[den01]

Hi,

After starting PC goes to black screen with the message:
Windows could not start because the following file is missing or corrupt:
\windows\system32\config\system

You can attempt to repair this file by starting Windows setup using the original setup CD-ROM.
Select ‘r’ at the first screen to start repair

Than I try to do that: change the boot sequence, boot from CD, windows blue screen started to load files… on the “welcome to setup” screen I pressed the ‘r’ (for the repair xp using recovery console)… and that I have black screen with the message:
Microsoft Windows XP™ Recovery Console
The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\Windows

Which windows installation would you like to log onto
(To cancel, press ENTER)? and cursor at the end

Well, I cannot type EXIT – I can only type ‘e’ but nothing else. So what do you advice I should do? Actuly, that’s the end of the road with pressing the’r’ as whatever I do - two above messages comes on the screen.

For the info, I have original xp, so that’s not problem (and its just one system on PC). I never done system recovery (didn’t need to) so I don’t want do formatting if is possible to sort out this.
Additionally, PC was shut down properly and its working all the time without any problems. There is no any malware and xp is uptodate.
And finally, if I do repair (after your advice how) do I have to do windows update again?

Thank you for help.

Den

[Advertisements]

Hi again,

Just 2 update – I have sort it out.

Regards

den

[den01]

Hi again,

Just 2 update – I have sort it out.

Regards

den

[Retired Tech]

Thank You for the update

Would you be able to post how you managed to resolve it

[den01]

Well, taking out my lack of common sense – it was quite strait forward:
On this message:
Microsoft Windows XP™ Recovery Console
The Recovery Console provides system repair and recovery functionality.
Type EXIT to quit the Recovery Console and restart the computer.

1: C:\Windows

Which windows installation would you like to log onto
(To cancel, press ENTER)? and cursor at the end

I HAVE TO PRESS 1 (of course!) and that EXIT, and everything finish happily in 10 sec. this is proof that using some brain power before panicking is useful.

Regards,

Den

[Retired Tech]

Thank You

[den01]

Of course there is still mystery why this happens on the first place.

[Retired Tech]

Items in blue which are underlined are clickable to give more information about the process

Click start then run, type prefetch then press enter, click edit then select all, right click any file then click delete, confirm delete

Click start, all programmes, accessories, system tools to run disc clean up, then from system tools, run disc defragmenter.

Click start then run, type sfc /scannow then press enter, you need the XP CD and Windows File Protection will show a blue onscreen progress bar, when the bar goes, reboot

If you do not have an XP CD you can borrow a same version as was originally installed XP CD, if you downloaded SP2 then you need an SP1 XP CD

Click start then run, type chkdsk /f /r then press enter, type Y to confirm for next boot, press enter then reboot.

Windows will appear to load normally then either the monitor will show progress or the screen will go blank, do not disturb this.

This will take an hour or so before it gets to the desktop.

Download and install Tune Up 2006 Trial

Run Tune Up Disc Clean Up

Run Tune Up Registry Clean Up

Click Optimize and Improve to run Reg Defrag, which will take a few minutes and need a reboot. You should disable the antivirus programme to run this and check it is running after the reboot

After the reboot, click optimize then system optimizer to optimize the computer, select computer with an internet connection from the drop down menu, this also requires a reboot

After the reboot, click optimize then system optimizer to accelerate downloads, select the speed just above your actual connection speed, this requires a reboot

After the reboot, click optimize then system optimizer to run system advisor

[den01]

Thanks Keith,

I regularly visit this forum and very often (when I don’t do anything else) check the many things as advised on many topics - so, regarding to your advice:
- I regularly clean prefetch;
- My PC is always defragmented – well I have two physical drives of 120GB and each of them with same partitions (40 + 80GB). The C drive is 40GB and I have just programs on it. Everything else is on backed up on each of 80GB drives, so I feel pretty safe regarding my docs.
- For the software side I am also quite safe: all programs that I am using are on original CDs (including XP SP2), apart from utilities that I am using (AVG, Zona Alarm, Spybot, AdAware and spywareBlaster) so basically I really do not have a problem, if anything goes wrong, to do just formatting of C drive.
- I done actually chkdsk /f /r yesterday and its OK.
- I have TuneUp and regularly do disc and reg clean up.

The only problems on event viewer are:
1. Dhcp - Warning – None – 1007 - Your computer has automatically configured the IP address for the Network Card with network address 0090967D6DC8. The IP address being used is 169.and.num.ber. (I am not sure do I have to place the full no – if you need the no I will send you)
2. W32Time – Error – None – 17 - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
3. W32Time – Error – None – 29 - The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

These three things are regular in my event viewer and they come up always in the order 1-2-3 but much more often in order 2-3. Usually I don’t see anything that actually happens on PC at the time of the errors.

The only “major” issue is: when playing the chess online on Yahoo games, sometimes cursor just freezes and I cannot do anything but to reboot the PC (and yes, the errors are there). A part of that everything is fine. So is this (and how big) the problem.

Thanks for advice.

Den

[Retired Tech]

How to use Event Viewer to view and manage Event Logs in Windows XP

Event Viewer

In Windows XP, an event is any significant occurrence in the system or in a program that requires users to be notified, or an entry added to a log. The Event Log Service records application, security, and system events in Event Viewer. With the event logs in Event Viewer, you can obtain information about your hardware, software, and system components, and monitor security events on a local or remote computer. Event logs can help you identify and diagnose the source of current system problems, or help you predict potential system problems.

Event Log Types

A Windows XP-based computer records events in the following three logs:

• Application log

The application log contains events logged by programs. For example, a database program may record a file error in the application log. Events that are written to the application log are determined by the developers of the software program.

• Security log

The security log records events such as valid and invalid logon attempts, as well as events related to resource use, such as the creating, opening, or deleting of files. For example, when logon auditing is enabled, an event is recorded in the security log each time a user attempts to log on to the computer. You must be logged on as Administrator or as a member of the Administrators group in order to turn on, use, and specify which events are recorded in the security log.

• System log

The system log contains events logged by Windows XP system components. For example, if a driver fails to load during startup, an event is recorded in the system log. Windows XP predetermines the events that are logged by system components.

How to View Event Logs

To open Event Viewer, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.

2. In the console tree, click Event Viewer.

The Application, Security, and System logs are displayed in the Event Viewer window.

How to View Event Details

To view the details of an event, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.

2. In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.

3. In the details pane, double-click the event that you want to view.

The Event Properties dialog box containing header information and a description of the event is displayed.

To copy the details of the event, click the Copy button, then open a new document in the program in which you want to paste the event (for example, Microsoft Word), and then click Paste on the Edit menu.

To view the description of the previous or next event, click the UP ARROW or DOWN ARROW.

How to Interpret an Event

Each log entry is classified by type, and contains header information, and a description of the event.

Event Header

The event header contains the following information about the event:

• Date - The date the event occurred.

• Time - The time the event occurred.

• User - The user name of the user that was logged on when the event occurred.

• Computer - The name of the computer where the event occurred.

• Event ID - An event number that identifies the event type. The Event ID can be used by product support representatives to help understand what occurred in the system.

• Source - The source of the event. This can be the name of a program, a system component, or an individual component of a large program.

• Type - The type of event. This can be one of the following five types: Error, Warning, Information, Success Audit, or Failure Audit.

• Category - A classification of the event by the event source. This is primarily used in the security log.

Event Types

The description of each event that is logged depends on the type of event. Each event in a log can be classified into one of the following types:

• Information

An event that describes the successful operation of a task, such as an application, driver, or service. For example, an Information event is logged when a network driver loads successfully.

• Warning
An event that is not necessarily significant, however, may indicate the possible occurrence of a future problem. For example, a Warning message is logged when disk space starts to run low.

• Error

An event that describes a significant problem, such as the failure of a critical task. Error events may involve data loss or loss of functionality. For example, an Error event is logged if a service fails to load during startup.

• Success Audit (Security log)
An event that describes the successful completion of an audited security event. For example, a Success Audit event is logged when a user logs on to the computer.

• Failure Audit (Security log)

An event that describes an audited security event that did not complete successfully. For example, a Failure Audit may be logged when a user cannot access a network drive.

How to Find Events in a Log

The default view of event logs is to list all its entries. If you want to find a specific event, or view a subset of events, you can either search the log, or you can apply a filter to the log data.

How to Search for a Specific Log Event

To search for a specific log event, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.

2. In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.

3. On the View menu, click Find.

4. Specify the options for the event that you want to view in the Find dialog box, and then click Find Next.
The event that matches your search criteria is highlighted in the details pane. Click Find Next to locate the next occurrence of an event as defined by your search criteria.

How to Filter Log Events

To filter log events, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.

2. In the console tree, expand Event Viewer, and then click the log that contains the event that you want to view.

3. On the View menu, click Filter.

4. Click the Filter tab (if it is not already selected).

5. Specify the filter options that you want, and then click OK.

Only events that match your filter criteria are displayed in the details pane.

To return the view to display all log entries, click Filter on the View menu, and then click Restore Defaults.

How to Manage Log Contents

By default, the initial maximum of size of a log is set to 512 KB, and when this size is reached, new events overwrite older events as needed. Depending on your requirements, you can change these settings, or clear a log of its contents.

How to Set Log Size and Overwrite Options

To specify log size and overwrite options, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.
2. In the console tree, expand Event Viewer, and then right-click the log in which you want to set size and overwrite options.

3. Under Log size, type the size that you want in the Maximum log size box.

4. Under When maximum log size is reached, click the overwrite option that you want.

5. If you want to clear the log contents, click Clear Log.

6. Click OK.

How to Archive a Log

If you want to save your log data, you can archive event logs in any of the following formats:
• Log-file format (.evt)
• Text-file format (.txt)
• Comma-delimited text-file format (.csv)

To archive a log, follow these steps:

1. Click Start, and then click Control Panel. Click Performance and Maintenance, then click Administrative Tools, and then double-click Computer Management. Or, open the MMC containing the Event Viewer snap-in.

2. In the console tree, expand Event Viewer, and then right-click the log in which you want to archive, and then click Save Log File As.

3. Specify a file name and location where you want to save the file. In the Save as type box, click the format that you want, and then click Save.
The log file is saved in the format that you specified.

REFERENCES

For more information about a specific event or error, visit the following Microsoft Web site:

http://www.microsoft...entserrors.mspx

For additional information about how to use Event Viewer, see Event Viewer Help. (In the Event Viewer snap-in or Computer Management window, on the Action menu, click Help).

APPLIES TO

• Microsoft Windows XP Home Edition

• Microsoft Windows XP Professional

[den01]

Thanks Keith,

Well I don’t want to take much of the time (people have much more serious problems that this one).

I have just copy the full errors/warnings and I have paste the answers from the Microsoft site, so please, when you are not too busy if you can just give me short (a few lines) explanations (and maybe how I can sort it out) in, lets say, plain English.

For the info: I have AOL broadband which is always on, but I use just IE for browsing. PC is home comp and not connected on any network.

These three events are in the same order as above:
1.
Event Type: Warning
Event Source: Dhcp
Event Category: None
Event ID: 1007
Date: 07/05/2006
Time: 10:05:47
User: N/A
Computer: DEN-958E95F7B63
Description:
Your computer has automatically configured the IP address for the Network Card with network address 0090967D6DC8. The IP address being used is 169.and.num.ber.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 ....


on microsoft site this is the info:
Explanation
The DHCP Client service on your computer did not receive a response from the DHCP server to the DHCP Discover message within the time limit; therefore your computer's IP address was assumed to be invalid, and the DHCP Client service generated another IP address.

If connection with the network is not established using this APIP address, the DHCP Client service will try to contact the DHCP server with a new IP address every five minutes as long as the APIP service is active.

The failure of the DHCP server to respond could be caused by network connectivity issues, DHCP server or DHCP relay malfunction, firewall issues, or a malfunction of your computer's network interface card or driver.


User Action
If your computer is connected to the network by cable, confirm that the cable is plugged in. If you have a wireless network connection, confirm that you have a signal and the proper credentials for the wireless network.

The DHCP Client service will continue trying to obtain a working IP address until it succeeds. If the network connection is not established automatically, check the following possible causes and take corrective action:


The DHCP server is down or not responding.
The DHCP relay is not functioning correctly.
The network is down.
The firewall on your computer is blocking out network broadcast traffic.
Your computer's network interface card or driver is not functioning correctly.



2.
Event Type: Error
Event Source: W32Time
Event Category: None
Event ID: 17
Date: 07/05/2006
Time: 10:05:48
User: N/A
Computer: DEN-958E95F7B63
Description:
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


on microsoft site this is the info:
Explanation
The name of the time source, a manually configured peer, cannot be resolved.


User Action
Do one or more of the following:

Verify that the DNS name for the time source is a valid name.
Verify that the time source is available on the network by pinging the server.



3.
Event Type: Error
Event Source: W32Time
Event Category: None
Event ID: 29
Date: 07/05/2006
Time: 10:05:48
User: N/A
Computer: DEN-958E95F7B63
Description:
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.


on microsoft site this is the info:
Explanation
The Windows Time Service cannot synchronize time with its time sources. Windows Time Service will attempt synchronization at a later time.

The W32time 29 message is usually caused by connectivity issues between a client and its source. In some cases, the source computer is unavailable; it may be restarting, disconnected from the network, or unreachable because of firewall or router configurations. If the W32time 29 condition persists, you should immediately troubleshoot the issue to ensure that successful synchronization can resume.


User Action
To ensure that the system can connect to the source, do one or more of the following:

Verify that the local computer is capable of contacting the desired source. In most cases, a simple connectivity test such as “ping” is adequate.
Confirm that Windows Time Service (or other NTP Time Service) is running and available on the source system.
If you are using a manually configured peer, such as time.windows.com, verify that the name is typed correctly and that the system is available.
Confirm that there are no network devices that block traffic on port 123 between the local computer and the time source.
W32time 29 is not a critical message when logged occasionally. It indicates that the system is unable to synchronize, which can present a problem if the condition persists. Always monitor the system after this message appears to ensure that synchronization resumes successfully.



also down the line i have found this warning (only once) as well:
Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 05/05/2006
Time: 21:37:46
User: N/A
Computer: DEN-958E95F7B63
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........



This is not priority so please in your own time. Thank you. Regards.

Den

[Retired Tech]

For 1.

Download and run

http://www.geekstogo...n=download&id=7

For 2. and 3.

Right click the clock, click adjust date and time, internet time, check it is set for time.windows.com or time.nist.gov, click update now, if you get an error with both, remove the tick for automatically synchronize, click apply

[den01]

Keith,

That was quick. Thank you.

I’ll do that now and let you know as soon as I finish.

Den

[den01]

Hi, me again.

Done the WinsockXPFix. We’ll see how it will go.

For time.windows.com is:
an error occurred while windows was synchronizing with time.windows.com

For time.nist.gov is:
The time nas been successfully synchronised with time.nist.gov on 07/05/2006 at 13:55

And I “apply” – is that OK?

I must say your instructions are in the “plain-est” English. Thank you.

Den

[Retired Tech]

Set it to use time.nist.gov and apply

[den01]

Thank you for help.
Regards.
Den