Event Viewer/Audit Failure/ID 6281

[Li0g8]

Need some assistance for this security event posting since I obtained SB S&D2.4.1 with AV
Seems my system security has been out of wack and posting these audit failures since I obtained your software
I ran a ckdsk /R. these failures did go away briefly but came back on the next log-on/Have yet to defrag
Any help:sad:

[Zenobia]

Could you copy and paste the auditing failure event here?You can obscure or x out any info you don't want visible,for example your computer name. :)

[Li0g8]

:sad:
Could you copy and paste the auditing failure event here?You can obscure or x out any info you don't want visible,for example your computer name. :)

These are peppering my event viewer since installation of SpyBot S&D w A/V :confused:software
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 2/23/2015 7:12:48 AM
Event ID: 6281
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: XXXX
Computer: xxxxxxxxxxxxx
Description:
Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name: \Device\HarddiskVolume1\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>6281</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12290</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-02-23T13:12:48.616186300Z" />
<EventRecordID>25420</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="44" />
<Channel>Security</Channel>
<Computer>XXXXXXXXXXXXXX
<Security />
</System>
<EventData>
<Data Name="param1">\Device\HarddiskVolume1\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDHook64.dll</Data>
</EventData>
</Event>

[Zenobia]

Thanks for posting that. :)

This page lists some user input from others on Event ID: 6281 and different reasons of why it's seen in Event Viewer:
http://www.eventid.net/display-eventid-6281-source-Microsoft-Windows-Security-Auditing-eventno-10903-phase-1.htm
Looking at the last entry listed:

In one case, the software mentioned in the event (BitDefender) had the wrong hashing information and the vendor fixed it by releasing a new version (from version 10 to version 11). The vendor also said that at least in their case, the event can be ignored as it will not affect the functionality of the software.
I think it's possible that it might be a similar reason in the case of SDHook64.dll with Spybot,though I don't know that for sure,of course. :)
For that reason,I'm going to refer you to the Spybot support page so you can fill out the form and contact them:
http://www.safer-networking.org/support/
Please give them the event viewer info you posted here so they can see it.I've heard they answer back pretty quickly,so it shouldn't be too long of a wait.

[Li0g8]

Zen,
I have yet to get a response to my inquiry regarding, the event viewer Security Audit Failure, that I sent out 4 days ago
If it seems like I am getting worried I AM..
:sad:Concerned that this may be malware behavior to compromise IPSEC security through tunneling
thanx
Li0g8

[Zenobia]

I've never gotten help through support,so I'm not sure how it all goes,or roughly how long it takes.I'm also unable to speed up a response or anything like that,I'm a Spybot user like you are. :)
They might have a lot of questions at the moment.Also,check your emails spam folder to make sure a response didn't get put into there.

The security audit failure is also somewhat common with other antiviruses,I saw that when I was searching for info about it,so you might not want to worry too much.

[Li0g8]

Thanks Zen,
Found the same posts also:D:

[Zenobia]

Good,glad you saw them. :)
Did you hear anything back yet?

[Li0g8]

Zen
Unfortunately, no response so far:sad:
Was hoping an update would correct the security audit failure 6281 from posting
Nothing yet.
I did go back and reinstalled my old antivirus and it immediately cleared up these in the event viewer.

[Zenobia]

I did go back and reinstalled my old antivirus and it immediately cleared up these in the event viewer.
Good,glad reinstalling your old antivirus worked. :)

I'm not sure what one does when not hearing back from support,since I've never gone that route,so I'll ask somebody for some help with that.

[Zenobia]

Li0g8,could you let me know which form you used out of these? :)
http://www.safer-networking.org/contact/

[Li0g8]

Hello again Zen, What is the current version that S&D is posting on their servers? I have version 2.4.40.0 Start Center 2.440.130 is this current?
Unfortunately still no response from support AND yes most assuredly after uninstalling SpyBot 2.4 fixed the event viewer issue. I am still stuck with the same
problem.
I got rid of my previous A/V because I saw advantages using S&D rather than it although it is a FREEBIE offered by my internet provider, BUT it is such a resource H0G!
My other problem lies with redundancy using S&D 2.4 Professional with my other A/V proggie
Was wondering if there is another solution besides dumping S&D and requesting a rebate for $25.US under any provision stated in the EULA?\that I am currently researching. This poses a security threat:sad:
Just sayin'
OOPZ I use Home/Pro priority support

[Zenobia]

Hi.Yes,that should be the latest version.
Thanks for letting me know the support form you used.I'll post back when I have further info. :)

[Zenobia]

I just heard back.A note was left for Team Spybot,and also,since you're requesting a refund,could you use the sales form to contact the sales department?Thanks.The sales form is located here. :)
http://www.safer-networking.org/contact/sales/

[AlamoBill]

FYI, I started getting the audit failure on the day I switched from Norton 360 to WebRoot SecureAnywhere.

Don't know if that's an artifact of WebRoot being better or worse.