Audit Failure

In my event-viewer the following error shows up that is related to bitdefender. I'm not sure if this is causing any problems (don't notice any, but as its a failure event, i guess it should be fixed.


Can this cause any problems for my system and its security? It shows up multiple times a day.


Log Name: Security


Source: Microsoft-Windows-Security-Auditing


Date: 25-8-2009 14:45:31


Event ID: 6281


Task Category: System Integrity


Level: Information


Keywords: Audit Failure


User: N/A


Computer: Vardump


Description:


Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


File Name: \Device\HarddiskVolume3\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_40\midas32.dll


Event Xml:


<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">


<System>


<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />


<EventID>6281</EventID>


<Version>0</Version>


<Level>0</Level>


<Task>12290</Task>


<Opcode>0</Opcode>


<Keywords>0x8010000000000000</Keywords>


<TimeCreated SystemTime="2009-08-25T12:45:31.473632800Z" />


<EventRecordID>910</EventRecordID>


<Correlation />


<Execution ProcessID="4" ThreadID="56" />


<Channel>Security</Channel>


<Computer>Vardump</Computer>


<Security />


</System>


<EventData>


<Data Name="param1">\Device\HarddiskVolume3\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas32-v2_40\midas32.dll</Data>


</EventData>


</Event>

Comments

  • In my event-viewer the following error shows up that is related to bitdefender. I'm not sure if this is causing any problems (don't notice any, but as its a failure event, i guess it should be fixed.


    Can this cause any problems for my system and its security? It shows up multiple times a day.


    I've the same thing. Windows7 Home Premium (x64) upgrade from Vista. Using BitDefender Internet Security 2010.


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume4\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_42\midas64.dll


    And a slightly earlier version:


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume4\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_41\midas64.dll

  • I've the same thing. Windows7 Home Premium (x64) upgrade from Vista. Using BitDefender Internet Security 2010.


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume4\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_42\midas64.dll


    And a slightly earlier version:


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume4\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_41\midas64.dll


    Hi, horseshrink and StartSoft,


    The problem still exists?


    Thanks!

  • Hi, horseshrink and StartSoft,


    The problem still exists?


    Thanks!


    Hello,


    with my 2 months old computer (Windos 7 64b), I am experiencing a number of issues.


    In the journal files (windows security) I also have a great number of lines (2599 times) relating to evenement 6281:


    L’intégrité du code a déterminé que les hachages de pages d’un fichier image ne sont pas valides. Le fichier peut être incorrectement signé sans hachages de pages ou endommagé en raison d’une modification non autorisée. Les hachages non valides peuvent indiquer une erreur d’unité de disque potentielle.


    Nom de fichier : \Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_45\midas64.dll


    Any thoughts ?

  • Hi all,


    As it is shown in other posts, upgrading Vista to Windows 7 may lead to some problems with software already installed.


    The best way to solve the problem is to reinstall BitDefender security solution. You should perform an uninstall, then a install of BitDefender. If you don't have the package, you could find the setup file in my signature with download links. Download the proper version (32/64-bit) for the system you have and after install see if problem still persist.


    Please post here the results!


    Best regards!

  • I have the same problem, but here i have a native Windows 7 Installation, no upgrade.


    It was logged 20 times in the last 2 days.


    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">


    - <System>


    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />


    <EventID>6281</EventID>


    <Version>0</Version>


    <Level>0</Level>


    <Task>12290</Task>


    <Opcode>0</Opcode>


    <Keywords>0x8010000000000000</Keywords>


    <TimeCreated SystemTime="2010-02-27T18:13:26.059791000Z" />


    <EventRecordID>689</EventRecordID>


    <Correlation />


    <Execution ProcessID="4" ThreadID="52" />


    <Channel>Security</Channel>


    <Computer>Deimos</Computer>


    <Security />


    </System>


    - <EventData>


    <Data Name="param1">\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_000\midas64.dll</Data>


    </EventData>


    </Event>

  • I have the same problem, but here i have a native Windows 7 Installation, no upgrade.


    It was logged 20 times in the last 2 days.


    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">


    - <System>


    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />


    <EventID>6281</EventID>


    <Version>0</Version>


    <Level>0</Level>


    <Task>12290</Task>


    <Opcode>0</Opcode>


    <Keywords>0x8010000000000000</Keywords>


    <TimeCreated SystemTime="2010-02-27T18:13:26.059791000Z" />


    <EventRecordID>689</EventRecordID>


    <Correlation />


    <Execution ProcessID="4" ThreadID="52" />


    <Channel>Security</Channel>


    <Computer>Deimos</Computer>


    <Security />


    </System>


    - <EventData>


    <Data Name="param1">\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_000\midas64.dll</Data>


    </EventData>


    </Event>


    Hi ezfox,


    You need to update BitDefender to get the latest fixes for modules.


    Regards!

  • Hi ezfox,


    You need to update BitDefender to get the latest fixes for modules.


    Regards!


    Hi, i did reinstall Bitdefender (2010, 64Bit) and the error came up again.


    My engine Version after the internal update is 7.30594


    The midas64.dll has the version 0.5.1766.2589


    Is there a fix available for download ?


    with kind rgds,


    ezfox

  • gdumitru
    edited March 2010
    Hi, i did reinstall Bitdefender (2010, 64Bit) and the error came up again.


    My engine Version after the internal update is 7.30594


    The midas64.dll has the version 0.5.1766.2589


    Is there a fix available for download ?


    with kind rgds,


    ezfox


    Hi ezfox,


    Please, check the files in directory where midas64.dll is located if all of the files have the same version: 0.5.1766.


    If not, then update your BitDefender.


    You may post a ticket by running supporttool.exe from BitDefender installation directory with administrator rights and wait until it completes.


    Regards!

  • Hi ezfox,


    Please, check the files in directory where midas64.dll is located if all of the files have the same version: 0.5.1766.


    If not, then update your BitDefender.


    You may post a ticket by running supporttool.exe from BitDefender installation directory with administrator rights and wait until it completes.


    Regards!


    same problem Blue Screen and Event 6281 with midas64.dll


    \Device\HarddiskVolume1\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_46\midas64.dll


    Just download and installed Bitdefender total security 2010 this morning ... running a fresh Win7-64bits


    any futur update would be appreciated


    Regards,


    Michel cr

  • same problem Blue Screen and Event 6281 with midas64.dll


    \Device\HarddiskVolume1\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_46\midas64.dll


    Just download and installed Bitdefender total security 2010 this morning ... running a fresh Win7-64bits


    any futur update would be appreciated


    Regards,


    Michel cr


    It still around in v2_47 :o


    Event Log: security


    Type: Audit Failure


    Source: Microsoft-Windows-Security-Auditing


    Category: System Integrity


    Event: 6281


    Message:


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_47\midas64.dll


    -_-

  • Same problem here.


    Windows 7 x64, fresh install, latest version of Bitdefender TS 2010, everything up to date.


    This error occurs multiple times a day, filling up the security log.


    This error has been going on for ages now, it's about time we receive at least some aknowledgement the techs are looking into the cause of this error!!!


    Yannis2701

  • RitSam
    edited May 2010

    -v2_47\midas64.Code Integrity determined that the page hashes of an image file are not valid.


    *******Why has it not been fixed over year***************


    This issue was brought up to tech support live chat twice now. We have proved to the technician and I guess to their upper-level support people that it existed and it is their problem.


    Their response was we will send you a help desk ticket via e-mail within 24 hours. No such help desk ticket has ever a arrived.


    I've been trying to understand why they have ignored this issue. People hide things when they are either embarrassed or there is a real problem here. This is a packaging problem, or a true security problem. Since it's been going on for such a long time I cannot believe that a packaging problem could go on such a long time without being noticed and corrected. I do now believe that there is a possibility of this being a true security problem. That may be the code or the product module has been compromised. There appears to be a lot of precedents for such things to occur these days such as the Google hack.


    The lack of acknowledgment from bit defender and its help desk citing the lack of help desk tickets on the issue clearly show that they are trying to keep this quiet. It appears that will have to be a little bit more radical to get some attention on this issue from bit defender. I plan to post this information from this form on this subject more publicly to bring the possibility of a true code integrity breach or at best case incompetence. Below is the chief executives e-mail address you may wish to follow up with him on the subject also as I am.


    Event Log: security


    Type: Audit Failure


    Source: Microsoft-Windows-Security-Auditing


    Category: System Integrity


    Event: 6281


    Message:


    Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


    File Name: \Device\HarddiskVolume1\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64dll

  • Hello,


    First and foremost allow me to apologize for any inconvenience this matter may have caused. We have already escalated the issue to our testing team and the files will be properly signed. Rest assure that you can ignore the event log notification, the file will be signed in a future build. As mentioned in the email I've sent, the security notification about the midas64.dll file can be ignored, it will not influence your computer in any way.


    Thank you for taking the time and please do not hesitate to contact us if you need further details from us.


    Best regards,

  • Hello,


    I am facing the same issue on win 7. Is this still not fixed ?


    Thanks.

  • Hi,


    As I mentioned above, this is not an issue but a simple notification that the midas64.dll file is not recognized as being digitally signed.


    The notification was resolved with the release of our newest version, BitDefender 2011. Check the link below for instructions on how to upgrade for free:


    http://forum.bitdefender.com/index.php?showtopic=20941


    Topic closed.


    Kind regards,

This discussion has been closed.