Vista - Event viewer security audit failures

**swarfega** · 10-17-2008

I was viewing the security logs in event viewer today (exciting I know!) when I noticed some audit failures. I like things running smoothly so this irked me a little.

I have a number relating to tcp/ip:

Quote:

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume1\Windows\System32\drivers\aswSP.sys

Quote:

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

Quote:

Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Error Code: 2

I no longer use windows firewall as I now use nod32 smart security, but the tcp/ip error concerns me.

**Flavius** · 10-22-2008

Quote:

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume1\Windows\System32\drivers\aswSP.sys

+

Quote:

I now use nod32 smart security

But first error message concern Avast.Make sure you uninstalled Avast exactly - I think isn't.Does exist avast folder on your computer?-If exist remove it

**swarfega** · 10-22-2008

Ive not had avast on here for some time.

**Flavius** · 10-22-2008

Quote:

Ive not had avast on here for some time

OK.But you surly still have empty values leaved by Avast.If you want to stop appear error message about it go to HKLM\System\CurrentControlSet\Services and find there subkey which include aswSP.sys and remove it,you can use RunAlyzer-> The home of Spybot-S&D! which help you to easy find this empty key

**swarfega** · 10-22-2008

Ive managed to delete most of the avast entries. I really need a good program that can check for orphans and remove them.

10-17-2008	#1 (permalink)
swarfega Windows 7 Professional 64-bit 403 posts	Event viewer security audit failures I was viewing the security logs in event viewer today (exciting I know!) when I noticed some audit failures. I like things running smoothly so this irked me a little. I have a number relating to tcp/ip: Quote: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume1\Windows\System32\drivers\aswSP.sys Quote: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys Quote: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network. Error Code: 2 I no longer use windows firewall as I now use nod32 smart security, but the tcp/ip error concerns me.
My System Specs

10-22-2008	#2 (permalink)
Flavius Vista Bussiness x64 PL 1,559 posts	Re: Event viewer security audit failures Quote: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume1\Windows\System32\drivers\aswSP.sys + Quote: I now use nod32 smart security But first error message concern Avast.Make sure you uninstalled Avast exactly - I think isn't.Does exist avast folder on your computer?-If exist remove it
My System Specs

10-22-2008	#3 (permalink)
swarfega Windows 7 Professional 64-bit 403 posts	Re: Event viewer security audit failures Ive not had avast on here for some time.
My System Specs

10-22-2008	#4 (permalink)
Flavius Vista Bussiness x64 PL 1,559 posts	Re: Event viewer security audit failures Quote: Ive not had avast on here for some time OK.But you surly still have empty values leaved by Avast.If you want to stop appear error message about it go to HKLM\System\CurrentControlSet\Services and find there subkey which include aswSP.sys and remove it,you can use RunAlyzer-> The home of Spybot-S&D! which help you to easy find this empty key
My System Specs

10-22-2008	#5 (permalink)
swarfega Windows 7 Professional 64-bit 403 posts	Re: Event viewer security audit failures Ive managed to delete most of the avast entries. I really need a good program that can check for orphans and remove them.
My System Specs

Similar Threads
Thread	Forum
HELP need to solve this problem asap - Unable to start event viewer/event log service	Software
Re: Security Event Log Audit Failure 5038 in Vista SP1 tcpip.sys	Vista General
Security Event Log Audit Failure 5038 in Vista SP1 tcpip.sys	Vista General
A New Vista Security Policy on Audit:Force Audit Policy Subcategor	Vista security
Strange security audit events	Vista security