecordID>27081</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="56" />

<Channel>Security</Channel>

<Computer>XPS1530-PC</Computer>

<Security />

</System>

<EventData>

<Data

Name="param1">\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys</Data>

</EventData>

</Event>

 

OS Vista Ultimate SP1

 

I have no idea why this failure is showing up, is there a specific service

needed for the audit success? Other than seeing the error(s) occur via Event

Viewer, I have not had any issues with connectivity, and other security

audits complete fine without failure. Anyone have any ideas what might fix

this? I do not believe I modified the tcpip.sys in any way

[Guest Engel]

See if the information in this article, "How to Repair and Verify the

Integrity of Vista System Files with System File Checker"

 

<http://www.vistax64.com/tutorials/66978-system-files.html>

 

Good luck

 

 

Ǝøçεl

-=-

 

 

"artfuldodga" wrote:

<span style="color:blue">

> Code integrity determined that the image hash of a file is not valid. The

> file could be corrupt due to unauthorized modification or the invalid hash

> could indicate a potential disk device error.

>

> File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys

>

> Log Name: Security

> Source: Microsoft-Windows-Security-Auditing

> Date: 8/11/08 3:35p

> Event ID: 5038

> Task Category: System Integrity

> Level: Information

> Keywords: Audit Failure

> User: N/A

> Computer: XPS1530-PC

> Description:

> Code integrity determined that the image hash of a file is not valid. The

> file could be corrupt due to unauthorized modification or the invalid hash

> could indicate a potential disk device error.

>

> File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys

> Event Xml:

> <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

> <System>

> <Provider Name="Microsoft-Windows-Security-Auditing"

> Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

> <EventID>5038</EventID>

> <Version>0</Version>

> <Level>0</Level>

> <Task>12290</Task>

> <Opcode>0</Opcode>

> <Keywords>0x8010000000000000</Keywords>

> <TimeCreated SystemTime="2008-11-08T19:05:00.227Z" />

> <EventRecordID>27081</EventRecordID>

> <Correlation />

> <Execution ProcessID="4" ThreadID="56" />

> <Channel>Security</Channel>

> <Computer>XPS1530-PC</Computer>

> <Security />

> </System>

> <EventData>

> <Data

> Name="param1">DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys</Data>

> </EventData>

> </Event>

>

> OS Vista Ultimate SP1

>

> I have no idea why this failure is showing up, is there a specific service

> needed for the audit success? Other than seeing the error(s) occur via Event

> Viewer, I have not had any issues with connectivity, and other security

> audits complete fine without failure. Anyone have any ideas what might fix

> this? I do not believe I modified the tcpip.sys in any way</span>

[Guest Paul Shapiro]

Interesting. My Vista 64 SP1 crashed two days ago for the first time in

months, and reported the same error with the same file. It just happened

once so I didn't investigate further. Seems to have been working fine since

then and no more error message in the event log. I wondered if was

antivirus-related? I have Trend Micro plus Windows Defender. Anything sound

familiar?

 

"Engel" <Engel@discussions.microsoft.com> wrote in message

news:8B730BEF-0E34-4965-B8E0-0B5742ACA61A@microsoft.com...<span style="color:blue">

>

> See if the information in this article, "How to Repair and Verify the

> Integrity of Vista System Files with System File Checker"

>

> <http://www.vistax64.com/tutorials/66978-system-files.html>

>

> Good luck

>

>

> Ǝøçεl

> -=-

>

>

> "artfuldodga" wrote:

><span style="color:green">

>> Code integrity determined that the image hash of a file is not valid.

>> The

>> file could be corrupt due to unauthorized modification or the invalid

>> hash

>> could indicate a potential disk device error.

>>

>> File Name: DeviceHarddiskVolume3WindowsSystem32driverstcpip.sys

>>

>> Log Name: Security

>> Source: Microsoft-Windows-Security-Auditing

>> Date: 8/11/08 3:35p

>> Event ID: 5038

>> Task Category: System Integrity

>> Level: Information

>> Keywords: Audit Failure

>> User: N/A

>> Computer: XPS1530-PC

>> Description:</span></span>

<span style="color:blue"><span style="color:green">

>> OS Vista Ultimate SP1

>>

>> I have no idea why this failure is showing up, is there a specific

>> service

>> needed for the audit success? Other than seeing the error(s) occur via

>> Event

>> Viewer, I have not had any issues with connectivity, and other security

>> audits complete fine without failure. Anyone have any ideas what might

>> fix

>> this? I do not believe I modified the tcpip.sys in any way </span></span>

[Guest artfuldodga]

RE: Security Audit Failure (Event Viewer) tcpip.sys hash not valid

 

yeah so the results of the manual check.

 

Microsoft Windows [Version 6.0.6001]

Copyright

[Guest Allan]

Re: Security Audit Failure (Event Viewer) tcpip.sys hash not valid

 

"artfuldodga" <artfuldodga@discussions.microsoft.com> wrote in message

news:BCDD2D91-75C1-4695-9C7C-B1EA98AEAEFC@microsoft.com...<span style="color:blue">

> yeah so the results of the manual check.

>

> Microsoft Windows [Version 6.0.6001]

> Copyright