locked
Event Viewer Crashes RRS feed

  • Question

  • Hello,

    Trying to access the Event Viewer in my W7 Ulitimate x64 machine.  MMC starts fine, and other MMC apps work.

    I get same result if I run eventvwr.exe or if I run MMC and then open the event viewer.  Each time, I get the following message:

    Problem signature:
      Problem Event Name: APPCRASH
      Application Name: mmc.exe
      Application Version: 6.1.7600.16385
      Application Timestamp: 4a5bc808
      Fault Module Name: KERNELBASE.dll
      Fault Module Version: 6.1.7600.16385
      Fault Module Timestamp: 4a5bdfe0
      Exception Code: c000041d
      Exception Offset: 000000000000aa7d
      OS Version: 6.1.7600.2.0.0.256.1
      Locale ID: 1033
      Additional Information 1: 46b5
      Additional Information 2: 46b58121c9f2560689e145b4dc343836
      Additional Information 3: 38d3
      Additional Information 4: 38d36bc51ff6dc4d689c937359098f1a

    I was finally able to run the event viewer by double clicking on the eventvwr.msc file in SysWOW64.

    In the event log I could open, I found this:

    Fault bucket , type 0

    Event Name: APPCRASH

    Response: Not available

    Cab Id: 0

    Problem signature:

    P1: mmc.exe

    P2: 6.1.7600.16385

    P3: 4a5bc808

    P4: KERNELBASE.dll

    P5: 6.1.7600.16385

    P6: 4a5bdfe0

    P7: c000041d

    P8: 000000000000aa7d

    P9:

    P10:

    Attached files:

    These files may be available here:

    C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mmc.exe_a353fbd4a4cbf6d84ded6216bc4b1182fde53b3d_0fc55b49

    Analysis symbol:

    Rechecking for solution: 0

    Report Id: b922e400-a022-11df-872c-005056c00008

    Report Status: 0

    And this:

    Faulting application name: mmc.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc808

    Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0

    Exception code: 0xc000041d

    Fault offset: 0x000000000000aa7d

    Faulting process id: 0xa60

    Faulting application start time: 0x01cb342f77edcea0

    Faulting application path: C:\Windows\SysWOW64\mmc.exe

    Faulting module path: C:\Windows\system32\KERNELBASE.dll

    Report Id: b922e400-a022-11df-872c-005056c00008

    Any ideas?

    Wednesday, August 4, 2010 11:52 PM

Answers

  • Hi,

     

    Thanks for posting in Microsoft TechNet forums.

     

    AppCrash can be caused by program conflicts, system file corrupt or incompatible version of files. Regarding your problem, I noticed that you can run 32bit eventvwr.exe, but can’t run 64bit eventvwr.exe. It seems that the kernelbase.dll file isn’t correctly registered for 64bit.

     

    To resolve this kind of issue, I would like to propose the following suggestions:

     

    1.     Clean Boot your system to see if the crash occurs.

    2.     Run SFC /SCANNOW command to automatically fix the system files.

    3.     Register the KernelBase.dll, please run a command prompt in elevated privilege, and type the following command:

     

    Regsvr32 Kernelbase.dll

    Regsvr32 c:\windows\SysWOW64\Kernelbase.dll

     

    4.     If the issue persists, please perform an in-place upgrade. In-place Upgrade is a special upgrade process to repair the system. In-place Upgrade will not affect settings like photos, movies, documents, etc. that are saved on the computer. Moreover, In-place upgrade doesn’t require activation again.

     

    1)    Perform a clean boot in the current operating system.

    2)    Insert the Windows 7 Installation Disc to your DVD-ROM drive. If AutoPlay pops up, click “Run setup.exe” directly.

    3)    Click “Install now” on the “Install Windows” screen.

    4)    In the “Get important updates for installation” screen, it is recommended to select the first option to download latest updates for installation, if Internet access is available.

    5)    Check the box “I accept the license terms” to agree with the installation license and click “Next”.

    6)    In the “Which type of installation do you want?” screen, click “Upgrade” to perform the In-Place upgrade.

    7)    Then, follow the wizard to finish the In-place Upgrade process.

     

    Best Regards

    Dale Qiao
    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Dale Qiao Sunday, August 8, 2010 6:36 AM
    Thursday, August 5, 2010 3:35 AM

All replies

  • Hi,

     

    Thanks for posting in Microsoft TechNet forums.

     

    AppCrash can be caused by program conflicts, system file corrupt or incompatible version of files. Regarding your problem, I noticed that you can run 32bit eventvwr.exe, but can’t run 64bit eventvwr.exe. It seems that the kernelbase.dll file isn’t correctly registered for 64bit.

     

    To resolve this kind of issue, I would like to propose the following suggestions:

     

    1.     Clean Boot your system to see if the crash occurs.

    2.     Run SFC /SCANNOW command to automatically fix the system files.

    3.     Register the KernelBase.dll, please run a command prompt in elevated privilege, and type the following command:

     

    Regsvr32 Kernelbase.dll

    Regsvr32 c:\windows\SysWOW64\Kernelbase.dll

     

    4.     If the issue persists, please perform an in-place upgrade. In-place Upgrade is a special upgrade process to repair the system. In-place Upgrade will not affect settings like photos, movies, documents, etc. that are saved on the computer. Moreover, In-place upgrade doesn’t require activation again.

     

    1)    Perform a clean boot in the current operating system.

    2)    Insert the Windows 7 Installation Disc to your DVD-ROM drive. If AutoPlay pops up, click “Run setup.exe” directly.

    3)    Click “Install now” on the “Install Windows” screen.

    4)    In the “Get important updates for installation” screen, it is recommended to select the first option to download latest updates for installation, if Internet access is available.

    5)    Check the box “I accept the license terms” to agree with the installation license and click “Next”.

    6)    In the “Which type of installation do you want?” screen, click “Upgrade” to perform the In-Place upgrade.

    7)    Then, follow the wizard to finish the In-place Upgrade process.

     

    Best Regards

    Dale Qiao
    TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    • Marked as answer by Dale Qiao Sunday, August 8, 2010 6:36 AM
    Thursday, August 5, 2010 3:35 AM
  • Hello, I have the same problem with the event viewer only crashing but not if I open the one under SysWow64. I the first few steps but on Step 3 I receive an error: "kernelbase.dll was loaded but the entry-point dllregisterserver was not found" for both DLLs. Any ideas before I continue on the next steps or should I invoke /in options in the regsvr32 command??
    Friday, February 17, 2012 3:33 PM