[bmueller]

Hallo, wer kann mit dieser Warnung in der Ereignisanzeige etwas anfangen?
Weiß mir keinen Rat.

Protokollname: Application
Quelle: Microsoft-Windows-User Profiles Service
Datum: 23.03.2007 07:19:43
Ereignis-ID: 1530
Aufgabenkategorie:Keine
Ebene: Warnung
Schlüsselwörter:Klassisch
Benutzer: SYSTEM
Computer: Bernd-PC
Beschreibung:
Es wurde festgestellt, dass Ihre Registrierungsdatei noch von anderen Anwendungen oder Diensten verwendet wird. Die Datei wird nun entladen. Die Anwendungen oder Dienste, die Ihre Registrierungsdatei anhalten, funktionieren anschließend u. U. nicht mehr ordnungsgemäß.

DETAIL -
15 user registry handles leaked from \Registry\User\S-1-5-21-3658398521-3000972948-3598229279-1000_Classes:
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES

Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" EventSourceName="profsvc" />
<EventID Qualifiers="32768">1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2007-03-23T06:19:43.000Z" />
<EventRecordID>10637</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Bernd-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">15 user registry handles leaked from \Registry\User\S-1-5-21-3658398521-3000972948-3598229279-1000_Classes:
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
Process 936 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3658398521-3000972948-3598229279-1000_CLASSES
</Data>
</EventData>
</Event>

MfG Bernd

[bmueller]

Hallo, ich bins nochmal. Wo bleiben die "Spezialisten"? MfG Bernd