locked
Security Event Log Audit Failure 5038 in Vista SP1 tcpip.sys RRS feed

  • Question

  • I've recently noticed bursts (e.g. 16 in a row, all with the same timestamp) of Event Log entries #5038 in the Security Event Log in Vista SP1 systems:

     

    <q>
    Code integrity determined that the image hash of a file is not valid.  The
    file could be corrupt due to unauthorized modification or the invalid hash
    could indicate a potential disk device error.

     

    File Name: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys
    </q>

     

    I noticed this the first time about two weeks after installing SP1 to my several-month-old Vista installation. Comparing the event timestamps to other event log entries and verifying against the file system, they began right after I installed Diskeeper 2008, which I did no more than a day or so before I found the entries in the event log. That is, the errors never occurred in the months prior to installing SP1, and following SP1 installation, they didn't occur for the next couple of weeks prior to installing Diskeeper 2008. I figured Diskeeper was somehow interfering with the OS, but now I think I was mistaken.

     

    I've since installed Vista w/ integrated SP1 from MSDN, and while I didn't install Diskeeper, the error message began to appear the day after I installed Vista w/ SP1, right after I installed the Realtek HD sound drivers. I believe the error is spurious. The tcpip.sys driver has a valid digital certificate. If anyone wants to check it against their Vista SP1 system, the fciv.exe output is:

     

    X>fciv c:\windows\system32\drivers\tcpip.sys
    //
    // File Checksum Integrity Verifier version 2.05.
    //
    fc6e2835d667774d409c7c7021eaf9c4 c:\windows\system32\drivers\tcpip.sys

     

    The event log entries do not appear immediately after booting, or even after I've used the computer for some time. They have not appeared so far today, nor did they appear yesterday.

     

    Googling for /"Code integrity" vista hash tcpip.sys/, I found this from
    "Jesper":

    http://groups.google.com/group/microsoft.public.windows.vista.security/msg/49f22efdaaa9920b
    <q>
    Submit a bug to Microsoft through whatever mechanism you got the beta
    service pack. The problem is that the hash listed for tcpip.sys in the
    manifest file is not correct.
    </q>

     

    There is not much else concerning tcpip.sys, but widening the search to /"Code integrity" vista hash/ turns up a lot more hits, though no explanation.

     

    Again, the computer works fine, and I believe the error is spurious. The SFC program detects no problems. Does anyone have experience with this? Does anyone have this error in their Vista SP1 Security event log?

     

    Saturday, March 15, 2008 5:34 PM

Answers

  • Thank you all for reporting this issue.

    We are actively investigating this issue and looking into a resolution for SP2 RC.

     

     

    Wednesday, December 3, 2008 11:44 PM
    Moderator

All replies

  • I'm getting about the same problem, could it be that it really has nothing to do with that file but something else? 

     

    It just started recently also, but I can't attribute it to any one thing in particular that I can think of...

     

    Here's what I'm getting:


    Log Name:      Security

    Source:        Microsoft-Windows-Security-Auditing

    Date:          11/2/2007 9:28:45 AM

    Event ID:      5038

    Task Category: System Integrity

    Level:         Information

    Keywords:      Audit Failure

    User:          N/A

    Computer:      X

    Description:

    Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

     

    File Name:          \Device\HarddiskVolume1\Windows\System32\APSHook.dll    

     

     

    Monday, March 17, 2008 4:37 PM
  •  SherryK wrote:

    I'm getting about the same problem, could it be that it really has nothing to do with that file but something else? 

     

    I'd bet it's a bug in whatever's generating those messages.

     

    Monday, March 17, 2008 9:41 PM
  • Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

    File Name: \Device\HarddiskVolume1\Windows\System32\drivers\Mpfp.sys

     

    And I must admit it was different on my last system (yesterday). I did a clean install, nothing but my security suite is installed, and vista of course.   My install was completed about 2 hrs ago so it truly is fresh. If it's a bug, seems to be a vista bug or mcafee since I do have that as part of my security suite.  I suppose it could relate to Seagate? I have just installed the same type of hard drive as my alleged failed one.  What I find interesting is that I seem to have hard drive errors yet again, errors of the drivers for the hard drives.  I had this problem last time and yes my motherboard supports large transfer rates. I'm using an Asus p5nsli motherboard if you'd like to check. I find it strange I get hard drive errors yet again when my last one kept saying my volume was dirty and my driver was going to fail (or my drive) under the reliability and performance or what have you that comes with windows vista.

     

    My last hard drive got to where it would not boot (at times, if you can believe that), I've yet to finish my research and begin testing the drive as I still have to get my files off of it.  My install is quite fresh and I do have this error. If it's a bug, it sounds vista related.

     

    My last vista install lasted right at 13 months before I had to replace the hard drive. I had to repair and system restore several times also. Thinking either it was a hard drive driver issue or some other driver or controller issue that was replaced by another mfr with my last hard drive like, for example, a video card's ata controller or similar. I'm not quite sure how those work, the installs and conflicts with drivers. This time, the new drive does make a noise but least it's got a 5 year warranty.  Strange it makes a noise and it's brand spanking new.  I can say the last vista install last about 8 months before I had to do a restore or a repair so I'm not really sure. Too many things it could be. I think my last disk got some issue with the files not sticking to the boot sector, maybe due to locking up? I'm hoping this error has nothing to do with what crashed my last drive/installation.

     

    Hope this information helps someone

     

    xts

     

    Edit: I've found this file belongs to McAfee. (File Name: \Device\HarddiskVolume1\Windows\System32\drivers\Mpfp.sys)

    runscanner seems to think it is clean as far as the md5 hash is concerned, it seems.

    Tuesday, April 15, 2008 5:48 AM
  •  

    I've had the same audit failure events on my log, but the failing file seems to be changing from event to event

     

    \Device\HarddiskVolume4\Windows\System32\drivers\symredrv.sys

    \Device\HarddiskVolume4\Windows\nvoclock.sys

    \Device\HarddiskVolume3\Windows\System32\drivers\symtdi.sys

     

    And these have been appearing on my security log ever since i've had this system up from start of january.

     

    There has been a trial version of diskeeper installed on system, but no mcAfee. I'm using symantec enterprice Antivirus client.

     

    -Teme-

    Wednesday, April 16, 2008 2:51 PM
  • I also have these errors, I posted about it here:

     

    http://www.admuncher.com/forum/viewtopic.php?f=4&t=3676

     

    I cant for the life of me figure out what is causing these, still.   I seem to mostly get them relating to tcpip.sys.   However I do also see an occasional one from another .sys file too.   I am wondering if it is another process "patching" the tcpip.sys in memory, such as an anti-virus program?  I am using NOD32 (Eset, s.r.o) v3.0.650.  Is anyone else using this anti-virus program, maybe we can find a common thread.... my system seems to behave normally and I do not suspect I am infected with anything, but with all the latest rootkits etc you can never tell.   I also use LogMeIn Hamachi for VPN and am running 1.0.2.5 of that program in "service" mode.

     

     

    Monday, April 21, 2008 2:15 PM
  •  

    I installed the SP1 on April 15 and I have the same Code Integrity Error for tcpip.sys, almost everyday, starting from April 16:

     

    Thursday, April 24, 2008 3:46 PM
  • i've had the same problem for the past two days and i don't know if there was an update which caused it. is there a way to find out the source of this?

    same tcpip.sys errors, id code 5038
    Monday, April 28, 2008 6:03 AM
  • This problem is also appearing on my system since yesterday after I installed Vista x64 SP1 via Windows Update.  Everything using the tcpip stack is running quite slow, including IE7.

     

    My only network connection is wireless with WPA2 AES encryption. 

     

     

    Provider
    [ Name] Microsoft-Windows-Security-Auditing
    [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}
    EventID 5038
    Version 0
    Level 0
    Task 12290
    Opcode 0
    Keywords 0x8010000000000000

     

     

     

    Tuesday, April 29, 2008 1:19 PM
  • I have noticed this problem on both Vista Ultimate x64 and Vista Home Premium 32. It seems to point to a variety of so called problem files like lgscroll.dll (Logitech), nvd3dumx.dll (Nvidia) among others. It happened both before and after upgrades to Vista SP1. Sometimes I can go for days without seeing this error. Other times there are dozens of them in the security log.  Both systems are using Avast security software. I tried disabling Avast but I still get the 5038 errors. I narrowed down the cause somewhat by using the event viewer option to attach a task to event ID 5038. The task sends me a message every time the event occurs. Whenever I visit a certain pornographic web site, the event 5038 task is kicked off. Might have something to do with viewing online WMV files ?

     

    Friday, May 2, 2008 7:45 PM
  • i think you are right! this must be the source of the problem (windows media player plugin for ie)

     

    i got the same problem with tiptsf.dll and nvd3dum.dll always together but tiptsf.dll 20 times as much as nvd3dum.dll.

    And it always happens when watching (porn) movies (eg http://www.stilemedia.com/?v=odear2.wmv click view) online inside internet explorer which use the media player from microsoft (so maybe only wmv but i dont know).

     

    im using vista sp1 and a nvidia go with latest certified drivers on a tablet pc

     

    i just dont look through why it effects the tiptsf.dll this is a system file used for pen input on my tablet pc.

     

    the events occour when opening the movie and start playing it (~40 events of that kind per movie) they dont occour while watching the rest of the movie.

     

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
      <EventID>5038</EventID>
      <Version>0</Version>
      <Level>0</Level>
      <Task>12290</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8010000000000000</Keywords>
      <TimeCreated SystemTime="2008-05-05T10:40:27.575Z" />
      <EventRecordID>4648</EventRecordID>
      <Correlation />
      <Execution ProcessID="4" ThreadID="68" />
      <Channel>Security</Channel>
      <Computer></Computer>
      <Security />
      </System>
    - <EventData>
      <Data Name="param1">\Device\HarddiskVolume1\Windows\System32\nvd3dum.dll</Data>
      </EventData>
      </Event>
     
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
      <EventID>5038</EventID>
      <Version>0</Version>
      <Level>0</Level>
      <Task>12290</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8010000000000000</Keywords>
      <TimeCreated SystemTime="2008-05-05T10:40:27.596Z" />
      <EventRecordID>4649</EventRecordID>
      <Correlation />
      <Execution ProcessID="4" ThreadID="68" />
      <Channel>Security</Channel>
      <Computer></Computer>
      <Security />
      </System>
    - <EventData>
      <Data Name="param1">\Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\ink\tiptsf.dll</Data>
      </EventData>
      </Event>
    Monday, May 5, 2008 11:51 AM
  •  

    latly the movies also started to flicker

     

    oh and im using nod32 and webwasher classic

    Monday, May 5, 2008 12:19 PM
  • I opened an older thread concerning this same problem. There are no third party causes, the tcpip.sys that comes with SP1 or the invalid catalog file is the source of this problem.

    I've been looking into this a bit longer so here goes, the useful information I can give...

    The event is logged ONLY if the tcpip.sys is queried for file info, that is, if it is selected, or if you are right-clicking it for properties. A string of 4 events in row is logged in this case.

    Unlike other cases mentioned here, like nvd3dum.dll, the event is not logged during normal operation, and if you don't find tcpip.sys in your sights, so to speak, inside an explorer window, chances are you won't find this in event log.


    Monday, May 5, 2008 2:04 PM
  • I'm noticing the same - and I can cause new Audit Failure entries to appear in the Security Event Log by going to \windows\system32\drivers and right-clicking on tcpip.sys and getting properties. Info:

     

    ************************************

    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          5/17/2008 11:57:49 AM
    Event ID:      5038
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      computer02
    Description:
    Code integrity determined that the image hash of a file is not valid.  The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

    File Name: \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys 
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
        <EventID>5038</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2008-05-17T15:57:49.973Z" />
        <EventRecordID>14510</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="48" />
        <Channel>Security</Channel>
        <Computer>computer02</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys</Data>
      </EventData>
    </Event>

    ************************************

     

    Can anybody from MS explain what this is all about?

     

    Saturday, May 17, 2008 4:07 PM
  •  

    According to http://www.eventid.net/display.asp?eventid=5038&eventno=8922&source=Microsoft-Windows-Security-Auditing&phase=1, "This behavior happens in Vista when a driver is not digitally signed."

     

    Sunday, May 25, 2008 9:49 PM
  • I am experiencing the exact same error.  Fresh install of "Vista x64 Ultimate SP1" from MSDN. 

     

    I've seen Audit Failure messages for:

     

    \Device\HarddiskVolume1\Windows\SysWOW64\PCIUtil.sys

    \Device\HarddiskVolume1\Windows\System32\nvd3dumx.dll

    \Device\HarddiskVolume1\Windows\System32\l3codeca.acm

    \Device\HarddiskVolume1\Users\xxx\AppData\Local\Temp\PCIUtil.sys

    \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys

     

    Example:

     

     <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
      <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
      <EventID>5038</EventID>
      <Version>0</Version>
      <Level>0</Level>
      <Task>12290</Task>
      <Opcode>0</Opcode>
      <Keywords>0x8010000000000000</Keywords>
      <TimeCreated SystemTime="2008-06-01T17:03:24.036Z" />
      <EventRecordID>6244</EventRecordID>
      <Correlation />
      <Execution ProcessID="4" ThreadID="60" />
      <Channel>Security</Channel>
      <Computer>XXX</Computer>
      <Security />
      </System>
      <EventData>
        <Data Name="param1">\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys</Data>
       </EventData>
      </Event>

     

    Sunday, June 1, 2008 6:51 PM
  • i have just recently installed the vista sp1 and I am getting this error too, has this problem been fixed yet?

     

    Thursday, June 26, 2008 8:27 AM
  •  

    I discovered this error after recording video in Office OneNote that wouldn't playback.

    I suspect it's something to do with the driver(s). I'll try reinstalling it (them) and let y'all know what happens.

    Sunday, June 29, 2008 9:18 PM
  • So... No MS person has even bothered to respond to this? I've checked a number of PCs that I'm running Vista on and the problem in on over 70% of them. Either one driver or the other has a problem and tcpip.sys seems to be more common. I've seen errors with Symantec Endpoint, McAfee and Kaspersky.
    Thursday, September 18, 2008 6:33 AM
  • I get LGSCROLL error, so logitech tells me.. go buy a registry cleaner, and never communicated again to me.

    seems I told them... either fix the problem or dialogue with microsoft about why its being reported.

    they took the easy way. and just stopped talking about, have not replied or done anything i think usefull.

    as for microsoft, if the problem is theirs , then they too are remise in not dealing with it.

    after all, what can u expect from PC developers... they got your money.. why help .. that's an expense(in the short term),

    in the long term i will avoid giving money to logitech , microsoft, or anyone else who treats customers this way.

    I get a lot of surveys and stuff. but the responses are obviously being ignored. and I agree.. filling up my event log is not a nice thing to do. I re-installed SETPOINT(LGSCROLL.dll, et al), did not help any.

     

    let me also say this.. it may not be the VP and his immediate staff who care little about their customers, but they are mismanaging their company if they ignore the condition(s).  the front line staff are only interested in either handling the next call or doing nothing. they have no indepth knowledge other than reboot , reinstall, try this, try that. just a bunch of dummies, really.  second level(the better experts) resolve symptoms (make errors not display!)... and mangers just want the time sheets filled out, and do admin stuff. so u get a company that's trying and failing at the same time.

    eventually the see-saw will tip in 1 direction, and u'll see IT companies buying other IT companies till only a few survivors are left. THE BIG FISH EAT THE LITTLE FISH,  and then the bigger fish eat them!- I saw Starwars #1, and saw that.

     

     

     

    Monday, October 13, 2008 6:43 AM
  • FYI, I was seeing the same problems reported in this forum and also experiencing intermittent crashes.  Finally narrowed the problem down to having two AV programs running simultaneously (CA ETrust and MS Forefront).  Not sure how MS Forefront was even installed but disabling CA ETrust Realtime seems to have stabilized system, fingers crossed.

    Sunday, November 16, 2008 4:29 PM
  • Hi i noticed the last post was 16 nov which was about the same time i started to recieve these intermitent system crashes and error messages containing almost the same file info, i'm not anyway up on my pc skills but really need some help to sort this out my computer is literally days out of warrenty and has worked perfectly for the past year any ideas gratefully welcome.

     

    Wednesday, December 3, 2008 9:02 PM
  • Thank you all for reporting this issue.

    We are actively investigating this issue and looking into a resolution for SP2 RC.

     

     

    Wednesday, December 3, 2008 11:44 PM
    Moderator
  • and .. Thank  u too!     I have a suggestion.....  get 1 PC at Microsoft installed (at least) with VISTA and latest fixes,

    and then check the event logs for ERRORS. find any ..then fix them...

    this PC should be LOADed with common products... like ATI/AMD , DELL, LOGITECH, etc etc....

    that represent a range of products, have the OEM supliers buy into this "program" somehow(make them an offer they can't refuse), and u and the partners, can together provide a better end-product.  this verification tool is not a new concept, I HOPE! p.s. u can add MCAFEE.Norton, and I assume a lot of other major players.... I would suggest that any company that works with u be branded as a VISTA-PARTNER, and gain some "respect", while those that find it distasfeul to co-operate be branded by implication as a bunch of "jerks".   there u have it.... u're either a PARTNER or a JERK.

    add that to your bottom-line! then people can chose what h/w and s/w they are willing to pay for!  that's how the free market system should work.  

    Thursday, December 4, 2008 4:31 AM
  • Still there in SP2 beta release 6002: tcpip.sys, and other files such as vsdatant.sys, vm86.sys and many others : these drivers are not microsoft's and are signed too. I hope this is not linked to the systems hangs I see, otherwise I would start suspecting random data corruption...
    Sunday, December 28, 2008 4:29 PM
  • I've also noticed this problem on both Vista x64 and Vista 32.  The Vista 32 machine I tested does not have anything besides Vista installed.
    Friday, January 2, 2009 6:59 PM
  • I have been experiencing this same problem ever since I updated with SP1, about a year ago now
    I also get blue screens after this error is logged but my nvidia display crashes seconds before the tcpip.sys error.
     
    MS is giving free support for vista64 SP1 (Now why would they be doing that?) users until March18 so after many days and hours and reintalls of my OS they tell me my grfx card is the cause, it is defective they tell me! "I promise you Mr. Josh if you get a new card you will not have these problems, I am sure of this"

    I previously had the 7950GX2 running stable for almost 3 years, never a single crash in 64bit vista, rock solid; unheard of. Then about a year ago I install SP1 and everything has been fucked ever since.

    I know my card is not defective but just for shits I go and buy a brand new 9800GTX, what do you think happens?
    I still get the same errors and blue screens.

    I believe this to be some how related to my grfx card since at the same time of errors I also get "nvlddmkm stop responding and recovered"
    There seems to be a lot of issues with Vista 64-bit and nvidia cards.

    Nvidia even acknowledges this with "vista only support" However talking to MS they dont seem to listen to what I have to say, its like I am talking to a foreigner that doest understand me, oh wait..

    Suggestions anyone??? I have a thread for this topic going on at nvidia.com and vistax64.com
    http://www.vistax64.com/graphic-cards/212378-bsod-nvlddmkm-tcpip-sys-invalid-hash.html
    http://forums.nvidia.com/index.php?showtopic=90299&st=0&p=509239&#entry509239

    Sunday, February 22, 2009 10:35 PM
  • I've also noticed this problem on both Vista x64 and Vista 32.  The Vista 32 machine I tested does not have anything besides Vista installed.

    I'm also getting this issue as an Audit Failure in the Security Log.
    Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
    File Name: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
    Digital signature is fine; signed by MS. File Veresion 6.0.6001.18063
    I'm on Vista Ultimate 64 SP1
    Sunday, April 19, 2009 2:05 PM
  • Do you have dsl?  if not ignore!

    I recieved @3 or 4 errors/messages in event viewer on initial startup with vista sp1 X64...

    1) kerboros: personally dont like this error

    2)WMI application error code 10" Ive read that this is an error relating to instalation of SP1"

    3) tcpip.sys "invalid hash" I installed a router and did not recieve the error upon rebooting...  hope it helps!  keep ur receipt

    Monday, April 20, 2009 3:51 PM



  • I have this exact same problem. In my case, I get the four tcpip.sys errors just after my nVidia display crashes. I just upgraded my gtx 260 to (2x) gtx 260 in SLI, so I thought it was problem with SLI at first. I have been scouring the net for advice on this problem and you are the first to associate the problem with nVidia display drivers, so I was very glad to run to your post. One thing that I have noticed is that I can get these tcpip.sys errors without crashes if I am not running a game at the time. I can see in Event Viewer that the errors have occurred without the Display error following when I am not running a game. The problem is that when I am running a game, it crashes, and I always see these errors just before or just after the crash:



    Code integrity errors without display crash:





    Code Integrity Errors with Display Crash:





    Details of first code integrity error after display crash:




    Details of display crash:


    I am running ESET NOD32 Antivirus 4

    Vista Ultimate x64 (fully updated)

    (2) GTX 260 in SLI (latest WHQL driver)

    I also don't have McAfee, but I do have the McAfee Site Advisor though (this seem like it slows everything up lately to anyone else?), if that makes a difference.

    EDIT: Two days later and I have been free of these errors up until just now. I have a task attached to these errors to let me know if these errors pop off and I just got the pop ups. I was playing EvE but AFK for a while when it happened.



    Newest code integrity errors:
     




    Well, this error is getting bothersome. Now it happens when I play Fallout 3.... It happens every time, about 20 minutes into almost every game. Has anyone found out anything about this yet?


    Friday, April 24, 2009 4:14 AM
  • Hi, i also have the same problem with tcpip.sys integrity. I've Vista Business with SP1. It occurs when I try to connect through F5 Firepass software with my remote workstation. And I suppose that is why I cannot connect to my remote PC :( . Before installing SP1  it works correctly. Is it any way to avoid this error? Or should I deinstall SP?
    br
    Tadeusz
    Friday, April 24, 2009 6:50 AM
  • Anyone know anything about this yet? I get this error all the time now-- several times a day. My first inclination was to think this was a graphics driver problem, but I have seen these errors on several occasions occur just BEFORE the display crash. This code integrity error ALWAYS occurs within several seconds of any display crashes I get though, but it doesn't always involve a display crash. Also, within the last few days I notice just the code integrity errors (without display crash) occurs right at startup.  I know this becuase of the tasks I have scheduled to show a pop up whenever the code interity errors occour, I get these very time I start up.

    EDIT: I forgot to mention, but I have already tried to use the Windows install disk to correct this problem, but it said that it did not find anything wrong with the startup files and so didn't do anything. Also, when it says that the display driver has stopped responding and successfully recovered.. it does not recover (fast?) enough to avoid crashing any game I am in to desktop.

    Any help at all with this would be very appreciated.

    EDIT: Well I still get the Code Integrity errors once in a while, but I found out what was causing the display crashes. I originally had 2x2 GB sticks of memory (1333 DDR3). Well, I ended up with an extra couple of 2X2 GB sticks left over from something, so I had put them in a month or so ago. I had problems at first, but I seemed to fix this by bumping up the northbridge voltage a bit to compensate for running 4 sticks instead of two. Everything seemed to work fine after that. I think the problem was that I didn't have the northbridge voltage quite right, and when the system was taxed it caused the display to crash; and for some reason whenever this happened I got those code integrity errors at the same time. Well I surmised all this because, on a hunch, I removeed those extra two sticks, and sure enough, no more display crashes, but I still get those code integrity errors though, but they don't crash my display anymore so I don't really care.

    Anyway, I hope this helps someone! Thanks :-)
    Sunday, May 3, 2009 2:28 AM
  • Thank you all for reporting this issue.

    We are actively investigating this issue and looking into a resolution for SP2 RC.

     

     


    I haven't read *all* the responses here, but because our Vista system runs isolated from the Internet, but is on a network, and receiving video via CCTV cameras, I'll add my voice to those suggesting that, perhaps, some kind of multimedia effect is at play.

    Our Vista Ultimate SP1 system will generate some number of these errors, and then Blue-screen with a Bugcheck 0x00000116.  Always TCPIP.SYS.  TCPIP.SYS has been updated due to an issue with Max number of TCP connections, but the problem has occured both before and after the file update.

    EDIT: We have realized that our VGA cable run to a large screen TV is over 28 feet in length.  The Vista machine has a DVI port, but a VGA conversion connector right at the machine.  This could be at the issue with our bugcheck crashes, so we're going to install a "high integrity" VGA/SVGA cable from Belkin and see if that helps with the bugcheck.  If it does, then our bugcheck issue isn't related to the code integrity issue in this conversation.


    NSSC
    • Edited by Rob Vargas Wednesday, June 3, 2009 6:28 PM Added info
    Friday, May 8, 2009 2:16 PM
  • I posted here earlier in April but nothing has been solved
    I fixed my problem by removing 2GB RAM
    Ive been running on 2GB RAM since the cause of my problem was with 4GB RAM in the system (2x2GB)
    I have tested my memory all good and even replaced them twice through kingston
    I also replaced my grfx card for the Nvidia 9800GTX+

    The problem lies directly when the chip is plugged in. Without the other 2GB machine is rock solid like the good ol' days!

    I hope someone someday figures out this problem. I happen to find 2GB lying around and decided to plug it in not realizing why I had it out in the first place. Just to bring me back to this thread and see all the sad faces suffering this Microsoft BS. Allah Akbar peace be upon him and all of you! Stay strong we will find a solution some day

    ***Currently installing SP2 as a last desperate attempt!
    • Edited by REHV Friday, July 10, 2009 3:51 AM
    Friday, July 10, 2009 1:06 AM
  • Audit Failure 8/12/2009 7:30:20 AM Microsoft Windows security auditing. 5038 System Integrity

    - System

       
    - Provider
          [ Name] Microsoft-Windows-Security-Auditing
          [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}
       
      EventID 5038
       
      Version 0
       
      Level 0
       
      Task 12290
       
      Opcode 0
       
      Keywords 0x8010000000000000
       
    - TimeCreated
          [ SystemTime] 2009-08-12T12:30:20.314Z
       
      EventRecordID 68445
       
      Correlation
       
    - Execution
          [ ProcessID] 4
          [ ThreadID] 56
       
      Channel Security
       
      Computer odstore_1
       
      Security

    - EventData

        param1 \Device\HarddiskVolume2\Windows\System32\drivers\v2imount.sys


    oh well what do you think about that?  have a good day>>>>>>>>>>>>>


    well here we go again, please help me with this
    - System
       
    - Provider
          [ Name] Microsoft-Windows-Security-Auditing
          [ Guid] {54849625-5478-4994-a5ba-3e3b0328c30d}
       
      EventID 5056
       
      Version 0
       
      Level 0
       
      Task 12290
       
      Opcode 0
       
      Keywords 0x8020000000000000
       
    - TimeCreated
          [ SystemTime] 2009-08-23T02:29:08.675Z
       
      EventRecordID 70219
       
      Correlation
       
    - Execution
          [ ProcessID] 636
          [ ThreadID] 780
       
      Channel Security
       
      Computer odstore_1
       
      Security
    - EventData
        SubjectUserSid S-1-5-18
        SubjectUserName ODSTORE_1$
        SubjectDomainName WORKGROUP
        SubjectLogonId 0x3e7
        Module ncrypt.dll
        ReturnCode 0x0


    please email me @ mrbgomez2000@gmail.com             thanks
    Wednesday, August 12, 2009 1:58 PM