I have been getting this Audit failure (Windows 7 Pro). I have run several virus and root kit scans all come back clean. I have checked the integrity of the HD it is fine. I have reinstalled Power DVD I have no idea how to fix this. can anyone tel me what they did to mitigate the issue. Any help would be appreciated. Tom Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 12/22/2010 7:50:53 AM Event ID: 5038 Task Category: System Integrity Level: Information Keywords: Audit Failure User: N/A Computer: xxxxxx Description: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error. File Name: \Device\HarddiskVolume2\Program Files\CyberLink\PowerDVD DX\000.fcl Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>xxxx</EventID> <Version>0</Version> <Level>0</Level> <Task>12290</Task> <Opcode>0</Opcode> <Keywords>0x8010000000000000</Keywords> <TimeCreated SystemTime="2010-12-22T12:50:53.308125000Z" /> <EventRecordID>47104</EventRecordID> <Correlation /> <Execution ProcessID="4" ThreadID="64" /> <Channel>Security</Channel> <Computer>XXXXX</Computer> <Security /> </System> <EventData> <Data Name="param1">\Device\HarddiskVolume2\Program Files\CyberLink\PowerDVD DX\000.fcl</Data> </EventData> </Event>

This problem is caused by CyberLink PowerDVD. I recommand to you to re-install it and to check if this solve your problem. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Windows 7 x64 wants all drivers ro be digitally signed. It looks like this CyberLink file is not signed and so you get this message. Contact the CyberLink support. André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

So what I can gather from the post is; that is a failed Security Audit is due to the drive not having a digital signature, and is a Windows glitch. I am under the assumption is not a true Audit Failure and should be filtered and ignored. Will Microsoft be addressing this problem? It seems to be hanging around since Vista. If I filter out the 5038 Audit ID in the log, will I be blind to Driver attacks?