Windows 7 Code Integrity determined that the page hashes of an image file are not valid

cherrio

Extraordinary Member
Joined
Jan 4, 2010
I have been logging a security audit error since Sep 2015, on my desktop Asus P9X79-E-WS (Xeon E5-1650 v2) running Windows 7 Ultimate (x64) Service Pack 1 (build 7601). Only recently - one week maybe - I have been experiencing my mouse hesitating and a beep when the mouse stops momentarily (sometimes locks up). This mouse problem is what made me look for errors in the even viewer. I am also experiencing more IE 11 hangs but think this is an unrelated issue (I could be off base there)

Below is the audit error

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.


File Name: \Device\HarddiskVolume2\Windows\System32\sxs.dll


- System



- Provider


[ Name] Microsoft-Windows-Security-Auditing

[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}


EventID 6281


Version 0


Level 0


Task 12290


Opcode 0


Keywords 0x8010000000000000


- TimeCreated


[ SystemTime] 2016-01-24T15:06:01.842183300Z


EventRecordID 403761


Correlation


- Execution


[ ProcessID] 4

[ ThreadID] 64


Channel Security


Computer DuaneP9-PC


Security

- EventData


param1 \Device\HarddiskVolume2\Windows\System32\sxs.dll

I try the Win online help and of course it cannot find such an error. Interestingly enough the only Volume2 on this PC (which has four internal SSD and HDDs, none of which are "Vol 2") is a NAS reference. I have no trouble accessing either Vol 1 or Vol 2 on the Ethernet connected NAS which includes two HDDs, 500Gb each which have been in use more than 5 years with minimal trouble.

So I search for the reported path in the audit failure report on the C: drive (which is a SSD2SC240GD2DH16T-T [Hard drive] (240.06 GB) -- drive 0, s/n PNY1332xxxxx) and the file is no where to be found anywhere in this path. I repeat searches removing the highest most path identifier and never find it until only looking for the file itself. Without a path it is found SIX times in various other locations. pic included showing where it found this file.
TRID76B.jpg

Any ides what this means and how can I get rid of the audit failure, not that I think it is serious or has anything to do with mouse freezing up momentarily?
 
The sxs.dll (valid windows system file) is having an issue with some 3rd party driver... I do remember Asus posted an alert that a doggy Realtek HD audio driver could cause this issue on W7 machines but as far as I know the only work around was to remove the realtek driver then use the windows default instead.

The mouse issue sounds like a driver conflict as well but prob not related to this error... I suggest you replace it with a moden mouse (wifi or cord)
 
Back
Top Bottom