Solved

Faulting Application fwInvn32.exe

Posted on 2009-04-08
19
4,001 Views
Last Modified: 2012-05-06
Upon boot up prior to sign in the server displays message about fwInvn32.exe. Note: fw(Cap i)nvn32.exe.   Examination of the Event Viewer / Application tab shows an error with the following application error.
Application Error
Category 100
Event ID 1000
Faulting application fwInvn32.exe, version 0.0.0.0, faulting module fwInvn32.exe, version 0.0.0.0, fault address 0x000017ff.

I noticed 5 seperate folders in the Documents and Settings\user\Local Settings\Temp directory with names like WER8c5f.dir00 and 1 file inside the folder all named fwInvn32.exe.hdmp.  I am not sure what is causing the issue or creating the folder/file?  Running on a Dell PowerEdge 1900.

Dell thought it might be MalWare??, I didn't think so but checked anyway - nothing found.  
They pointed me to a site
http://www.prevx.com/filenames/****-******-*****-X1/FWINVN32.EXE.html
I wasn't too sure about Prevx so I still need to find a solution / fix.  Any ideas?
0000: 41 70 70 6c 69 63 61 74   Applicat

0008: 69 6f 6e 20 46 61 69 6c   ion Fail

0010: 75 72 65 20 20 66 77 49   ure  fwI

0018: 6e 76 6e 33 32 2e 65 78   nvn32.ex

0020: 65 20 30 2e 30 2e 30 2e   e 0.0.0.

0028: 30 20 69 6e 20 66 77 49   0 in fwI

0030: 6e 76 6e 33 32 2e 65 78   nvn32.ex

0038: 65 20 30 2e 30 2e 30 2e   e 0.0.0.

0040: 30 20 61 74 20 6f 66 66   0 at off

0048: 73 65 74 20 30 30 30 30   set 0000

0050: 31 37 66 66               17ff

Open in new window

0
Comment
Question by:dnetsol
  • 6
  • 4
  • 3
  • +4
19 Comments
 

Expert Comment

by:wydoublek
Comment Utility
Microsoft Engineer asked me to contact the Microsoft Security Team after this came about.. Basically I had Microsoft on my server to correct WMI corrupt Repository, after a few secedit scans this error came about and Microsoft thinks its malware... I really don't think so -- but also can't find any information.
0
 

Expert Comment

by:wydoublek
Comment Utility
More Information -- I am currently working with Microsoft's Security Team on this one but have found the following on my drive --


C:\>dir fwInvn* /s

 Volume in drive C is OS

 Volume Serial Number is D8B7-E8BC
 

 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER1e8

a.dir00
 

04/07/2009  01:27 PM         1,504,445 fwInvn32.exe.hdmp

               1 File(s)      1,504,445 bytes
 

 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER610

0.dir00
 

04/08/2009  08:14 AM         1,504,429 fwInvn32.exe.hdmp

               1 File(s)      1,504,429 bytes
 

 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER8c0

a.dir00
 

04/07/2009  01:27 PM         1,504,445 fwInvn32.exe.hdmp

               1 File(s)      1,504,445 bytes
 

 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER90f

0.dir00
 

04/07/2009  12:48 PM         1,504,429 fwInvn32.exe.hdmp

               1 File(s)      1,504,429 bytes
 

 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WERadb

3.dir00
 

03/25/2009  08:18 AM         1,508,509 fwInvn32.exe.hdmp

               1 File(s)      1,508,509 bytes
 

     Total Files Listed:

               5 File(s)      7,526,257 bytes

               0 Dir(s)  14,664,663,040 bytes free
 

C:\>

Open in new window

0
 

Author Comment

by:dnetsol
Comment Utility
I continue to be amazed that something can be creating this file, causing an error in the event manager under Applications without more available information.  Dell thinks it is Malware, Microsoft thinks it may be Malware but no one can confirm it.  It this really that new of a problem or are people just not paying attention to their server event logs.  While the issue doesn't stop the operation of the server I am concerned that something is creating these files and I don't know why or how to fix it.
Thanks for the feedback -- Hopefully someone else has seen this and been able to fix it..
0
 

Expert Comment

by:wydoublek
Comment Utility
Microsoft found the original file location which was missing on my server:

C:\WINDOWS\Temp\inv1_tmp\NIC_Broadcom_FW_5708\32\fwInvn32.exe

They asked I upload the missing file, and I have yet to hear back...

RESOLUTION -- I was able to correct this issue by installing the latest Broadcom Network Device Driver available from Dell's web site.
0
 
LVL 6

Expert Comment

by:stewartacampbell
Comment Utility
We are getting exactly the same error, but updating the drivers didnt work.

I dont suppose you are using Altiris Agent on the server?
0
 

Author Comment

by:dnetsol
Comment Utility
I am not running the Altiris Agent.  I did try the updated drivers for the Broadcom NIC in the server as well as the Dell Control Point Manager update and I still have the error.  After doing the updates I searched the server drive for the fwInvn32.exe and it was nowhere to be found.  Apparently it was not part of the Broadcom install.  I'm still hoping for some help on this one from someone.  Thanks in advance for any help, this one for some reason isn't getting enough attention out there.
0
 
LVL 6

Expert Comment

by:stewartacampbell
Comment Utility
My server is a Dell PowerEdge 1950 so I expect we may be running pretty much the same hardware.
They are due out to replace the motherboard this evening as we were also having trouble teaming the network adapters, so to be sure it isnt one of the on board adapters causing the error they are replacing it.
Are your adapters also on board ?
0
 

Author Comment

by:dnetsol
Comment Utility
Yes, the server with the problem is also a Dell PowerEdge 1900.  On this box the network adapters are both on the main board.  I am not doing anything with the network adapter teaming though.  Let me know if the new motherboard solves your issue.  I'm just wondering if the NIC's need a firmware update to match the actual driver?  You may want to ask about that.  Please let me know what you find out.  Thanks  
0
 

Expert Comment

by:lcave
Comment Utility
I had the issue after loading the server administrator on my Dell 1900.  Dell technical support provided the file and then had the audacity to tell me that my server was infected with malware.  This is not the case.  I asked Dell to do some research (in no uncertain terms).
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 6

Expert Comment

by:stewartacampbell
Comment Utility
Ok, so Dell replaced the board last night AND we downgraded the drivers on their advice.
No more errors now.
Not sure which worked, but the drivers we were advised to use are located here: http://ftp.us.dell.com/network/Bcom_LAN_10_30_W2K3_A03.exe
We uninstalled the current broadcom suite, rebooted, then installed the driver package above. Dell advised to install everything, which we did.
Give the older drivers a shot and see how it goes. Make sure to reboot after the initiall uninstallation.
Otherwise then I am guessing it must be the board itself.
0
 
LVL 1

Accepted Solution

by:
GarrettPlante earned 500 total points
Comment Utility
The problem is caused by Dells Open Manage Server Administrator.  During boot there is an inventory process that runs and this is what is causing the error.  Call Dell and they will give you a not yet released version of a file named invcol.exe. All you need to do is replace the current file on the server and reboot.
0
 
LVL 6

Expert Comment

by:stewartacampbell
Comment Utility
Does this inventory run all the time? The reason I ask is that we were experiencing the error even when the server had been up for days if not weeks.
0
 
LVL 1

Expert Comment

by:GarrettPlante
Comment Utility
I was told it only runs at boot. If you call Dell have them reference Case No. :7065308 - PE2900 :: fwinvn32.exe
0
 

Author Comment

by:dnetsol
Comment Utility
Thanks for the post.  I emailed my Dell support rep and referenced your case No.:7065308 and all they provided me was feedback to the Dell PowerEdge 2900 and the invcol.exe reference that you mentioned.  They still will not confirm any information relating to the fwinvn32.exe error that I've originally posted here.  She can however help me re-install the fracking OS??  Why would I want to do that?  I could always call Dell software support as a paid service and see if they can help me, if i am interrested..  Meanwhile I still have the boot issue, no real help from Dell on a resolution, and lots of finger pointing.
I feel you are on the right track and the error is related to the invcol.exe file.  I see this error only upon a server boot as was indicated in the last few posts.  How do you get Dell to address the issue?  You gave me a case # but from the information that they replied back with no-one at Dell seems to know anything about fwinvn32.exe and the error I am having.
Were you seeing this error or another one?  Why can't Dell technical support look at the case and see a reference to fwinvn32.exe?  I am really tired of chasing my tail on this one when I feel that this error is related to the Dell server environment.  There doesn't seem to be other users having this same file issue on any other platform?
Again, I appreciate the feedback from everyone but so far I have NOT resolved the issue as it was originally put out there.
0
 
LVL 1

Expert Comment

by:GarrettPlante
Comment Utility
I got lucky when I called Dell. The tech that answered the phone just finished a month long case with this issue. Email him at  Brooks_Roberts@Dell.com and reference the case number. I will also email you the file if you like but use it at your own risk.
0
 

Author Comment

by:dnetsol
Comment Utility
I sent an Email to him as per your suggestion.  Thank you.  I will post any new information here concerning this issue until I get it solved.
0
 

Expert Comment

by:mb2010
Comment Utility
I had the same problem with a 2950 server with Dell OpenManage Server Administrator Version 5.5.0 installed.  The problem with the fwinvn32.exe comes from a boot order conflict.  The old version of invcol.exe is responsible for the current failure youre seeing.  Replacing the old invcol.exe with the version from the new OMSA (6.0.1, not yet released for the 2950) fixes the boot order conflict and thus the error disappears.  A reboot is required after doing this.  Case number: 7112382. Tech: Abderrahmane_Lahmams@Dell.com.  Thanks for posting the other case number.  It came in handy when calling in this case.
0
 

Author Closing Comment

by:dnetsol
Comment Utility
Be sure to read the posts in order to get the proper case ID for reference in your communication with Dell.
0
 

Expert Comment

by:Defianse
Comment Utility
This situation was also be resolved by updating my RAID Controller firmware and RAID Windows Drivers.  v6.1.0 OM software also contains the invcol.exe referenced above and is now available.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now