Events Register damaged

[Cla]

On a Packard Bell Notebook I couldn't start a session anymore (and had great
difficulties in starting a temporary session too) because the Events Register
was damaged.
Everything is fine if I exclude the Events Register from the Services on
start-up (unchecking it in msconfig).
Is there a way to repair the Register, in order to have it woking again,
avoiding to restore all of the system in the original status with the Master
DVD?

Thanks for helping.

 

[Gerry]

Cla

Is Events Register something special to a Packard Bell computer or are
you referring Event Viewer, which comes with Windows XP?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Cla]

Thank you for answering.
It is Event Viewer of Windows XP in fact: I roughly translated from the
Italian name in msconfig.

 

[Gerry]

Cla

Background information on Stop Error code:
http://msdn2.microsoft.com/en-us/library/ms797159.aspx

This occurs when Windows switches into kernel mode and a user-mode
subsystem, such as Winlogon or the Client Server Runtime Subsystem
(CSRSS), is compromised. Security can no longer be guaranteed. Because
Win XP can't run without Winlogon or CSRSS, this is one of the few
situations where the failure of a user-mode service can cause the system
to stop responding. This Stop message also can occur as a result of
malware infestation or when the computer is restarted after a system
administrator has modified permissions so that the SYSTEM account no
longer has adequate permissions to access system files and folders.
http://aumha.org/a/stop.htm

Have you recently restored your system from a back up?

You could try System Restore from a restore point dating from before the
problem first arose,

http://bertk.mvps.org/


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Cla]

Thank you Gerry.

I haven't recently restored my system from a back up, but something appened
during surfing in Internet.
Anyway, Norton 360 didn't find anything, but a threat that was cancelled
(and it didn't seem to me that it entered).

Moreover, if I tried to start under F8 choosing tha Last Known Good
Configuration, this didn't help.

Now the story becomes a bit odd.
I tried to restore the system from a restore point dating from before the
problem first arose.
Through Start-All Programs - Accessories - System Tools - System Restore, I
received the answer (translation): "System Restore can't protect the system:
restart and try again"; of course, no use to restart and try again.

But I succeded in acceding System Restore through the Start - Run box.
In this case, apparentrly I restored to a date before (at least Windows
confirmed), but I still found that Event Viewer was unchecked under
msconfig\selective start\services, when, at a date before, it was checked.

Therefore, I 've checked it and the problem reappeared.

Now, if I try to to restore to an even earlier date, System Restore either
denies or it is impossible to choose any date but to-day: in practice also
System Restore doesn't work any more!

At the moment, the only thing I can do is to live without Event Viewer.

 

[Gerry]

Cla

Select Start, Control Panel, Administrative Tools, Services. Right click
on Event Log and select Properties. The StartUp type should be
Automatic. If it is something else, change it to Automatic (the scroll
bar gives access to options) and click on Apply and OK. Exit and Restart
your computer for the change to take effect.

To use System Restore to restore to an earlier date you will need need
to do this in Safe Mode to prevent Norton 360 from interfering.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Cla]

Gerry

I think I'm back again.

First.
Under Start, Control Panel, Administrative Tools, Services I've turned in
automatic all item that could corrispond to the English "Event Log".
Especially "Registro Eventi" (corrisponding to my previous rough traslation
in "Event Register"); first time only this item, second time together with
other possible items.
Starting again the problem stroke back.
Therefore, I've had to newly disable "Registro Eventi", leaving in automatic
the others, that probably don't have anything to do.

Second.
In safe mode, System Restore denies to run, giving me the stupid wording
I've already translated for the other case: something like "System Restore
can't protect the system, please start again and retry".
In all cases, it seems that all restore points have been deleted (by who?,
after when I tried yesterday).
Why there is no System Volume Information fold in Windows XP Home Edition?

Cla

 

[Gerry]

Cla

I am not sure what is causing the problem with Event Viewer. Can you try
and copy actal error messages even if they are in Italian.

Here some further information about Norton and System Restore.
http://bertk.mvps.org/html/symantecdoc1.html

Your problem could be the BackUp and Restore feaure in Norton 360.

BTW had 14 days break at Malcesine on Lake Garda last September. Very
pleasant.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[John John (MVP)]

Probably a long shot but try deleting the Event Log files and see if
things change:

How to Delete Corrupt Event Viewer Log Files
http://support.microsoft.com/kb/172156

John

 

[Cla]

Thank you all.

Gerry,
if I boot with Event Viewer on, I receive on a blue screen, with very
confused letters, this message:
"STOP: c000021a [errore irreversibile di sistema]
Processo di sistema Windows Logon process terminato in modo inatteso
con stato 0xc0000005 (0x0000000 0x0000000)
il sistema è stato chiuso"
Something like: "STOP: c000021a [system irreversible error]
Sytem process Windows Logon process ended in a unexpected way
with state 0xc0000005 (0x0000000 0x000000)
the system has been shut down"

I have disabled Norton 360, but the problem with Windows System Restore is
still that apparently it can't find any restore point before the problem
occured.
Maybe, it could work, if only it could find some point, I don't know...

John John
One of the first things I tried was just to delete Event Viewer files, with
no difference.
As to the Microsoft article, while Event Log is desabled (key value 0x4), in
the path %SystemRoot%\System32\Config I can find the three *.evt files
referred to, but I can't understand if any is damaged.
What should I do? Since Microsoft says that the damaged files could be moved
elsewhere, can I delete everything??? In alternative, Microsoft says that the
file should be renamed: what does it mean? I don't thing I can give it a
fantasy name...

For all helpers: I'll be out for some two weeks, but I'll still appreciate
possible new suggestion at my coming back.

Thanks for now.

 

[Gerry]

Cla

How long before your Norton 360 subscription expires? I would not renew
it.

When was your Packard purchased new? Did it come with SP2 already
installed.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Cla]

Hi Gerry

At the date, it is 329 days before Norton 360, version 2.2.0.2, expires.

As to SP2, I'm not sure, since in fact it's my daughter's NoteBook: anyway,
it was purchased on January 2007.
I think SP2 was around at that time (and I was still happy with my Windows
98 SE...), so I think SP2 was installed.

Cla