Article ID: 172156 - View products that this article applies to.
This article was previously published under Q172156
When you launch Windows Event Viewer, one of the following error messages may occur if one of the *.evt files is corrupt:
The handle is invalid
When you click OK or cancel on the Dr. Watson error message, you may also receive the following error message:
Dr. Watson Services.exe
Exception: Access Violation (0xc0000005), Address: 0x76e073d4
The services.exe process may consume a high percentage of CPU utilization.
Remote Procedure Call failed
The Event Viewer Log files (Sysevent.evt, Appevent.evt, Secevent.evt) are always in use by the system, preventing the files from being deleted or renamed. The EventLog service cannot be stopped because it is required by other services, thus the files are always open. This article describes a method to rename or move these files for troubleshooting purposes.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(https://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
FAT partition (Alternative method)
Article ID: 172156 - Last Review: February 23, 2007 - Revision: 2.5