Dagelijks vindt ik onderstaande vermelding (waarschuwing) terug in het beheerslogboek. Het klinkt nogal onheilspellend. Wat is er eigenlijk niet in orde?
Mijn laptop lijkt wel normaal te werken.
Logboeknaam: Application
Bron: Microsoft-Windows-User Profiles Service
Datum: 29/01/2013 1:06:44
Gebeurtenis-id:1530
Taakcategorie: Geen
Niveau: Waarschuwing
Trefwoorden:
Gebruiker: SYSTEM
Computer: HP-Ronny
Beschrijving:
Uw registerbestand is nog steeds in gebruik door andere toepassingen of services. Het bestand wordt nu verwijderd. De toepassingen en services die het registerbestand nu gebruiken, werken achteraf mogelijk niet meer goed.
DETAIL -
8 user registry handles leaked from \Registry\User\S-1-5-21-2005720376-2898171921-4280256072-1001:
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\trust
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\Root
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1008 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Gebeurtenis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-01-29T00:06:44.395992100Z" />
<EventRecordID>8979</EventRecordID>
<Correlation ActivityID="{A7C2B8B3-FA7A-0001-964A-C3A77AFACD01}" />
<Execution ProcessID="880" ThreadID="6316" />
<Channel>Application</Channel>
<Computer>HP-Ronny</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">8 user registry handles leaked from \Registry\User\S-1-5-21-2005720376-2898171921-4280256072-1001:
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\trust
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\Root
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1008 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
</Data>
</EventData>
</Event>
Mijn laptop lijkt wel normaal te werken.
Logboeknaam: Application
Bron: Microsoft-Windows-User Profiles Service
Datum: 29/01/2013 1:06:44
Gebeurtenis-id:1530
Taakcategorie: Geen
Niveau: Waarschuwing
Trefwoorden:
Gebruiker: SYSTEM
Computer: HP-Ronny
Beschrijving:
Uw registerbestand is nog steeds in gebruik door andere toepassingen of services. Het bestand wordt nu verwijderd. De toepassingen en services die het registerbestand nu gebruiken, werken achteraf mogelijk niet meer goed.
DETAIL -
8 user registry handles leaked from \Registry\User\S-1-5-21-2005720376-2898171921-4280256072-1001:
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\trust
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\Root
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1008 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Gebeurtenis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2013-01-29T00:06:44.395992100Z" />
<EventRecordID>8979</EventRecordID>
<Correlation ActivityID="{A7C2B8B3-FA7A-0001-964A-C3A77AFACD01}" />
<Execution ProcessID="880" ThreadID="6316" />
<Channel>Application</Channel>
<Computer>HP-Ronny</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">8 user registry handles leaked from \Registry\User\S-1-5-21-2005720376-2898171921-4280256072-1001:
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\My
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\trust
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\Root
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1008 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall
Process 880 (\Device\HarddiskVolume4\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2005720376-2898171921-4280256072-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
</Data>
</EventData>
</Event>
Laatst bewerkt:
