cherrio

Extraordinary Member
Joined
Jan 4, 2010
Messages
114
This morning out of the blue I have many errors on my trusty Win 7 Pro 64bit machine. I have fixed all errors but I still get an audit failure in the event viewer under Windows Logs, Security.

This particular partition is the C: vol 3 which is identified as FAT32 EFI System Partition.

Is there a way to fix this? I have no idea whey this error stated this morning among all the other faults. Perhaps malware or virus but I have cleaned all the up with only finding a few pups that I have known about for a year and have left alone as it was a Wondershare converter program I had been using (until the latest version stopped it from converting anything over 500Mb and I uninstalled - but not cleanly enough and traces still existed).
 

Attachments

  • TRI8066.webp
    TRI8066.webp
    58.4 KB · Views: 283
  • TRIFC96.webp
    TRIFC96.webp
    54.5 KB · Views: 387
Solution
You can try and fix the corrupted file by opening an admin command prompt and running sfc/scannow, it should fix it but if not could you send us the cbs.log it created with any errors it encountered.
You can try and fix the corrupted file by opening an admin command prompt and running sfc/scannow, it should fix it but if not could you send us the cbs.log it created with any errors it encountered.
 

Solution
Volume3 would be your C drive. The volumes assigned in diskpart don't correspond to the Windows object symbolic links. If you look in WinObj and look for the link for C: in the GLOBAL?? namespace it will likely have the symbolic link \Device\HarddiskVolume3
 

You can try and fix the corrupted file by opening an admin command prompt and running sfc/scannow, it should fix it but if not could you send us the cbs.log it created with any errors it encountered.
I will run sfc/scannow a couple of more times after I finish posting this, but here is the cbs.log from yesterday. It did not fix anything
 

Volume3 would be your C drive. The volumes assigned in diskpart don't correspond to the Windows object symbolic links. If you look in WinObj and look for the link for C: in the GLOBAL?? namespace it will likely have the symbolic link \Device\HarddiskVolume3
Vol 3 is the FAT partition on the C: drive and is about 100Mb according to the screen shot I originally posted.
 

As I stated before the IDs in diskpart don't correspond to the object IDs. Vol 3 is your C drive. The EFI partition will have a different volume object ID

You can see this if you download WinObj. Mine is different because I have an extra partition.
An image from 'Code Integrity determined that the page hashes of an image file are not valid.'. The images show symbolic links for C: drive to HarddiskVolume4 and disk volume details from DISKPART.


You can see they don't match up

An image from 'Code Integrity determined that the page hashes of an image file are not valid.'. The images show symbolic links for C: drive to HarddiskVolume4 and disk volume details from DISKPART.
 

Last edited by a moderator:
Back
Top