Error 0xc0000428, "Windows cannot verify the digital signature for this file"

This code is Windows saying a file failed its integrity check, so the loader refused to trust it. Microsoft's name for it is STATUS_INVALID_IMAGE_HASH. It shows up in two places, in a browser as an "Aw, Snap!" page when another program injects an unsigned DLL into a tab, and at startup or driver load when a driver or system file is unsigned, damaged, or tampered with.

The fix, in order

  1. Note where the error appears. If it is a browser tab showing "Aw, Snap!", follow the browser steps below. If it appears at startup or when a driver loads, skip to step 4.
  2. Update the browser. Install the latest Chrome or Edge, since newer versions handle injected DLLs more gracefully, and restart the browser after updating.
  3. Find the injecting software. In Chrome open chrome://conflicts, or in Edge open edge://conflicts, and look at the modules loaded into renderer processes. Update or uninstall the antivirus, data loss prevention, overlay, or accessibility program that owns the rejected DLL, then restart the browser.
  4. Update the driver or program from its maker. If the error names a driver or a program file, download a fresh, signed copy from the hardware or software maker's official site. Do not install drivers from third-party driver sites.
  5. Run a full malware scan. Use Windows Security or your installed security software, since tampered files are one of the things this check is designed to catch.
  6. Repair Windows files. In an admin Command Prompt run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth.
  7. Check the Code Integrity log. Open Event Viewer, go to Applications and Services Logs, Microsoft, Windows, CodeIntegrity, Operational, and look for the event that names the rejected file, so you know exactly which file and program to fix.
Do not disable driver signature enforcement or Secure Boot to get past this. Those checks are what caught the bad file, and turning them off lets unsigned or tampered code run. A properly signed replacement from the maker is the fix.

If it still happens

If the browser error returns after you updated everything, try the browser with all extensions disabled and any third-party security software temporarily uninstalled, then re-enable them one at a time to find the injector. If a driver still fails its signature check after a fresh download from the maker, check whether the system clock is wrong, since a clock set far in the past or future can make a valid signature look expired.

Common questions

Is 0xc0000428 a virus? Not by itself. It means a file failed a signature check, which can happen to a legitimate file that was damaged, badly updated, or injected by another program. But because malware can tamper with files, a full scan is a sensible step, especially when the error names a system file.

Why does Chrome show STATUS_INVALID_IMAGE_HASH? Chrome and Edge run web pages in sandboxed processes that refuse DLLs not signed by Microsoft. When antivirus, data loss prevention, overlay, or accessibility software injects its own DLL into a page process, Windows rejects it and every tab shows Aw, Snap with this code. Updating or removing the injecting software is the fix.

Should I disable driver signature enforcement to fix 0xc0000428? No, not as a fix. Disabling signature enforcement lets unsigned and possibly tampered drivers load, which removes the protection that caught the problem. Get a properly signed driver from the hardware maker instead, and only use test signing if you are a developer testing your own driver.

Related errors

Error 0xc000012f · Error 0xc000007b · Error 0xc0000409

Was this helpful?