Constant Audit Failures - Event ID 6281

[Arthur Hucksake]

Getting a bit concerned about something which keeps cropping up.

I get persistent audit failures that are being logged.

Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\sxs.dll

Is sxs.dll that Side By Side?

Might explain the constant Event ID 72

Activation context generation failed for "c:\program files\microsoft security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft security client\MSESysprep.dll" on line 10. The element imaging appears as a child of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by this version of Windows.

Could this be down to Microsoft Security Essentials doing it's business?

 

[Arthur Hucksake]

If so, can you suggest a good free alternative AV?

 

[Arthur Hucksake]

The

The invalid hashes could indicate a potential disk device error.

part... worries me as my SSD has dropped a couple of marks in the WEI and don't know if a problem is brewing.

Anyone?

 

[drewho]

been getting the exact same sxs.dll error from some time last week,
disk checks out ok, used sysinternals sigcheck and the file is signed ok,
i think it was something that came with windows update last week,
formatted to check and the same sxs.dll problem came back with the latest windows updates, which one though im not sure.
or as you say it could be Microsoft Security Essentials which i reinstalled last

 

[drewho]

just an update, ive tracked my problem down to Realtek High Definition audio drivers.
removed them and the sxs.dll audit problem is gone
driver Version R2.66 or R2.65 triggers the error

 

[Arthur Hucksake]

Ahh how strange, good to know. I am running 2.65s. Thanks for clearing that up. Really much appreciated. Have to look for 2.66 if they are around.

 

[hannedog]

Has there been any update on this?

I'm at the latest driver version, R2.67, and I'm getting these errors often now.

When I just came back to my computer after leaving it for about 30 minutes, the screen had turned off, and it was unresponsive. Plugging in the keyboard in and out of various USB ports would not even light the keyboard up.

When I restarted the machine, it booted up fine. The event viewer logs had nary an error, except for about 5 consecutive audit failures of this exact type, each happening about an hour or so, the most recent one roughly right before the computer became unresponsive.

Needless to say, I don't have much else to go on as to why my computer did that.

 

[hexaae]

I've installed R2.50 (suggested drivers for my laptop on the MSI site) and I can't reproduce the problem anymore...
See Realtek High Definition Audio 2.70 Vista 64 - History - FileHippo.com

My issue was:
- System

- Provider

[ Name] Microsoft-Windows-CodeIntegrity
[ Guid] {4EE76BD8-3CF4-44A0-A0AC-3937643E37A3}

EventID 3002

Version 0

Level 2

Task 1

Opcode 102

Keywords 0x8000000000000000

- TimeCreated

[ SystemTime] 2012-10-07T12:14:16.342773400Z

EventRecordID 6544

Correlation

- Execution

[ ProcessID] 408
[ ThreadID] 5392

Channel Microsoft-Windows-CodeIntegrity/Operational

Computer Hexaae-MSI

- Security

[ UserID] S-1-5-19


- EventData

FileNameLength 48
FileNameBuffer \Device\HarddiskVolume3\Windows\System32\sxs.dll

 

[misterz100]

My friend had this issue, it has resolved his problem as well thanks.
It was slowing down his bootup and made live stream non functioning.