Event 5038 Security Failure

[kangaroo319]

Since updating to version 2.00. Is working great.( Installed over the top of version 1.75)

I am gettining  Audit Failure in Security in event viewer.

See Attachment

 

I am using Vista Home Basic 4 gb ram

Antivirus Avast Pro

Comodo firewall

Winpatrol

 

Cheers

[John L. Galt]

Can you grab the hash of that particular file (MD5 or SHA-1) and post it here and I will compare it with mine to see if the file itself might have gotten corrupt?

[kangaroo319]

Can you grab the hash of that particular file (MD5 or SHA-1) and post it here and I will compare it with mine to see if the file itself might have gotten corrupt?

 

Used WinMD Free to obtain hash   54f96c57ac09d9ee249c72a0df3c5228

[John L. Galt]

This is mine.  Definitely two different files.  

 

CRC32: B96DA14A

MD5: EF3B71BD5920BD4C02302AFBABE210A6

SHA-1: D8120652A339FFE33267A8FB13177FBD00F3A3ED

SHA-512: 78BC3267BD8B5C37A5F0E6CB2C0BEA7946D02308187D46548B71574E4BC861BCAF85A61BC62BD65FED784AE3A51BF8DBC09DBED5EF9C5ED8693595DB5144015C

 

I think at this point a clean uninstall fo MBAM followed by a reinstall might be your best solution.

 

Use this thread to help you cleanly uninstall MBAM 2.0, then reboot and install MBAM 2.0.  Hopefully that should help your problems go away.  Please report back either way - if it gets fixed or does not.

[kangaroo319]

I have done a complete uninstal and reinstal by using the link supplied.

 

Just checked event viewer

Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:    \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys
Used WinMD Free to obtain hash   54f96c57ac09d9ee249c72a0df3c5228


Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name:    \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys
Used WinMD Free to obtain hash   54f96c57ac09d9ee249c72a0df3c5228

 

 

Think now they also appeared after updating to version 2.0.

 

All seems to be working fine though.

 

Also my wife updated her computer yesterday and got the same as me.

Thanks for your assistance

 

 

[kangaroo319]

I have installed Hash Tab 5.1.0.23

Here are thier results

 

File Name:    \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys

CRC32: 9A758E91
MD5: C846349849475B7EC8B20A825449D531
SHA-1: E29D35779762B252AC6AB05BF3D60DF128440D0A


File Name:    \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys

CRC32: 49848AF8
MD5: 54F96C57AC09D9EE249C72A0DF3C5228
SHA-1: 7E92C62491A335221C37E2BA5E9E60D9AF60C096

 

Also in my earlier post for file   \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys

WinMD should have been c846349849475b7ec8b20a825449d531

[John L. Galt]

Hash Tab rocks - I didn't think to tell you to use it but that is what I use, and the developer Cody is really easy to talk to and when you make RFFs he explains whether or not they will get implemented, including reasoning behind the decisions.

 

As for the files, here are mine:

 

mwac.sys:

 

CRC32: 2DC8DB7D

MD5: 5F779F8A5599F2DDA479157088E3836E

SHA-1: B934F13E9869BE7848D87DD2D2D56CA8625C9BCA

SHA-512: 5EFA7A89DABDA567FD5A43D729E8070DA59A6A7CA942750D6210DB40A43EB15E5D4F0BCFB0053C2108A25BDED58CE95A2E6BDCC6AD743D0B6FBDD0452C9784C2

 

 

mbamchameleon.sys

 

CRC32: B96DA14A

MD5: EF3B71BD5920BD4C02302AFBABE210A6

SHA-1: D8120652A339FFE33267A8FB13177FBD00F3A3ED

SHA-512: 78BC3267BD8B5C37A5F0E6CB2C0BEA7946D02308187D46548B71574E4BC861BCAF85A61BC62BD65FED784AE3A51BF8DBC09DBED5EF9C5ED8693595DB5144015C

 

it could be that you're getting different files b/c you are on Vista in stead of Windows 7, as I am.  However, since all is working for you, glad you got everything resolved.

[kangaroo319]

You're not wrong Hash Tab is brilliant .

 

Thanks once again for your assistance.

 

Cheers