Event ID: 1524 Error

[as702]

Operating System: Windows XP Professional (SP3)
Hardware: IBM T43 Thinkpad, Centrino 2.00Ghz, 1GB Ram, ATI Adapter

Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 28/05/2008
Time: 03:43:02
User: IBMT43\anne
Computer: IBMT43
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

-------------------------------------------------------------------------

Windows XP Hotfix Validation Report for \\IBMT43
Report Date: 5/28/2008 1:08pm

Current Service Pack Level: Service Pack 3
Hotfixes Identified:

KB892313
KB895181
KB898461
KB922814
KB936782_WMP10
KB941569
KB942763
KB943729
KB944110_WM10L
KB947864-IE7
KB949056_WM10L
KB952287
Q147222

-------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:45, on 28/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\rundll32.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINNT\system32\TpShocks.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINNT\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINNT\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1211924573546
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINNT\system32\ibmpmsvc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINNT\System32\TPHDEXLG.exe
-------------------------------------------------------------------------

The strange thing is this is a fresh install. I made an image shortly after I installed XP (SP3 slipstreamed) with all the host drivers, hotfixes, and ancillary IBM software installed; everything was running fine.

I have since installed Windows Defender, Microsoft Base Security Analyzer 2.1, and Office 2003. I've scanned the system using trend micro sysclean just to be sure. I don't really want to rely on micorsoft's user profile hive cleanup service since it will only mask the inherent problem.

any suggestions?

[as702]

managed to isolate the problem.

Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1401
Date: 28/05/2008
Time: 15:09:27
User: IBMT43\anne
Computer: IBMT43
Description:
The following handles in user profile hive IBMT43\anne (S-1-5-21-1708537768-796845957-1417001333-1003) have been remapped because they were preventing the profile from unloading successfully:

MsMpEng.exe (900)
HKCU (0x46c)
HKCU\Software\Classes (0x4ec)




windows defender is not closing the registry and releasing hive usage properly. not sure why. in any case, this piece-of-s*** software should still be in beta.

[FReakMaster]

Multiple errors 1000, 1524, 8026, 1030, 1065 all in a few days..

[as702]

Multiple errors 1000, 1524, 8026, 1030, 1065 all in a few days..

sorry, that last sentence of mine was unnecessary. as for this link, i'm not entirely sure what it is i'm supposed to be looking at.

could you possibly expand on this?

[as702]

Ok, i appear to have tracked down the reason as to why Windows Defender wasn't playing nice. It would appear the program is dependent on the Remote Access Auto Connection Manager; when the service is set to anything other than automatic, Windows Defender is somehow unable to release the hive from memory.

i've tested it a few times now and the results appear to be consistent.

[as702]

well, Windows Defender is still generating the same error regardless. Guess i was a bit premature in my celebrations. suffice to say, UHPC seems to be the only solution to this point.