Corruption in the Event Viewer can be caused if one of the *.evt files is corrupt

Error messages are prompted by your Windows when there is corruption or damage of the Windows Event Viewer. The event viewer’s logfiles keeps the record of Windows security events and the information about hardware, software, and system problems. An event viewer comprises of three log files that include application log, system log, and security log. The events logged by any application are maintained in the application log. The event logged by Windows system component is maintained by the system log. The events logged by logon details are maintained in the security log. The Event Viewer Log files are in constant use by the system, thereby preventing the files from being deleted or renamed. A corruption of Event Viewer Log files requires Windows Data Recovery software for its recovery.

Consider a scenario wherein you receive one of the following error messages such as:

“a setup exe the handle is invalid error”

or

“Dr. Watson Services.exe Exception: Access Violation (0xc0000005), Address: 0x76e073d4 ”

or

“Event Viewer Remote Procedure Call failed ”

The above error message indicates corruption in the Event Viewer. The corruption can result in abrupt deletion or change of name of the files saved on the system.

Corruption in the Event Viewer can be caused if one of the *.evt files (application log, system log, and security log) is corrupt.

You can follow the following procedures to recover the damaged event viewer. The procedures are different as per the file system used by your operating system.

If your filesystem is a NTFS partition, perform the following steps:

· Click 'Start'> Settings>Control Panel

· Double-click Services

· Select the EventLog service and click Startup

· Change the Startup Type to Disabled

· Click OK

· In case you have remote access to the registry, alter the Startup value of the registry key of 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog' to 0x4

· Restart Windows

· Rename or move the corrupt *.evt file from the location as described below: %SystemRoot%\System32\Config

· Re-enable the Event Log service of the In Control Panel Services tool by providing its value as default of Automatic startup, or by altering the registry Startup to 0x2.

If your filesystem is a FAT partition, perform the following steps:

· Using a DOS bootable disk, boot to a MS-DOS prompt

· Rename or move the corrupt *.evt file from the location as described below:

%SystemRoot%\System32\Config

· Remove the disk

· Restart Windows

On the performance of the above described procedures, the data stored on the computer might get lost or damaged. In this case, to recover Windows files, you can use the can use third party Windows Data Recovery Software to successfully recover the lost filed and folders stored on the computer.