Create Custom Views in Event Viewer

The Event Viewer in the Windows operating system is used to troubleshoot any computer issues. It is one of the most useful tools that keep logs of both security and system events. It also monitors for both software and hardware problems in the computer. This tool is the only one with amazing features that maintain logs about everything that’s going on in the computer system. It keeps track of all the information to the point where going over them will take a lot of time.

Luckily, the Event Viewer tool now allows users to create custom views where you can set the filters and sort the data recorded to limit the information details to only what you’re interested in seeing. For instance, if you want to troubleshoot with one hard drive, you can just create a special custom view to display only the hard drive warnings in the security logs. This will save you hassle and time.

Take note that the logs in the Event Viewer are divided into two main categories namely the Window logs and the Application and Services logs. You can just set the filter to the logs by their event id, specific date, and many other events when you have to troubleshoot some problem in your computer. So if you are trying to troubleshoot a problem in your Windows 10 computer and you’re checking the Event Viewer, read on as this post will guide you in creating custom event views in the Event Viewer. To get started, refer to the instructions given below.

Step 1: Go to the Start menu and in the search box, type “event viewer” and then click on Event Viewer from the search results to open it.

Step 2: After opening Event Viewer, click on Custom Views located in the left pane of the window.

Step 3: Next, click on the Administrative events under the Custom View to create special log views.

Step 4: Then on the right side of the window, click on Create Custom View to open the Create Custom View window.

Step 5: There is a logged drop-down list under Filter. From there, you have the option to choose an appropriate predefined time or use a custom time range for your Custom log views.

Step 6: After that, select an appropriate event level for your custom view. You have fine entry-level options to choose from such as critical event level, error, warning, information and verbose.

  • Critical – select this if you want to see the events that require your immediate attention in the custom view.
  • Error – select this if you want your Event Viewer to display the events that are less critical but hints at the problems.
  • Warning – select this event-level if you want to see the event with the potential problem but may not bound to happen.
  • Verbose – select this if you want to see detailed information about all the events.

Step 7: After you’ve selected the event level, you now have to select how you want the events to be filtered. They can either be filtered By the log or By the source.

  • By the log – you can select two options called Windows log and, Application and Service logs. The Windows logs allow you to filter the logs created during events like setup, security, applications, and system events. While the Application and Service logs filter the log created by the installed applications in your system.
  • By the source – select this if you want your Custom View to search for information in event sources. It allows you to view events in detail for various applications and devices.

Note: You have the option to further customize the event logs with more filters like Event IDs, task category, keywords, User, and Computer. Using these additional filters, you can choose to filter the events in the special views by specifying event id numbers in the Event IDs, entering predefined Windows words in the Keyword, specify the user accounts in the User field, as well as choose the system from the server to maintain logs in the Computer field.

Step 8: Once you’re done customizing the log filter, click on OK to apply the changes made.

Step 9: After that, a Save Filter should be displayed in the Custom View window. Just enter the Custom View name and select the Event Viewer folder where you want to save the Custom view. The folder name should be Custom View by default. And if you want, you can also create your own folder if you want your custom views to be visible to all the system users.

Step 10: Next, check all the Users box located in the lower corner of the window and then click the OK button after you’re done.

You should now see the customized filter you just created on the left side of the window. Just click on it to check your filtered events in the center of the Event Viewer window. And for you to save the custom view logs, simply right-click on the Custom views you created and then click on Save All Events in the Custom View As from the drop-down menu. Then put a name on the file and select the appropriate location where you want to save the logs and click on the Save button. Note that the log file is saved with the “.EVTX” file extension and when you double click on it, it will open the file in the Event Viewer.

Do You Need Help with Your Device?

Our Team of Experts May Help
Troubleshoot.Tech Experts are There for You!
Replace damaged files
Restore performance
Free disk space
Remove Malware
Protects WEB browser
Remove Viruses
Stop PC freezing
GET HELP
Troubleshoot.Tech experts work with all versions of Microsoft Windows including Windows 11, with Android, Mac, and more.

Share this article:

You might also like

Using ???? and other emoji in Windows
Did you know you can use emoji in file names inside Windows 10? It is no secret that emojis are basically everywhere and Microsoft has seen this and integrated them into Windows itself, so you can name files using emojis or combine them with text. Placing emojis in file names or in the text is extremely easy, all you have to do is press ⊞ WINDOWS + . and the emoji dialog will open from where you can find which emoji you would like to use. And that's it, you just used emoji for the file naming.

!!!NOTE!!!

In theory, some applications may not like these emojis if they don’t support Unicode characters. However, modern applications are designed to work with a broad set of languages that should properly support emojis. For example, the classic Windows Command Prompt can’t see emoji characters in file names properly, but both PowerShell and Microsoft’s new Windows Terminal can display them properly. If you do run into a problem, you can always open File Explorer and rename the affected files and folders to remove the emoji characters. You can then use those files in applications that don’t properly support emoji file names.
Read More
Nvidia RTX 4090 & RTX 4080 unveiled

Nvidia announced the third generation of GeForce RTX GPUs called Ada Lovelace. New technology is bringing 76 billion transistors with 18,000 CUDA cores along with new gen ray tracing cores and improved Tensor cores as well. The new lineup also comes with DLSS 3 which is vastly improved from its previous version pushing a 4 times increase in frame rates over native rendering.

Nvidia RTX 4090

RTX 4090, a better model of GPU will come with 16,384 CUDA cores and a boost clock speed of 2.52 GHz. Also, it is packed with stunning 24 GB of GDDR6V VRAM. In Nvidia's words, its performance is twice faster than the 3090 Ti in games like Flight simulator, three times faster on Portal RTX, and four times faster on RacerX.

RTX 4080 comes in two modes, one with 12GB VRAM and a stronger one with 16GB VRAM but differences do not end here. The lower model is packing 7,680 CUDA cores while the stronger one is going to 9,728 CUDA cores. We will wait to see how will these cores count impact real-world performance in games.

As for prices, the flagship model RTX 4090 will be $1,600 USD and it will hit the market on October 12th. RTX 4080 12GB model will be $900 USD and the model with 16GB VRAM will go up to $1,200 USD. This, of course, is the price for Founders Edition cards, OEM cards from third parties like ASUS, MSI, Gigatech, etc will cost more.

Read More
How to Fix R6025 Pure Virtual Function Call
R6025 pure virtual function call’ is a runtime error that occurs suddenly on the screen and disrupts the program being run prior to it. This error display indicates that the program has been corrupted. R6025 runtime error usually occurs with the Visual C++ framework.

Solution

Restoro box imageError Causes

This error occurs when the C++ program crashes which is usually because of the malfunctioning or missing of the device driver or incomplete device driver files. It happens because your application indirectly calls a pure virtual member function in a context where a call to the function is invalid. Most of the time, the compiler detects it and reports it as an error when building the application. R6025 error is usually detected at run time.

Further Information and Manual Repair

To fix the R6025 pure virtual function call error, you need to find the call to the pure virtual function. After you find the call, you need to rewrite the code so that it is not called again. There are 2 ways to do this:

Alternative 1

One way to fix the R6025 pure virtual function call is to replace the function with an implementation that calls the Windows API function DebugBreak. The DebugBreak causes a hard-coded breakpoint. Once the code stops running at this breakpoint, it is easy for you to view the call stack. By viewing the call stack you can identify the place where the function was actually called.

Alternative 2

Another quick way to find a call to a pure virtual function to fix the R6025 error is to set a breakpoint on the _purecall function that is usually found in PureVirt.c. By breaking this function you can trace the problem occurring and rewrite the call to ensure the error does not occur and the program you are trying to develop on the Visual C++ framework is easily developed. If R6025 Error is related to Windows Registry Problem Then here’s how you can fix the problem: To fix the runtime error R6025, run registry cleaner software to scan and fix all errors.  This alternative is suitable if the R6025 error is related to the Windows registry problem and where the error has occurred due to corrupted or malicious registry entries. You can download the registry cleaner repair tool for free. Run it to scan errors and then click the fix error button to repair the problem immediately.
Read More
How to Obliterate PyLocky Ransomware

What is PyLocky ransomware? And how does it execute its attack?

PyLocky ransomware is a file-locking malware created in order to lock important files and demand ransom from victims in exchange for data recovery. This new ransomware uses the .lockymap extension in marking the files it encrypts. It starts to execute its attack by dropping the following malicious payload in the system:
Name: facture_4739149_08.26.2018.exe SHA256:8655f8599b0892d55efc13fea404b520858d01812251b1d25dcf0afb4684dce9 Size: 5.3 MB
After dropping its malicious payload, this crypto-malware connects the infected computer to a remote server where it downloads more malicious files and places them on system folders. It then applies a data gathering module used to gather data about the user and the computer. The malicious files that were downloaded earlier along with the data obtained are used for another module called stealth protection. This allows PyLocky ransomware to execute its attack without detection from any security or antivirus programs installed in the system. It also modifies some registry keys and entries in the Windows Registry such as:
  • HKEY_CURRENT_USERControl PanelDesktop
  • HKEY_USERS.DEFAULTControl PanelDesktop
  • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
  • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce
  • HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
Once all the modifications are carried out, PyLocky ransomware will begin encrypting its targeted files using a sophisticated encryption cipher. Following the encryption, it adds the .lockymap extension to each one of the encrypted files and releases a ransom note named “LOCKY-README.txt” which contains the following content:
“Please be advised: All your files, pictures document and data has been encrypted with Military Grade Encryption RSA ABS-256. Your information is not lost. But Encrypted. In order for you to restore your files, you have to purchase a Decrypter. Follow these steps to restore your files. 1* Download the Tor Browser. ( Just type in google “Download Tor“ 2‘ Browse to URL: http://4wcgqlckaazungm.onion/index.php 3* Purchase the Decryptor to restore your files. It is very simple. If you don’t believe that we can restore your files, then you can restore 1 file of image format for free. Be aware the time is ticking. Price will be doubled every 96 hours so use it wisely. Your unique ID : CAUTION: Please do not try to modify or delete any encrypted file as it will be hard to restore it. SUPPORT: You can contact support to help decrypt your files for you. Click on support at http://4wcgqlckaazungm.onion/index.php”

How does PyLocky ransomware spread over the web?

PyLocky ransomware spreads using malicious spam email campaigns. Creators of this threat embed an infected attachment to spam emails and send them using a spambot. Crooks may even use deceptive tactics to trick you into opening the malware-laden immediately which is something you must not do. Thus, before opening any emails, make sure that you’ve thoroughly checked them. To successfully obliterate PyLocky ransomware from your computer, refer to the removal guide laid out below.
  • Step 1: Launch the Task Manager by simply tapping Ctrl + Shift + Esc keys on your keyboard.
  • Step 2: Under the Task Manager, go to the Processes tab and look for the process named facture_4739149_08.26.2018.exe and any suspicious-looking process which takes up most of your CPU’s resources and is most likely related to PyLocky ransomware.
  • Step 3: After that, close the Task Manager.
  • Step 4: Tap Win + R, type in appwiz.cpl and click OK or tap Enter to open Control Panel’s list of installed programs.
  • Step 5: Under the list of installed programs, look for PyLocky ransomware or anything similar, and then uninstall it.
  • Step 6: Next, close the Control Panel and tap Win + E keys to launch File Explorer.
  • Step 7: Navigate to the following locations below and look for PyLocky ransomware’s malicious components such as facture_4739149_08.26.2018.exe and LOCKY-README.txt as well as other suspicious files, then delete all of them.
%TEMP% %WINDIR%System32Tasks %APPDATA%MicrosoftWindowsTemplates %USERPROFILE%Downloads %USERPROFILE%Desktop
  • Step 8: Close the File Explorer.
  • Step 9: Tap Win + R to open Run and then type in Regedit in the field and tap enter to pull up Windows Registry.
  • Step 10: Navigate to the following path:
HKEY_CURRENT_USERControl PanelDesktop HKEY_USERS.DEFAULTControl PanelDesktop HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce
  • Step 11: Delete the registry keys and sub-keys created by PyLocky ransomware.
  • Step 12: Close the Registry Editor and empty the Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies Restoring your encrypted files using Windows Previous Versions feature will only be effective if PyLocky ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot. To restore the encrypted file, right-click on it and select Properties, a new window will pop up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.
Read More
Restore default Display Color settings in Windows 10
The color settings in a Windows computer certainly matter a lot especially when it comes to printing pictures. Users who are found or edit photos for a living change their computer’s color settings in order to ensure that the printout looks like the actual colors. However, those settings might not be appropriate for computer display and you can really tell right away that there something’s not right in the display. You might also notice some weird tint which isn’t easy to get rid of. You can’t actually tell the difference at first, not until you look at some other computers and then wonder what’s wrong with yours so, in this guide, you will know how to restore the display color settings back to their default state on your Windows 10 PC. Make sure to follow each one of the steps laid out below carefully to restore the default Display Color settings.

Step 1: Set the Color Management Settings to default.

  • In the Start search box, type in “color management”. Once you see it in the search results, open it.
  • Once you’ve pulled up the Color Management window, go to the Advanced tab. From there, make sure that every single option is set to default – from all the options in both the “Windows Color System” and “ICC rendering intent to WCS gamut mapping”.
Note: You also have the option to reset it for everyone by simply clicking on the “Change system defaults” button.
  • Finally, you can also try to calibrate your display.

Step 2: Set the Graphics Properties to default.

After making changes in the Color Management settings, you need to also set the Graphics Properties to default.
  • Start by right-clicking on any empty space on your desktop.
  • Then select the Graphics properties from the context menu. From the Graphics properties window, you will see that most sections have to restore defaults.

Step 3: Try using Nvidia Color Settings for Desktop

The next thing you can try is using the Nvidia Color Settings if you have Nvidia graphics installed on your Windows 10 PC. Just the Control Panel to reset the color settings.
  • From the system tray, launch the Nvidia control panel.
  • Next, go to Display > adjust desktop color settings.
  • From there, select the display and then select the Nvidia Settings.
  • After that, change the options accordingly in order to get the correct combination though you can always leave them to default.
Read More
How to Resolve Internal Error 2753

Internal Error 2753 - What is it?

Internal error 2753 is associated with Windows Installer failure. The Windows Installer is basically an in-built software program in Windows 7 and 8. It installs all programs on the system smoothly, saves the program in the computer program files and in the Windows Registry. Though this can be carried manually Windows Installer makes the installation process much easier. However, internal error 2753 can cause a great deal of distress and frustration during program installation. This error prevents you from installing your desired program successfully.

Solution

Restoro box imageError Causes

The 2 known causes for Internal Error 2753 are:
  • Viral infection
  • Windows Installer not properly registered

Further Information and Manual Repair

To resolve internal error 2753 on your system, try the methods discussed below. These methods are easy and require no technical expertise. Let’s get started:

Method 1 - Remove All Malicious Programs

Malicious programs like viruses, malware, adware, Trojan and spyware can corrupt programs on your PC like Windows Installer. If this is the underlying cause of error code 2753, then simply download a powerful antivirus on your system. Run it to scan for all such malicious programs and remove them. Once your PC is clean, try installing your desired program. This will hopefully resolve the issue. If the error still pops up then try method 2.

Method 2 - Register Windows Installer Properly

To do this, go to the start menu and then open Run and type ‘cmd’ in the box, and press OK. This will open the DOS command window. In the command prompt type "regsvr32 vbscript.dll" and then press Enter to proceed. After that, you will see a message that will read as "DllRegisterServer in vbscript.dll succeeded." This means Window Installer files have been successfully registered on your PC.  Now you can try installing your desired program again. If the installation begins and completes successfully, then the error is resolved.

Method 3 - Undo Recent Changes

If nothing works, then use the Windows System Restore Utility tool to undo recent changes. This will bring back your PC in the former state before you experienced the error 2753 on your PC. To access System Restore Utility, press Start and type System Restore in the search box. Now follow the steps in the Wizard to choose a restore point. Once you select the point, reboot your system to activate changes.
Read More
The server did not register with DCOM
There are times when after you upgrade your Windows operating system, the System Logs under the Event Viewer will display an error message saying, “Event ID 10010 error – The server did not register with DCOM within the required timeout”. What is DCOM? DCOM stands for “Distributed Component Object Model”. It is a proprietary Microsoft technology that allows the Component Object Model or COM software to communicate across a network. You can consider it as an extension of COM which is equipped with the capability of solving a couple of inherent problems related to the COM model to the better use over a network. COM is a tool that’s used for advanced configuration and troubleshooting in Windows 10. Developers usually use it to configure routine components and application behavior like participation in transactions and object pooling and so on. The Component Services needs the DCOM wire protocol in order to communicate with the Component Object Model components on other computers. By default, in a Windows-based system, the network computers are configured initially to enable DCOM. There are also some components in Windows that might require registering themselves with DCOM. However, if they fail to do so, you will encounter the “The server did not register with DCOM within the required timeout” error. To fix this, here are some suggestions you can check out.

Option 1 – Try to use the Component Services

  • Tap the Win + R keys to open the Run dialog box.
  • Then type “dcomcnfg” in the field and tap Enter to pull up Component Services.
  • Next, double click on the Computers folder located in the right pane and right-click on My Computer, and select the Properties option.
  • After that, switch to the COM Security tab under My Computer Properties and then go to the Access Permissions section.
  • From there, click the Edit Default button and in the new window that appears, apply the correct permission to objects under the Group or user names section.
  • Once you’re done, click OK and exit. This should fix the error.

Option 2 – Make sure that Function Discovery Resource Publication Properties Services is running

  • In the Cortana search box, type “services” and click on the Services icon to open the Services Manager. Alternatively, you can also tap the Win + R keys to launch the Run prompt and then type “services.msc” in the field and hit Enter to open the Services Manager.
  • Next, scroll down and look for the “Function Discovery Resource Publication” entry and double click on it.
  • Then switch to the General tab and from there, make sure that the Startup Type is set to “Manual (Triggered).
  • You also have to make sure that the service is running so if it’s not, just click on the Start button to start the service.
  • Now click on Apply to save the changes made.

Option 3 – Try resetting the default DCOM permissions

  • Tap the Win + R keys to open the Run dialog box.
  • Then type “dcomcnfg” in the field and tap Enter to pull up Component Services.
  • After that, expand Component Services > Computers and right-click on My Computer, and then select Properties.
  • Next, go to the Default Properties tab, and in the Default Distributed COM Communication Properties section, make sure that:
    • Default Authentication Level is set to Connect
    • Default Impersonation Level is set to Identify.
Read More
Disable Telemetry & Data Collection in Windows
The Windows 10 Telemetry and Data Collection features are auto-enabled and they collect all sorts of user activity and sends it to Microsoft. Microsoft says that the data collected only enhances the overall user experience and Windows functionality better but the number of data breaches happening across the globe has forced users to be extra cautious about their data privacy. So naturally, from stronger passwords and other services management, it is only logical to turn off Windows data gathering. To do so:
  • Press ⊞ WINDOWS + R to open the run dialog.
  • In the Run dialog type: taskschd.msc
  • Press CTRL + SHIFT + ENTER key combo to open Task Scheduler in admin mode.
  • On the left pane, navigate to the: Task Scheduler Library > Microsoft > Windows > Customer Experience Improvement Program
  • At the location, on the middle pane, right-click on the task named Consolidator and select Disable from the context menu...
  • Repeat the process with all other tasks listed in the middle pane.
  • Exit Task Scheduler.
Read More
How to Fix the Error 0X80070005

0X80070005 - What is it?

0x8007005 is a Windows Error Code. You may come across this error if you don’t have the appropriate permission to install a particular Windows update. It is prompted as ‘Access Denied’ error message. Solution

Restoro box imageError Causes

The error code 0x80070005 usually triggered because of 2 reasons:
  1. Some updates require administrative permissions to be installed
  2. Due to malware and viruses

Further Information and Manual Repair

If you face this error while installing Windows updates on your PC, it is advisable to fix it immediately. By taking timely actions, you can update your PC easily and in case if the cause of the error code 0x80070005 is malware or some virus, you can stop it from causing more and serious damage to your system.  Sometimes malware and viruses can lead to data loss. To avoid such damages here’s what you need to do:

Cause: Updates require administrative permission

Quick Fix: If the 0x8007005 error occurs on your system due to administrative permission issues, then the best way to fix this error right away is to log on as an administrator. If there are many user accounts on your PC, then to resolve this error, make sure you log on using the user account that has administrator permissions on the computer. Once you log on as an administrator, now try to install the updates again.

Cause: Malware and Viruses

Quick Fix: If the error 0x80070005 occurs because of malware infection, the best way to resolve this error would then be to open your antivirus software and run a scan to detect the malware. However, if you don’t have antivirus software installed on your system, then it is advisable to download the software immediately. Download antivirus software. To be on the safe side download Microsoft Safety Scanner. Click on the run when prompted. Once the scanner is installed on your PC create a shortcut to Safety Scanner on your computer desktop so that it is easily accessible. Now double click on the icon and click on the full scan tab to start scanning for malware and viruses on your system. After the scan is complete, you will see a list of viruses on your PC. Now remove them all by hitting the delete tab and then repair. Now try installing the updates again. By following these quick-fix techniques, you can easily resolve the error 0x80070005 on your system by yourself, without calling an IT professional.
Read More
Microsoft Store Error 0x80072F7D in Windows
Check your connection. Microsoft Store needs to be online. It looks like you’re not. Check connection Code: 0x80072F7D
This is the error that you get if trying to open the Microsoft store on Windows 10 and it fails. If you experienced this error and are unable to access the store do not despair we are here to help you. This particular error is usually due to some internet issues, follow the presented guide step by step in order to solve it and be able to access the Windows store again.
  1. Check your Internet connection

    Since this error is closely tied to internet connection it is advisable to first eliminate the obvious and check if your computer is connected to the internet.
  2. Run Network troubleshooter

    Built-in Windows troubleshooter is a great tool and we will be using it in the next few segments in order to locate the issue and fix it. Open Windows 10 Settings app using the WINDOWS + I Click on Network & Internet Click on Network troubleshooter Select network adapter to diagnose Press the Next button.
  3. Run Internet Connections troubleshooter

    Press WINDOWS + I to open the Settings app Click on the Update & Security Click on the Troubleshoot Select Additional troubleshooters option Click on Internet Connections option Hit Run the troubleshooter button.
  4. Run Windows Store Apps troubleshooter

    Press WINDOWS + I to open the Settings app Select Update & Security Click on the Troubleshoot Use the Additional troubleshooters option Click on the Windows Store Apps option Press Run the troubleshooter button
  5. Temporarily disable security software

    Your antivirus or firewall might be interfering with the application, sometimes, in some cases store is detected as a false positive in some security applications, and its access to the internet is cut. Disable your security suite to see if this is the case.
Read More
1 2 3 171
Logo
Copyright © 2023, ErrorTools. All Rights Reserved
Trademark: Microsoft Windows logos are registered trademarks of Microsoft. Disclaimer: ErrorTools.com is not affiliated with Microsoft, nor claims direct affiliation.
The information on this page is provided for information purposes only.
DMCA.com Protection Status