Share via

ERROR in EVENT VIEWER

Anonymous
2020-06-28T03:50:04+00:00

Very Intermittent problem.

The below EVENT VIEWER - EVENT TYPE - ERROR has me perplexed.

( NOTE ) : EVENT VIEWER - EVENT TYPE -ERROR is at the very end of  this page.

What i have tried as to the computers go, no go affair and occasional strange and differing errors making it very difficult to lay one finger on the problem directly.

This began when the computer decided not to boot properly and started with the wrong resolution on screen.

Very intermittent problem leading me to believe its a Hardware Issue relating to the Graphics Card initially.

On successive re-boots and error checking this proved NOT TO BE the Graphics Card.

( Tested with a brand new one from the workshop old and new, all OK ).

( Tested Memory, all OK ).

( Tested Power Supply, all OK ).

( Tried my REPAIR DISK and found bugger all ).

If i remember correctly, at one point it did say there was some DATA CORRUPTION within the REGISTRY CABINET ( Therefore i did do a RESTORE ) but problem persists.

Sometimes it would boot properly into the correct resolution and on some re-boots it would not boot.

When it did NOT BOOT i could still RE-Start and access SAFE MODE for further problem diagnosis.

After going back to a FULL BOOT from SAFE MODE it STARTED CORRECTLY.

The next in-line successive boots after that were failures again though SAFE MODE still worked fine.

Ran a Standard Windows Hard Drive Check which gave it a clean bill of health when i did get it to start correctly.

Ran SFC ( also a clean bill of health ).

Did a RESTORE from a good known point.

On RE-START it BOOTED CORRECTLY.

Successive BOOTS after that failed again to boot properly. 

Decided to try a earlier RESTORE and to my surprise they were NO LONGER THERE.

At this  point i was on the verge of going out and purchasing a new hard drive ( even though this one is approx 6 weeks old ).

One thing i overlooked and failed to do was REPLACE the HARD DRIVE S-ATA CABLE which i have now done and should have done at the very beginning to rule that out.

Low and behold it is now all working fine " BUT " on each BOOT it still LOGS this SAME PERSISTENT ERROR in the EVENTS VIEWER.

Ran SEA-TOOLS which gave the HARD DRIVE a CLEAN BILL of HEALTH.

ERROR in EVENTS VIEWER continues to persist.

Anyone have any experience with this type of issue as it seems to be a DATABASE PAGE CACHE that is READING INCORRECTLY producing a PAGE CHECKSUM MISMATCH.

( Whilst still using the FAULTY S-ATA CABLE when the computer did BOOT FULLY it may have written a DIFFERENT CHECKSUM therefore the MISMATCH after having replaced it with a new one which it now shows in the EVENT VIEWER - EVENT TYPE - ERROR ).

Wondering if there is a way of fixing this so the ERROR no longer shows ???

Log Name:      Application

Source:        ESENT

Date:          26/06/2020 2:45:13 PM

Event ID:      474

Task Category: Database Page Cache

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Frank-PC

Description:

Catalog Database (1300) Catalog Database: The database page read from the file "C:\Windows\system32\CatRoot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" at offset 3489792 (0x0000000000354000) (database page 851 (0x353)) for 4096 (0x00001000) bytes failed verification due to a page checksum mismatch.  The expected checksum was [5fe92016d60a7373] and the actual checksum was [5f0f20f0a48df8b3].  The read operation will fail with error -1018 (0xfffffc06).  If this condition persists then please restore the database from a previous backup.  This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="ESENT" />

    <EventID Qualifiers="0">474</EventID>

    <Level>2</Level>

    <Task>2</Task>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2020-06-26T04:45:13.000000000Z" />

    <EventRecordID>18859</EventRecordID>

    <Channel>Application</Channel>

    <Computer>Frank-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data>Catalog Database</Data>

    <Data>1300</Data>

    <Data>Catalog Database: </Data>

    <Data>C:\Windows\system32\CatRoot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb</Data>

    <Data>3489792 (0x0000000000354000)</Data>

    <Data>4096 (0x00001000)</Data>

    <Data>-1018 (0xfffffc06)</Data>

    <Data>[5fe92016d60a7373]</Data>

    <Data>[5f0f20f0a48df8b3]</Data>

    <Data>851 (0x353)</Data>

  </EventData>

</Event>

Windows for home | Previous Windows versions | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-07-05T05:54:04+00:00

    I reckon corrupt data got written to the file when the cable was faulty.

    Reset catroot2 folder

    To reset the catroot2 folder do this:

    Open an elevated Command Prompt, type the following command one after the other and hit Enter:

    net stop cryptsvc




md %systemroot%\system32\catroot2.old




xcopy %systemroot%\system32\catroot2 %systemroot%\system32\catroot2.old /s

    Next, delete all the contents of the catroot2 folder.

    Having done this, in the CMD windows, type the following and hit Enter:

    net start cryptsvc

    Your catroot folder will be reset, once you start Windows Update again.

    As there were no other thoughts and reply's on my question apart from Marks, ( Thank you Mark and i will keep this script you presented saved for future reference and testing ), ....... I have decided to leave this ERROR in the EVENTS VIEWER alone for now.

    My logic is since it does not cause any problem whatsoever with the functioning and operation of the Computer ( apart from its nuisance factor of the ERROR LOGGING in the EVENTS VIEWER on BOOT ), ....Its probably best to leave it alone as it is not  CLASSIFIED as CRITICAL.

    To my way of thinking its just a ID Number that does not match the original ID Number ( in relation to the CHECKSUM ) which resides in the CATROOT2 FOLDER as a file or other.

    What i believe to have happened is that while the COMPUTER and HARD DRIVE continued to function with the FAULTY S-ATA CABLE it wrote a new CHECKSUM which now does not correspond with the OLD LOGGED CHECKSUM.

    ( 1 HARD DRIVE but 2 CHECK-SUMS LOGGED for it ).

    Much the same way as when one downloads a program / software that is supplied with a CHECKSUM to compare it to to make sure its legitimate and not some pirated or virus-ed software.

    Any more thoughts on this or corrections please reply.

    One learns something new every day.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2020-06-28T14:25:01+00:00

    I reckon corrupt data got written to the file when the cable was faulty.

    Reset catroot2 folder

    To reset the catroot2 folder do this:

    Open an elevated Command Prompt, type the following command one after the other and hit Enter:

    net stop cryptsvc

md %systemroot%\system32\catroot2.old

xcopy %systemroot%\system32\catroot2 %systemroot%\system32\catroot2.old /s

    Next, delete all the contents of the catroot2 folder.

    Having done this, in the CMD windows, type the following and hit Enter:

    net start cryptsvc

    Your catroot folder will be reset, once you start Windows Update again.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  3. Anonymous
    2020-06-29T04:45:22+00:00

    Thanks Mark.

    Before i do this i have another question as to the Catroot2 Folder Contents.

    Within the Cattroot2 folder are 2 other File Folders as well as some text files and jrs files including a recovered file fragment that may relate to the faulty S-ATA Cable.

    Do i DELETE all the Catroot2 contents including these 2 File Folders that reside within it ???

    Was this answer helpful?

    0 comments