Seeking help - Microsoft support unable to find a solution.

[SSI]

Vista Home premium. Antivirus and antispyware is up to date and the computer
clean.
This warning appears in Events every time I log on and off and have spend 2
weeks back and forth with Microsoft support without a resolution. Their
suggestion was to create a new user profile and delete the old which I did,
however the problem still appears. Microsoft support although responsive has
been unable to help me so I am back here looking for some suggestions.
Do I need to worry about this or just ignore it? Thanks in advance for any
help.

Here is the Warning:

Windows detected your registry file is still in use by other applications or
services. The file will be unloaded now. The applications or services that
hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from
\Registry\User\S-1-5-21-448539723-1275210071-725345543-1021:
Process 4540 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has
opened key \REGISTRY\USER\S-1-5-21-448539723-1275210071-725345543-1021

 

[SSI]

I forgot to mention that the source of the event is: User Profile Service.

 

[jim]

give us a list of all applications you have installed

 

[SSI]

Thank you for the reply. By installed applications do you mean running at
startup or all programs. I am sorry I am not clear.
Thanks

 

[Adam Albright]

Vista Home premium. Antivirus and antispyware is up to date and the computer
clean.
This warning appears in Events every time I log on and off and have spend 2
weeks back and forth with Microsoft support without a resolution. Their
suggestion was to create a new user profile and delete the old which I did,
however the problem still appears. Microsoft support although responsive has
been unable to help me so I am back here looking for some suggestions.
Do I need to worry about this or just ignore it? Thanks in advance for any
help.

Here is the Warning:

Windows detected your registry file is still in use by other applications or
services. The file will be unloaded now. The applications or services that
hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from
\Registry\User\S-1-5-21-448539723-1275210071-725345543-1021:
Process 4540 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has

Just a guess...

Some application or a driver needed to open the Registry, but for one
reason or another doesn't close it when finished like it is suppose
to. This actually is a frequent cause of Windows hanging at shutdown.
You're "lucky" in that at least Windows says it figured out something
needs to be unloaded then posted a entry in the Event Log, assuming
that's what you're saying happens. It normally don't say, and just
waits and waits to no avail. So I'm guessing all that gibberish means
is Windows says this is what happened.

What can happen is something we've all experienced. A open link to
your Registry regardless how it got opened or by what presents no
problem until you try to shut down your computer. Then your user
profile which tells Windows to start the shutdown sequence once you
tell Windows to log off as a user or shut down if you're the only user
tries to shut down your computer but can't because the driver or
application that opened a link to the Registry didn't close it and
then Windows thinks something is still running, oops better not shut
down yet. So normally what happens next is Windows just keeps waiting
for the link to close and it typically won't which is why you need to
push the power button to shut down sometimes. XP, but rarely would
once in awhle if it detected a hung driver or a still open link to the
Registry would bring up a little Window and tattle on the offender. If
that happened sometimes it gave you a means to again tell it to shut
down whatever was "open" and avoid having to push the power button on
your PC. Haven't used Vista long enough to know if it will still do
that.

If this "error", more along the lines of a informational comment just
appears in your Event Log and doesn't cause you any grief, I wouldn't
worry about it since it seems what is causing it is a component of
Windows itself, therefore isn't much you can do to fix it if anything,
other then reinstalling Windows which for something this minor would
seem to be overkill.

 

[Frank Saunders, MS-MVP OE/WM]

Vista Home premium. Antivirus and antispyware is up to date and the
computer clean.
This warning appears in Events every time I log on and off and have spend
2 weeks back and forth with Microsoft support without a resolution. Their
suggestion was to create a new user profile and delete the old which I
did, however the problem still appears. Microsoft support although
responsive has been unable to help me so I am back here looking for some
suggestions.
Do I need to worry about this or just ignore it? Thanks in advance for any
help.

Here is the Warning:

Windows detected your registry file is still in use by other applications
or services. The file will be unloaded now. The applications or services
that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from
\Registry\User\S-1-5-21-448539723-1275210071-725345543-1021:
Process 4540 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has
opened key \REGISTRY\USER\S-1-5-21-448539723-1275210071-725345543-1021

What anti-virus and anti-spyware?
Do you get the message is you turn them both off?

 

[SSI]

Just a guess...

Some application or a driver needed to open the Registry, but for one
reason or another doesn't close it when finished like it is suppose
to. This actually is a frequent cause of Windows hanging at shutdown.
You're "lucky" in that at least Windows says it figured out something
needs to be unloaded then posted a entry in the Event Log, assuming
that's what you're saying happens. It normally don't say, and just
waits and waits to no avail. So I'm guessing all that gibberish means
is Windows says this is what happened.

What can happen is something we've all experienced. A open link to
your Registry regardless how it got opened or by what presents no
problem until you try to shut down your computer. Then your user
profile which tells Windows to start the shutdown sequence once you
tell Windows to log off as a user or shut down if you're the only user
tries to shut down your computer but can't because the driver or
application that opened a link to the Registry didn't close it and
then Windows thinks something is still running, oops better not shut
down yet. So normally what happens next is Windows just keeps waiting
for the link to close and it typically won't which is why you need to
push the power button to shut down sometimes. XP, but rarely would
once in awhle if it detected a hung driver or a still open link to the
Registry would bring up a little Window and tattle on the offender. If
that happened sometimes it gave you a means to again tell it to shut
down whatever was "open" and avoid having to push the power button on
your PC. Haven't used Vista long enough to know if it will still do
that.

If this "error", more along the lines of a informational comment just
appears in your Event Log and doesn't cause you any grief, I wouldn't
worry about it since it seems what is causing it is a component of
Windows itself, therefore isn't much you can do to fix it if anything,
other then reinstalling Windows which for something this minor would
seem to be overkill.

Thank you so much for taking the time to write such a detailed explanation.
I really do appreciate the light you shed on this and I suppose unless a
solution surfaces and since it is not creating any problems so far I will
dismiss it for now.

 

[SSI]

What anti-virus and anti-spyware?
Do you get the message is you turn them both off?

Thanks for the reply I use the AVG 7.5 Had Norton but when my subscription
expired I decided to change because it was getting way too 'top heavy' for
my taste..
In as far as AntiSpyware I use the built in defender and spyware blaster.

 

[Frank Saunders, MS-MVP OE/WM]

Thanks for the reply I use the AVG 7.5 Had Norton but when my subscription
expired I decided to change because it was getting way too 'top heavy' for
my taste..
In as far as AntiSpyware I use the built in defender and spyware blaster.

You don't have Windows Defender and Spyware Blaster both resident at the
same time, do you?

 

[MICHAEL]

You don't have Windows Defender and Spyware Blaster both resident at the same time, do you?

Frank,

SpywareBlaster doesn't do real-time/resident protection.

<quote>
SpywareBlaster doesn't scan and clean for so-called spyware, but prevents it from being
installed in the first place. It achieves this by disabling the CLSIDs of popular spyware
ActiveX controls, and also prevents the installation of any of them via a webpage. This allows
you to run Internet Explorer with Active-X enabled, but it will never download or even prompt
you for any of the known ActiveX controls. All other Active-X controls or plug-ins will work
fine. The SpywareBlaster database contains information on these known spyware Active-X controls
and can be updated with the click of a button. The application windows displays a list of all
controls that it is able to detect (this is not a list of what was found on your computer). The
program cannot detect if you have any of the known objects already installed, but if you do,
they will be disabled. The program also allows you to take a snapshot of your computer (certain
settings) in its clean state and later revert many changes made by spyware and browser
hijackers.
</quote>


-Michael