On a site, a strange Win16 error appeared when running a passive: error in S32evnt1.dll.

After much research this was found to be caused by an old version of nortons anti virus version 8 or 9 installed on the computer (the av had been uninstalled and replaced by kaspersky). The message appears when any 16 bit program is run. Since a passive does not need to run any 16 bit apps, the solution was to rename c:\microscan\tagmon.exe to c:\microscan\ttagmon.exe and the message no longer appears.

Searching S32evnt1.dll on the web will yield the official symantec support notes for the issue. They were not tried.

Note: Passive 5.0.3000 no longer starts tagmon.exe on startup.