[Amrita]

Thanks so much for all you have done Pieter. I am very fortunate to have come across this site and you have been so very helpful! I am going to get some sleep myself now..will check back later. Thanks again! Amrita

[Advertisements]

OK. I have a lot of reading and "unhexing" to do now.

Rest well,

[Metallica]

OK. I have a lot of reading and "unhexing" to do now.

Rest well,

[Metallica]

I hope this is enough.

Copy the part in bold below into notepad and save it as dispevlog.reg
Set filetype to "All files"

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]
"Description"="Stores Events written by programs and applications to logs. This service can not be stopped."
"DisplayName"="Event Log"
"ErrorControl"=dword:00000001
"Group"="Event log"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,65,00,72,00,76,00,69,00,63,00,65,00,73,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="LocalSystem"
"PlugPlayServiceType"=dword:00000003
"Start"=dword:00000002
"Type"=dword:00000020


Confirm you want to merge it with the registry.

Regards,

[Amrita]

Hi Pieter,

I followed your instructions but when I saved the file I did not get any message asking if I should merge with the registry. Should I be saving it in any particular folder?

Thanks, Amrita

[Metallica]

No you will have to doublelclick it after you saved it in order to activate it.

I forgot to tell you

[Amrita]

Very impressive! Now I have an entry for Event log under Services. Unfortunately its status is stopped and when I try to start it I get a msg saying

Could not start the Event Log Service on Local computer. Error 2: The system cannot find the file specified.

Thanks, Amrita

[Metallica]

That is very awkward, since it points to C:\WINNT\system32\services.exe and I saw that in your running processes in the first log you posted.

Can you find that file, rightclick it and post the properties?
Version number etc.

[Amrita]

Hello..here you go..

Type of file: application
Description: Services and Controller app
Location: C:\WINNT\system32
Size: 87.2 KB (89,360 bytes)
Size on disk:87.5 KB (89,600 bytes)
Created: Dec 31, 1979
Modified: June 19th, 2003
Accessed: Today, July 03, 2005, 5:40:50 AM
Version: 5.0.2195.6700
Company name:Microsoft Corporation
Internal name: services.exe
Original filename:services.exe
Product name:Microsoft® Windows ® 2000 Operating System


The following options are checked:
File is ready for archiving
Allow indexing service to index this file

Also all permissions under Security are set to Allow.

Hope I got all the info you need.
Thanks, Amrita

[Metallica]

It's a start.

Can you find eventlog.dll and see if that has the same version number?

Regards,

[Amrita]

I'm glad you still have a happy smiley! Thanks for your patience. Here is the info on eventlog.dll

Type of file: Application Extension
Opens with: Unknown application
Location: C:\WINNT\system32
Size: 6.7 KB (47,888 bytes)
Size on disk:47.0 KB (48,128 bytes)
Created: Thursday, August 12, 2004, 10:03:40 AM
Modified: Tuesday, March 23, 2004, 10:17:01 PM
Accessed: Today, July 03, 2005, 1:05:35 PM
Version: 5.0.2195.6883
Company name:Microsoft Corporation
Internal name: Eventlog.DLL
Original filename:Eventlog.DLL
Product name:Microsoft® Windows ® 2000 Operating System

The version is slightly different.

Thanks, Amrita

[Metallica]

This stinks. If the Event Viewer was working we could see which file it was missing, but since that is the service we are trying to fix we can't.

Do you have an original Windows 2000 CD ?

If so, click Start > Run > copy&paste sfc /scannow >OK

Windows will look for system files taht are missing, corrupted or outdated and prompt you for the CD if it comes across one that needs to be replaced.

Regards,

[Amrita]

Does the Windows 2000 disk have to be the same that was used for the original installation? I dont have that but I do have one that was used on another computer..however when I tried to use it , Windows rejected it and said that it was the wrong product CD. Is it because that copy of Windows 2000 is not licensed for this PC?

Thanks, Amrita

[Metallica]

Some computers come with installation CD's
These are completely different from Windows CD's and useless for what I had in mind.
All they do is put your computer back the way it was when you bought it.
These are also different per computer and can not be used on others.

The problem is that I don't know which file is missing.

An alternative would be to use the dllcache folder:
Not sure if that will work for win2K: http://www.updatexp....cannow-sfc.html
but I'm willing to try if you are.

First run sfc /scannow to see if it actually wants a file, or we would be going through the trouble for nothing.

Regards,

[Amrita]

Hi Pieter,

The article you pointed me to was helpful..one of the things it said was that if scannow did not work, to try putting the Windows CD in a different drive. I have 2 CD drives and yesterday I had inserted the Windows CD in my E drive and Windows kept rejecting it. So today I retried scannow and when it asked for the Windows CD I put it in the D drive and it worked! Scannow ran for a while but then it ended without any further messages. I rebooted just in case and then checked to see if Event log was working..it was still stopped. When I tried to start it I got the same old msg saying File was missing

Thanks, Amrita

[Metallica]

Bummer.

services.exe uses about 30 dll's on my computer.
Most of them are also in use by other processes, so there would be more significant problems if any of those was missing.

Besides eventlog.dll I found one more file that might be specific for the Eventlog service: AppEvent.evt in the C:\WINDOWS\system32\config folder

Can you see if you have that too?
The path may be slightly different since I am working on an XP computer.

Regards,