Event Viewer Crashes
Hello,
Trying to access the Event Viewer in my W7 Ulitimate x64 machine. MMC starts fine, and other MMC apps work.
I get same result if I run eventvwr.exe or if I run MMC and then open the event viewer. Each time, I get the following message:
Problem signature:
Problem Event Name: APPCRASH
Application Name: mmc.exe
Application Version: 6.1.7600.16385
Application Timestamp: 4a5bc808
Fault Module Name: KERNELBASE.dll
Fault Module Version: 6.1.7600.16385
Fault Module Timestamp: 4a5bdfe0
Exception Code: c000041d
Exception Offset: 000000000000aa7d
OS Version: 6.1.7600.2.0.0.256.1
Locale ID: 1033
Additional Information 1: 46b5
Additional Information 2: 46b58121c9f2560689e145b4dc343836
Additional Information 3: 38d3
Additional Information 4: 38d36bc51ff6dc4d689c937359098f1a
I was finally able to run the event viewer by double clicking on the eventvwr.msc file in SysWOW64.
In the event log I could open, I found this:
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: mmc.exe
P2: 6.1.7600.16385
P3: 4a5bc808
P4: KERNELBASE.dll
P5: 6.1.7600.16385
P6: 4a5bdfe0
P7: c000041d
P8: 000000000000aa7d
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mmc.exe_a353fbd4a4cbf6d84ded6216bc4b1182fde53b3d_0fc55b49
Analysis symbol:
Rechecking for solution: 0
Report Id: b922e400-a022-11df-872c-005056c00008
Report Status: 0
And this:
Faulting application name: mmc.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc808
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0
Exception code: 0xc000041d
Fault offset: 0x000000000000aa7d
Faulting process id: 0xa60
Faulting application start time: 0x01cb342f77edcea0
Faulting application path: C:\Windows\SysWOW64\mmc.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: b922e400-a022-11df-872c-005056c00008
Any ideas?
August 5th, 2010 2:52am
Hi,
Thanks for posting in Microsoft TechNet forums.
AppCrash can be caused by program conflicts, system file corrupt or incompatible version of files. Regarding your problem, I noticed that you can run 32bit eventvwr.exe,
but can’t run 64bit eventvwr.exe. It seems that the kernelbase.dll file isn’t correctly registered for 64bit.
To resolve this kind of issue, I would like to propose the following suggestions:
1.
Clean Boot your system to see if the crash occurs.
2.
Run
SFC /SCANNOW command to automatically fix the system files.
3.
Register the KernelBase.dll, please run a command prompt in elevated privilege, and type the following command:
Regsvr32 Kernelbase.dll
Regsvr32 c:\windows\SysWOW64\Kernelbase.dll
4.
If the issue persists, please perform an in-place upgrade. In-place Upgrade is a special upgrade process to repair the system. In-place Upgrade will not affect settings like
photos, movies, documents, etc. that are saved on the computer. Moreover, In-place upgrade doesn’t require activation again.
1)
Perform a
clean boot in the current operating system.
2)
Insert the Windows 7 Installation Disc to your DVD-ROM drive. If AutoPlay pops up, click “Run setup.exe” directly.
3)
Click “Install now” on the “Install Windows” screen.
4)
In the “Get important updates for installation” screen, it is recommended to select the first option to download latest updates for installation, if Internet access
is available.
5)
Check the box “I accept the license terms” to agree with the installation license and click “Next”.
6)
In the “Which type of installation do you want?” screen, click “Upgrade” to perform the In-Place upgrade.
7)
Then, follow the wizard to finish the In-place Upgrade process.
Best Regards
Dale Qiao
TechNet Subscriber Support in forum. If you have any feedback on our support, please contact
tngfb@microsoft.com
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2010 6:35am