Eventvwr.msc doesn't open

[capi]

Ok, will logon and off, didn't know i had to do that

Anyways, many thanks for your time :D if you come up with any other possible solution just tell me

 

[Flavius]

Yes i did a system restore to before i installed this register cleaner. But it didn't help

I doubt your trouble is caused by using registry cleaner,otherwise your trouble gone now.System Restore in Vista restore all registry,system and application files - in this checkpoint you had no registry cleaner what you told...
Check permissions for both eventvwr.exe i eventvwr.msc what I told you few posts above
http://www.vistax64.com/tutorials/67717-take-ownership-file.html

EDIT

ooops I'm late...

 

[capi]

No, it didn't work, same error message as always

 

[Flavius]

No helps because you have trouble with permissions or virus or both or you have another trouble but longer than 10 days.Did you checked system what I told you in post 11,checked permissions for files (post 22)? Then you'll finish scan try this.Download file which I attached,unpack file P1 and place it in C:
Run cmd.exe with administritive previlliges(right click on this file>>run as administrator - it is neccessary if you have UAC turned on) and type:

icacls C:\Windows\System32 /restore C:\P1

 

[capi]

Sorry for being so late, i have been busy. Well i did the virus scan, and no problem was detected. I even searched for everything containing eventvwr.msc in the report that i saved after finishing the scan, and it said OK besides them all.
So the problem isn't in a virus at least. Will try what the las post said then :huh:

 

[capi]

No helps because you have trouble with permissions or virus or both or you have another trouble but longer than 10 days.Did you checked system what I told you in post 11,checked permissions for files (post 22)? Then you'll finish scan try this.Download file which I attached,unpack file P1 and place it in C:
Run cmd.exe with administritive previlliges(right click on this file>>run as administrator - it is neccessary if you have UAC turned on) and type:

icacls C:\Windows\System32 /restore C:\P1

This is what i get in the command box:

C:\Windows\system32>
C:\Windows\system32>icacls C:\Windows\System32 /restore C:\P1
C:\Windows\System32\System32: Systemet cannot find specified file.
0 files has been treated, 1 file has not been treated

C:\Windows\system32>

 

[Flavius]

Oh I forgot to take ownership this folder - sorry.Only owners can change permissions.Try this in following order

takeown /f C:\Windows\System32
icacls C:\Windows\System32 /restore C:\P1

 

[capi]

This is what i get then:

C:\Windows\system32>takeown /f C:\Windows\System32

Succeded: The file (or folder) C:\Windows\System32 is now owned by user [PC_name]-PC\[User_name].

C:\Windows\system32>icacls C:\Windows\System32 /restore C:\P1
C:\Windows\System32\System32: Systemet cannot find specified file.
0 files has been treated, 1 file has not been treated

C:\Windows\system32>

 

[Flavius]

So man learn all his life.I've just trained these command on my Virtual PC and result are likely to you:huh:,but this will be work:

takeown /F C:\Windows\System32\ /R /D N
icacls C:\Windows\System32\*.* /grant Administrators:F /t

Permissions after this action will be a bit stronger than original,so after try how event viewer work...
Try it what I gave you above untill now I think how to restore really original permissions..

 

[capi]

So man learn all his life.I've just trained these command on my Virtual PC and result are likely to you:huh:,but this will be work:

takeown /F C:\Windows\System32\ /R /D N
icacls C:\Windows\System32\*.* /grant Administrators:F /t

Permissions after this action will be a bit stronger than original,so after try how event viewer work...
Try it what I gave you above untill now I think how to restore really original permissions..

Yes, did it, it seems i took permisson of all files in system32, but isn't that dangerous and risky?

And then about this part:

icacls C:\Windows\System32\*.* /grant Administrators:F /t

it says:
*C:\Windows\system32>icacls C:\Windows\System32\*.* /grant Administrators:F /t
Administrators:No assignments were made between account names and security IDs.
0 files has been treated, 1 file has not been treated.

[*:This has been translated from Norwegian to english]

My computer comes in Norwegian lenguage, maybe i have to translate a part of it?

Btw thanks a lot for ur support!! :D i think u will solve the problem if u keep on like this

 

[Flavius]

Yes, did it, it seems i took permisson of all files in system32, but isn't that dangerous and risky?

This taking ownership folder,subfolders and files (it wasn't taking permissions) is not dangerous,but of course normally shouldn't do like we shouldn't turn on built-in Administrator account but in extremally situation we've no choice but restoring ownership is easy unlike to restoring permissions

Can you differentiate ownership and permissions?

Of course giving to much more permissions could be dangerous (computer will be more risk virus infection) but even if you'll only give Administrators full control for C:\Windows\System32 (and containers) permisions for this group will be the same like are natural in XP - but if you will work on XP only on limited account you will be save like to work in Vista with UAC turned on.I don't know and I think nobody know why permissions in Vista so subtle - probably is some second protection if any user don't use UAC to prevent any viruses to penetrate so deeply in the system as usually happens in XP if you working on administrative account.Of course normally we shouldn't do this also but sometimes we've no choice :huh:

And then about this part:

icacls C:\Windows\System32\*.* /grant Administrators:F /t

it says:
*C:\Windows\system32>icacls C:\Windows\System32\*.* /grant Administrators:F /t
Administrators:No assignments were made between account names and security IDs.
0 files has been treated, 1 file has not been treated.

It's strange because by me this command work perfect :huh:
and this command?:

icacls C:\Windows\System32\ /grant Administrators:F /t

But there is way (sophisticated) to diagnose losing permissions.Download and place
anywhere Process Monitor Process Monitor
Run it and try run event viewer - of course you have no chance to do it but it is not concern at the moment ->the main meaning is allow Process Monitor see what kind of problem you have trouble.After all save log in Process Monitor as a *.PML file.
It will be better if I'll see this log myself but because it will be too big to attache here pack this file to *.zip and upload it on Speedy Share - upload your files here

Any changing permissions will do manually http://www.vistax64.com/tutorials/67717-take-ownership-file.html

 

[capi]

To make it easier, i filtered the process monitor loeaving only mmc files so it would be easier for u

Logfile.rar

 

[Flavius]

I found your problem but until now I don't now how to fix it:See yourself:

log with filter: RESULT IS ACCESS DENIED:


of course log shows some trouble with permissions but there are false alarm with permission- your trouble is time.Created,Visited,modiefied in....1601 year

other part your log without any filters:



You have full files created,modiefied in.... 1601 year although also exist files with correct time.Are you travelling in time?Of course due to time paradox you have mad event viewer.Check time in BIOS.

If time in BIOS and in the system is correct you make additional log.In cmd.exe type:
C:
cd\
cd /d C:\Windows
dir /s >C:\log.txt

On C: appear log.txt<- upload it on Speedy Share - upload your files here
because it will be too big too attache here also

Can you explain your paradox in time?

 

[capi]

After seing that strange thing, I wanted to see if it was maybe just a mistake of the computer, and tried to run event viewer again, while having processor monitor open.
The first time I got this:

Logfile2.rar

Then I tried again, and I got the same result as the one posted yesterday all the time I tried again.

About

C:
cd\
cd /d C:\Windows
dir /s >C:\log.txt

Here is the file:

log.txt

*Innhold means content

Do u think a repair install would solve everything?
I don't want to formate my laptop!!

 

[Flavius]

In new log haven't strange things but It disturb me still it was before.Give me full log without any filters.Have you checked time in BIOS what I asked you in my previus post? I had a few time ago accident difference time in system and BIOS.In system time was OK but in BIOS was 2090 year and due to I couldn't install antivirus and returned me access denied although permissions were correct.

Do u think a repair install would solve everything?

Not always.I'm thinking now there is not system trouble only BIOS trouble or CMOS battery...due to time paradoxes your event viewer went mad

 

[capi]

Posted the log.txt file

 

[capi]

Here u have, enjoy

FullLogfile.rar

 

[Flavius]

The log.txt is all right also.
I'll check this PM log until now you try this command:due to undentified shortly temponautic shock your event viewer went mad and you have to clear all events of course without opening event viewer.
In cmd.exe try this (I hope these command will work)

wevtutil cl Application
wevtutil cl System
wevtutil cl Security
wevtutil cl HardwareEvents
wevtutil cl ForwardedEvents
wevtutil cl "DFS Replication"

if no help but commands no return errors (this means works) type

wevtutil el >C:\evt.txt

In C: appear file evt.txt <-attache this file here

EDIT
Unfortunatly you still live in 1601 year :eek:


I think about it later when I'll back...


PS.I'll have no time for 3 days,I have you leave you at the moment...

 

[Flavius]

I've checked your PM log - probably only Norman generate events from 1601 year but I don't know why,


have you checked time in BIOS what I asked you?-although difficult explain back 400 years due to BIOS neverless you should check it.Uninstall Norman completly,after remove manually directory C:\Program Files\Norman and after all in cmd.exe type:

wevtutil el >C:\evt.txt

this log shows whats section you have in event viewer and you have to clear all sections in event viewer by using command wevtutil cl for all sections not only what I gave you in my previous post.If all troubles gone you'll have no problem to open event viewer and install Norman again....

 

[capi]

evt.txt

There u got what u asked for in post 38.

BIOS time is perfect!!