Startup Registry Error Window

[Chris B.]

I am running Windows XP Pro. When I start up my desktop appears and then a
long horizontal narrow error windows appear:

"Window-Registry Recovery i One of the files containing the system's
Registry data had to be recovered by use of a log or alternate copy. The
recovery was successful. OK"

I click "OK" and the error window goes away and then things are fine.



I was advised to go to Control Panel, Administrative Tools, Event Viewer
(local), Application Log Application Error Records. There are four entries.
Three of them just indicate that app has started. However, one USERENV has
a yellow triangle with "warning."

Then I open this entry and see below.



I am not sure what to do, now. Please help me. Thanks very much
Chris.





Event Type: Warning

Event Source: Userenv

Event Category: None

Event ID: 1517

Date: 4/17/2007

Time: 8:48:57 AM

User: NT AUTHORITY\SYSTEM

Computer: BLACK_BEAST

Description:

Windows saved user BLACK_BEAST\Chris registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.



This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.

 

[John John]

Try this:

User Profile Hive Cleanup Service
http://www.microsoft.com/downloads/...6D-8912-4E18-B570-42470E2F3582&displaylang=en

John

 

[Newbie Coder]

Chris B

This Microsoft article says you don't have to do anything:

http://support.microsoft.com/kb/810616

Basically the event ID you have means the registry hasn't unloaded
successfully...

 

[Chris B.]

John,
Thanks for your response. I installed UPHclean-setup.msi. I restarted
my PC. There was no change. The long horizontal narrow error window still
is there without change.
Any ideas on what is next? Thank you very much.
I know the other response takes me to Microsoft which says "not to
worry," but, that is way below the $billions that Micorosft has to fix this.


Chris

 

[John John]

The problem can also be caused by faulty hardware, a failing hard disk
or bad RAM can cause this error to pop up. Do a chkdsk on your drive
and run a diagnostic utility form your drive manufacturer. If the drive
passes all tests run a memory test. I would try to eliminate these
possibilities before delving further into the problem.

John

 

[Poprivet]

Chris B

This Microsoft article says you don't have to do anything:

http://support.microsoft.com/kb/810616

Basically the event ID you have means the registry hasn't unloaded
successfully...

I agree, but ... I think the Event Viewer message is a little misleading.
If the problem was literally only what that article talks about, the error
at startup about having recovered and replaced a file wouldn't be happening;
that indicates something else/more at work; either corruption or malware,
IMO.

The UPHClean utility sounded like the right starting place to me. Therei
s also an MS utility called BootVis which has a registry optimization
feature that has helped occasionally with similar problems.

HTH
Pop`


Pop`

 

[Poprivet]

John,
Thanks for your response. I installed UPHclean-setup.msi. I
restarted my PC. There was no change. The long horizontal narrow
error window still is there without change.
Any ideas on what is next? Thank you very much.
I know the other response takes me to Microsoft which says "not to
worry," but, that is way below the $billions that Micorosft has to
fix this.

Chris

I would next try the MS utility BootVis for XP (be sure you get the right
one). It has a featuer to "optimize" the registry that sometimes helps with
situations like this. It's a bit of a long shot but quick & easy to try.

In no particular order:

Apparently something is corrupting the file in question or replacing it.
That could indicate a virus or malware (spyware, etc.).

Have you run virus and malware scans with recently updated programs? There
are some malwares can damage files like that so if malware keeps changing
it, XP will keep replacing it.
What do ou use for spyware detectors? I'd suggest at least Adaware and
Spybot.

Have you run chckdsk /r on the drive? It'll ask you to reboot to run chkdsk
on a boot drive. Just in case there are bad sectors, the /r will make a
workaround for that. It might take a few minutes to run; let it complete
all 5 stages.

Does Event Viewer give you any hint which file might be the problem file?
That might help a LOT.

I saw someone suggesting the disk may be going bad or memory might be going
bad; I don't think so, based on the repeatability of the problem. In this
case, Chkdsk will be enough of an indication of disk health and memory,
well, it just wouldn't be this consistant; it would show in other ways too,
and be variable, not easy to repeat.
It does no harm to do the checks though; It's just that IMO they aren't
necessary.

Have you changed/installed/uninstalled/updated/added anything at all to the
compter just before this started to happen?

Let us know.

Pop`

 

[Rock]

I am running Windows XP Pro. When I start up my desktop appears and then a
long horizontal narrow error windows appear:

"Window-Registry Recovery i One of the files containing the system's
Registry data had to be recovered by use of a log or alternate copy. The
recovery was successful. OK"

I click "OK" and the error window goes away and then things are fine.



I was advised to go to Control Panel, Administrative Tools, Event Viewer
(local), Application Log Application Error Records. There are four
entries. Three of them just indicate that app has started. However, one
USERENV has a yellow triangle with "warning."

Then I open this entry and see below.



I am not sure what to do, now. Please help me. Thanks very much Chris.





Event Type: Warning

Event Source: Userenv

Event Category: None

Event ID: 1517

Date: 4/17/2007

Time: 8:48:57 AM

User: NT AUTHORITY\SYSTEM

Computer: BLACK_BEAST

Description:

Windows saved user BLACK_BEAST\Chris registry while an application or
service was still using the registry during log off. The memory used by
the user's registry has not been freed. The registry will be unloaded when
it is no longer in use.



This is often caused by services running as a user account, try
configuring the services to run in either the LocalService or
NetworkService account.

See this article:
How to Troubleshoot Registry Corruption Issues
http://support.microsoft.com/?id=822705

Make sure you always have a full and complete backup of data on this system
in case the problem escalates to one where it won't boot at all. If that
happens here is an article on recovering from that.

How to Recover from a Corrupted Registry that Prevents Windows XP from
Starting:
http://support.microsoft.com/?id=307545

There are many reasons why the registry corruption is occurring. The first
article outlines those.

After the system is stable you could look into using ERUNT to make a daily
backup of the registry. It can be set to run using task scheduler. When
ERUNT is set up properly, if something corrupts the registry causing the OS
not to boot, a recent backup copy of the registry made by ERUNT can be
restored from the recovery console.

ERUNT
http://www.larshederer.homepage.t-online.de/erunt/
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt

Installing and Using ERUNT
http://www.silentrunners.org/sr_eruntuse.html
http://www.winxptutor.com/regback.htm

If you need it here are some utilities for testing RAM. They create a
bootable floppy or CD. Boot from that and run the utility. Let it run for
multiple passes, not just a single pass.

Memtest86+
http://www.memtest.org/

Windows Memory Diagnostic
http://oca.microsoft.com/en/windiag.asp

DocMemory Memory Diagnostic
http://www.simmtester.com/page/products/doc/download.asp

To test the hard drive download a drive diagnostic utility from the hard
drive manufacturer's web site. That will create a bootable floppy or CD.
Boot from it and run the diagnostics.