Code Integrity determined that the page hashes of an image file are not valid.

cherrio

Extraordinary Member
This morning out of the blue I have many errors on my trusty Win 7 Pro 64bit machine. I have fixed all errors but I still get an audit failure in the event viewer under Windows Logs, Security.

This particular partition is the C: vol 3 which is identified as FAT32 EFI System Partition.

Is there a way to fix this? I have no idea whey this error stated this morning among all the other faults. Perhaps malware or virus but I have cleaned all the up with only finding a few pups that I have known about for a year and have left alone as it was a Wondershare converter program I had been using (until the latest version stopped it from converting anything over 500Mb and I uninstalled - but not cleanly enough and traces still existed).
 


Attachments

nmsuk

Windows Forum Admin
Staff member
Premium Supporter
You can try and fix the corrupted file by opening an admin command prompt and running sfc/scannow, it should fix it but if not could you send us the cbs.log it created with any errors it encountered.
 


Neemobeer

Windows Forum Team
Staff member
Volume3 would be your C drive. The volumes assigned in diskpart don't correspond to the Windows object symbolic links. If you look in WinObj and look for the link for C: in the GLOBAL?? namespace it will likely have the symbolic link \Device\HarddiskVolume3
 


cherrio

Extraordinary Member
You can try and fix the corrupted file by opening an admin command prompt and running sfc/scannow, it should fix it but if not could you send us the cbs.log it created with any errors it encountered.
I will run sfc/scannow a couple of more times after I finish posting this, but here is the cbs.log from yesterday. It did not fix anything
 


cherrio

Extraordinary Member
Volume3 would be your C drive. The volumes assigned in diskpart don't correspond to the Windows object symbolic links. If you look in WinObj and look for the link for C: in the GLOBAL?? namespace it will likely have the symbolic link \Device\HarddiskVolume3
Vol 3 is the FAT partition on the C: drive and is about 100Mb according to the screen shot I originally posted.
 


Neemobeer

Windows Forum Team
Staff member
As I stated before the IDs in diskpart don't correspond to the object IDs. Vol 3 is your C drive. The EFI partition will have a different volume object ID

You can see this if you download WinObj. Mine is different because I have an extra partition.
1533223189707.png


You can see they don't match up

1533223262875.png
 


This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.
Top