When I start Explorer I get a Dr Watson error, what can I do?

A. If when you start Explorer yet receive the error:

The handle is invalid


Dr. Watson Services.exe
Exception: Access Violation (0xc0000005), Address: 0x76e073d4

This may be caused by a corrupt event file, a .evt file. Clicking OK to the error may also display the error:

Event Viewer
Remote Procedure Call failed

The Event Viewer Log files (Sysevent.evt, Appevent.evt, Secevent.evt) are always in use by the system thus preventing the files from being deleted or renamed. The EventLog service (which has the files open) cannot be stopped because it is required by other services, thus the files are always open.

In order to fix there are two methods depending on if your boot partition is NTFS or FAT

NTFS Partition

  1. Click the Services control panel applet (Start - Settings - Control Panel - Services)
  2. Select the EventLog service and click Startup. Change the Startup Type to Disabled, and then click OK. If you are unable to log on to the computer but can access the registry remotely, you can change the Startup value in the following registry key to 0x4:
  3. Restart Windows NT.
    NOTE: When the system starts up, several services may fail; a message informing the user to use Event Viewer to review errors may appear.
  4. Rename or move the corrupt *.evt file from the following location:
  5. In Control Panel Services tool, reenable the EventLog service by setting it back to the default of Automatic startup, or change the registry Startup value back to 0x2.

If you had another copy of NT installed on the computer you could boot to that installation and directly delete the .evt files from the %systemroot%\system32\config directory.

FAT Partition

  1. Boot to a MS-DOS prompt using a DOS bootable disk or an alternate operating system installed on the computer.
  2. Rename or move the corrupt *.evt file from the following location:
  3. Remove the disk and restart Windows NT.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.