Solved Event log service is unavailable?

[stevieray]

Hey everybody!

I am trying to chase down a new bug in my system (something about MUI/GUI(?) stopped working...), and a tried to check my Event Viewer, but it tells me that "The Event log service is unavailable. Verify that the service is running."

This is a brand new issue. I haven't had trouble using the Event Viewer before. Anyone run into this problem before? And how can I turn the Event log service back on?

Thanks!

 

[richc46]

Do you think that searching for and then using "services", might lead you in the right direction?

edit I found this on MS site.



http://support.microsoft.com/kb/172156

 

[stevieray]

Here is a snip of the event viewer as it currently appears on my system.

Edit: I'm trying to avoid the obvious fixes (like sfc /scannow) 'cause I don't want to have to repatch all of those files... I just got things lookin' great.

 

[stevieray]

Do you think that searching for and then using "services", might lead you in the right direction?

edit I found this on MS site.
How to Delete Corrupt Event Viewer Log Files

Thanks for the reply. I began my quest on the MS websites. I really didn't see anything close to the issue I'm facing.

 

[Jacee]

Did you use a 'registry cleaner'?

 

[Frostmourne]

What have you patched?

 

[stevieray]

Did you use a 'registry cleaner'?

Never. I have CCleaner on my system, but I only use it to dump cookies/temp files/ caches/etc...

 

[stevieray]

What have you patched?

I patched the uxtheme files necessary to run third-party themes. I also changed a few files to run decent icons.

 

[richc46]

computer management>services and appl>srvices>com and event services Click and turn on. You should be good to go. S/b set to automatic

 

[stevieray]

computer management>services and appl>srvices>com and event services Click and turn on. You should be good to go. S/b set to automatic

No go. According to Comp. Management, the service was already running (and set to auto), so I chose to restart it... it didn't help. I then rebooted (just in case), but still no love.

I have no proof, but I suspect this problem is connected with the Malicious Software Removal Tool I installed Friday night... I have had a string of little problems ever since then, like a service called "MMC" stopped running, and the MUI stopped as well...

These functions all seem to be in the same dependency tree with RPC, as is COM + Event System.

 

[richc46]

Bite the bullet. System restore or System image. Go back prior to updates. Dont install the mal. tool.

 

[stevieray]

I'll try rolling back to Friday, if that doesn't work I'll try sfc/ scannow. Thanks for the help!

 

[richc46]

If you are correct and the Mal. Tool Removal caused the problem, if you roll back to that point, your problem should be solved. If that does not work a roll back with the system image, will definaltly solve the problem. You will be rolling back to an image when everything worked. I feel that we are so very close to a solution. I will continue to look, I hate to lose.

.

 

[stevieray]

I rolled back to before the MSRT install, but it still won't work. It must've stopped functioning earlier than I thought...

 

[stevieray]

Hmmm... what to try next? Should I uninstall MS updates/hotfixes until it functions, or just run sfc/ scannow?

 

[richc46]

if it were me I would go with scannow, but you indicated that you prefer not to go that route. There is no proof that the problem was caused by the updates. Hold off for a day or two. If I think of anything else I will, get back to you. Just keep us posted to your actions and outcome. If everyone followed through with their final outcome, we would all benefit and learn.

 

[stevieray]

Well, I went through all of the updates and uninstalled them one-by-one... made no difference. Since the Event viewer used to work fine (I last used it about a week ago), and now suddenly doesn't, I thought I'd try to "undo" any changes I made to the system recently, in the hope that one of those undone changes would fix it.

I guess its a corrupted file somewhere... if I had a bunch of time, I'd compare hashes of likely culprits, with someone who's system works fine, until the bad file is revealed... but who has that kind of free time? Not me!

Edit: Decided to run "sfc /VERIFYONLY". Maybe I can examine the list of "corrupted" files it produces, and only fix the non-patched ones.

 

[richc46]

How about this, back up your stuff, just in case. Then, with the Windows 7 DVD, do a repair. That should work, and you probably will not need the back up, but you will have it just in case.

 

[stevieray]

How about this, back up your stuff, just in case. Then, with the Windows 7 DVD, do a repair. That should work, and you probably will not need the back up, but you will have it just in case.

That's gonna have to be my next step. SFC only found a few corrupted files... and they were all corrupted on purpose (patched to run third-paarty themes, icons, start buttons).

Oh, and the command "sfc /verifyonly" was supposed to only check the files, not fix them... but it fixed them anyway. So I've got to repatch everything anyway. Feh.

 

[stevieray]

For future reference for others who may stumble upon this thread, these are the "corrupted" files the sfc scan found:

C:\Windows\System32\imagesp1.dll
C:\Windows\System32\imageres.dll
C:\Windows\System32\shell32.dll
C:\Windows\SysWOW64\shell32.dll
C:\Windows\SysWOW64\imageres.dll
C:\Windows\SysWOW64\imagesp1.dll

These are all files that must be modified in order to customize themes, start orbs, and icons in Windows 7. Repairing these files didn't fix the original Event Viewer issue... it only broke much of my customization. Double feh.