Hi Noel,
I just wanted to let you know that I posted 'nplist2.log' as requested. I am home today, due to a lovely snow storm hitting our area, so, if you have any questions, I will be available to respond reasonably quickly. No rush at all..
Cheers,
Jim
lol, no worries at all..
Thank you
Finally caught up so I can concentrate on some of the knottier ones :)
I can't see anything obviously amiss in those listings.
There are slight anomalies in the C:\Windows\ServiceProfiles\LocalService folder - where you have 94 files showing as hidden (I have less than 30) - and the C:\Windows\System32\config folder (100/70)
I'm also a little puzzled as to why co many oem*.inf files are tagged as hidden - although I can't see it causing any problems.
Please upload the Windows System and Application Event logs so I can take a look - it may help isolate your problem.
To do this
run the following commands in an Elevated Command Prompt, (to copy them to the desktop) then compress and upload the copies.
COPY C:\Windows\System32\winevt\Logs\application.evtx %userprofile%\desktop\apps.evtx
COPY C:\Windows\System32\winevt\Logs\System.evtx %userprofile%\desktop\Sys.evtx
Hi Noel,
on both of these, what copied to the desktop was the following:
MMC could not create the snap-in
MMC could not create the snap-in. The snap-in might not have been installed correctly.
Name: Event Viewer
CLSID:FX:{b05566ad-fe9c-4363-be05-7a4cbb7cb510}
This was the same on both events.
Thank you.
Jim
That would only happen if you attempted to open the files - not simply copy or compress them.
Hmmm,
Okay, I copied each one in to the command prompt, it created the folders on the desktop, I compressed them. Note on each, (before compression), it has a red circle with a "X" and a yellow triangle with a exclamation mark. I did compress them and have attached. I hope it works this time..
So sorry.
Unfortunately, both files are corrupted - I'll have to see if I can work out a way to read what's there.
Is it something I'm doing wrong Noel? Or, are they corrupted before I copy them to the desktop?
I think it's the originals that are corrupted - possibly by a broken service
I don't think I'll be able to pull anything sensible out of the data left, and they aren't much use to you as they are anyhow (and may be causing further problems) so we should delete them.
I'm just trying to work out how best to do it - there is no simple article available that I can see.
Please run the following commands, and we'll see what the Event services are actually doing, so we can decide how to approach it.
SC QUERYEX EVENTLOG
SC QUERYEX WINMGMT
SC QUERYEX WECSVC
SC QUERYEX SCHEDULE
SC QUERYEX HTTP
post the results.
Quote