- Thread Author
-
- #1
I have been logging a security audit error since Sep 2015, on my desktop Asus P9X79-E-WS (Xeon E5-1650 v2) running Windows 7 Ultimate (x64) Service Pack 1 (build 7601). Only recently - one week maybe - I have been experiencing my mouse hesitating and a beep when the mouse stops momentarily (sometimes locks up). This mouse problem is what made me look for errors in the even viewer. I am also experiencing more IE 11 hangs but think this is an unrelated issue (I could be off base there)
Below is the audit error
I try the Win online help and of course it cannot find such an error. Interestingly enough the only Volume2 on this PC (which has four internal SSD and HDDs, none of which are "Vol 2") is a NAS reference. I have no trouble accessing either Vol 1 or Vol 2 on the Ethernet connected NAS which includes two HDDs, 500Gb each which have been in use more than 5 years with minimal trouble.
So I search for the reported path in the audit failure report on the C: drive (which is a SSD2SC240GD2DH16T-T [Hard drive] (240.06 GB) -- drive 0, s/n PNY1332xxxxx) and the file is no where to be found anywhere in this path. I repeat searches removing the highest most path identifier and never find it until only looking for the file itself. Without a path it is found SIX times in various other locations. pic included showing where it found this file.
Any ides what this means and how can I get rid of the audit failure, not that I think it is serious or has anything to do with mouse freezing up momentarily?
Below is the audit error
Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.
File Name: \Device\HarddiskVolume2\Windows\System32\sxs.dll
- System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 6281
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2016-01-24T15:06:01.842183300Z
EventRecordID 403761
Correlation
- Execution
[ ProcessID] 4
[ ThreadID] 64
Channel Security
Computer DuaneP9-PC
Security
- EventData
param1 \Device\HarddiskVolume2\Windows\System32\sxs.dll
File Name: \Device\HarddiskVolume2\Windows\System32\sxs.dll
- System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid] {54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 6281
Version 0
Level 0
Task 12290
Opcode 0
Keywords 0x8010000000000000
- TimeCreated
[ SystemTime] 2016-01-24T15:06:01.842183300Z
EventRecordID 403761
Correlation
- Execution
[ ProcessID] 4
[ ThreadID] 64
Channel Security
Computer DuaneP9-PC
Security
- EventData
param1 \Device\HarddiskVolume2\Windows\System32\sxs.dll
I try the Win online help and of course it cannot find such an error. Interestingly enough the only Volume2 on this PC (which has four internal SSD and HDDs, none of which are "Vol 2") is a NAS reference. I have no trouble accessing either Vol 1 or Vol 2 on the Ethernet connected NAS which includes two HDDs, 500Gb each which have been in use more than 5 years with minimal trouble.
So I search for the reported path in the audit failure report on the C: drive (which is a SSD2SC240GD2DH16T-T [Hard drive] (240.06 GB) -- drive 0, s/n PNY1332xxxxx) and the file is no where to be found anywhere in this path. I repeat searches removing the highest most path identifier and never find it until only looking for the file itself. Without a path it is found SIX times in various other locations. pic included showing where it found this file.
Any ides what this means and how can I get rid of the audit failure, not that I think it is serious or has anything to do with mouse freezing up momentarily?
Last edited by a moderator: