Faulting Application fwInvn32.exe

Microsoft Engineer asked me to contact the Microsoft Security Team after this came about.. Basically I had Microsoft on my server to correct WMI corrupt Repository, after a few secedit scans this error came about and Microsoft thinks its malware... I really don't think so -- but also can't find any information.

More Information -- I am currently working with Microsoft's Security Team on this one but have found the following on my drive --

C:\>dir fwInvn* /s
 Volume in drive C is OS
 Volume Serial Number is D8B7-E8BC
 
 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER1e8
a.dir00
 
04/07/2009  01:27 PM         1,504,445 fwInvn32.exe.hdmp
               1 File(s)      1,504,445 bytes
 
 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER610
0.dir00
 
04/08/2009  08:14 AM         1,504,429 fwInvn32.exe.hdmp
               1 File(s)      1,504,429 bytes
 
 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER8c0
a.dir00
 
04/07/2009  01:27 PM         1,504,445 fwInvn32.exe.hdmp
               1 File(s)      1,504,445 bytes
 
 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WER90f
0.dir00
 
04/07/2009  12:48 PM         1,504,429 fwInvn32.exe.hdmp
               1 File(s)      1,504,429 bytes
 
 Directory of C:\Documents and Settings\Administrator\Local Settings\Temp\WERadb
3.dir00
 
03/25/2009  08:18 AM         1,508,509 fwInvn32.exe.hdmp
               1 File(s)      1,508,509 bytes
 
     Total Files Listed:
               5 File(s)      7,526,257 bytes
               0 Dir(s)  14,664,663,040 bytes free
 
C:\>

Select allOpen in new window

I continue to be amazed that something can be creating this file, causing an error in the event manager under Applications without more available information.  Dell thinks it is Malware, Microsoft thinks it may be Malware but no one can confirm it.  It this really that new of a problem or are people just not paying attention to their server event logs.  While the issue doesn't stop the operation of the server I am concerned that something is creating these files and I don't know why or how to fix it.
Thanks for the feedback -- Hopefully someone else has seen this and been able to fix it..

Microsoft found the original file location which was missing on my server:

C:\WINDOWS\Temp\inv1_tmp\NIC_Broadcom_FW_5708\32\fwInvn32.exe

They asked I upload the missing file, and I have yet to hear back...

RESOLUTION -- I was able to correct this issue by installing the latest Broadcom Network Device Driver available from Dell's web site.

We are getting exactly the same error, but updating the drivers didnt work.

I dont suppose you are using Altiris Agent on the server?

I am not running the Altiris Agent.  I did try the updated drivers for the Broadcom NIC in the server as well as the Dell Control Point Manager update and I still have the error.  After doing the updates I searched the server drive for the fwInvn32.exe and it was nowhere to be found.  Apparently it was not part of the Broadcom install.  I'm still hoping for some help on this one from someone.  Thanks in advance for any help, this one for some reason isn't getting enough attention out there.

My server is a Dell PowerEdge 1950 so I expect we may be running pretty much the same hardware.
They are due out to replace the motherboard this evening as we were also having trouble teaming the network adapters, so to be sure it isnt one of the on board adapters causing the error they are replacing it.
Are your adapters also on board ?

Yes, the server with the problem is also a Dell PowerEdge 1900.  On this box the network adapters are both on the main board.  I am not doing anything with the network adapter teaming though.  Let me know if the new motherboard solves your issue.  I'm just wondering if the NIC's need a firmware update to match the actual driver?  You may want to ask about that.  Please let me know what you find out.  Thanks  

I had the issue after loading the server administrator on my Dell 1900.  Dell technical support provided the file and then had the audacity to tell me that my server was infected with malware.  This is not the case.  I asked Dell to do some research (in no uncertain terms).

Ok, so Dell replaced the board last night AND we downgraded the drivers on their advice.
No more errors now.
Not sure which worked, but the drivers we were advised to use are located here: http://ftp.us.dell.com/network/Bcom_LAN_10_30_W2K3_A03.exe
We uninstalled the current broadcom suite, rebooted, then installed the driver package above. Dell advised to install everything, which we did.
Give the older drivers a shot and see how it goes. Make sure to reboot after the initiall uninstallation.
Otherwise then I am guessing it must be the board itself.

Does this inventory run all the time? The reason I ask is that we were experiencing the error even when the server had been up for days if not weeks.

I was told it only runs at boot. If you call Dell have them reference Case No. :7065308 - PE2900 :: fwinvn32.exe

Thanks for the post.  I emailed my Dell support rep and referenced your case No.:7065308 and all they provided me was feedback to the Dell PowerEdge 2900 and the invcol.exe reference that you mentioned.  They still will not confirm any information relating to the fwinvn32.exe error that I've originally posted here.  She can however help me re-install the fracking OS??  Why would I want to do that?  I could always call Dell software support as a paid service and see if they can help me, if i am interrested..  Meanwhile I still have the boot issue, no real help from Dell on a resolution, and lots of finger pointing.
I feel you are on the right track and the error is related to the invcol.exe file.  I see this error only upon a server boot as was indicated in the last few posts.  How do you get Dell to address the issue?  You gave me a case # but from the information that they replied back with no-one at Dell seems to know anything about fwinvn32.exe and the error I am having.
Were you seeing this error or another one?  Why can't Dell technical support look at the case and see a reference to fwinvn32.exe?  I am really tired of chasing my tail on this one when I feel that this error is related to the Dell server environment.  There doesn't seem to be other users having this same file issue on any other platform?
Again, I appreciate the feedback from everyone but so far I have NOT resolved the issue as it was originally put out there.

I got lucky when I called Dell. The tech that answered the phone just finished a month long case with this issue. Email him at  Brooks_Roberts@Dell.com and reference the case number. I will also email you the file if you like but use it at your own risk.

I sent an Email to him as per your suggestion.  Thank you.  I will post any new information here concerning this issue until I get it solved.

I had the same problem with a 2950 server with Dell OpenManage Server Administrator Version 5.5.0 installed.  The problem with the fwinvn32.exe comes from a boot order conflict.  The old version of invcol.exe is responsible for the current failure youre seeing.  Replacing the old invcol.exe with the version from the new OMSA (6.0.1, not yet released for the 2950) fixes the boot order conflict and thus the error disappears.  A reboot is required after doing this.  Case number: 7112382. Tech: Abderrahmane_Lahmams@Dell.com.  Thanks for posting the other case number.  It came in handy when calling in this case.

Be sure to read the posts in order to get the proper case ID for reference in your communication with Dell.

This situation was also be resolved by updating my RAID Controller firmware and RAID Windows Drivers.  v6.1.0 OM software also contains the invcol.exe referenced above and is now available.