hku/s-1-5-21-2117891135-820165737-679121223-1000_classes ?

HalloGARYween,

Registry file UsrClass.dat is loaded at HKU\s-1-5-21-*-1000_Classes is a tough issue, since it deals with Registry hives...

There may be an advisor here qualified to deal with this problem, so, will check around and let you know.

In the meantime, please do the following:

Go to Start > All Programs > Accessories > Command Prompt
Right-click the Command Prompt and select: Run as Administrator

After the prompt to the right of C:\Windows\System32>
Copy and then paste all of the following commands contained inside the code box below, and press: Enter

Code:

REG QUERY HKU
REG QUERY HKU\S-1-5-21
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21"
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist

To obtain the results of the query, please click on the small command prompt icon on the top left.
Select: Edit > Select All

After the info is highlighted (turns white), go back to the same icon on the top left, and select:
Edit > Copy

Next, open Notepad (Start > All Programs > Accessories > Notepad)
Paste the info to Notepad, and post it in your reply.


Also, please go to Start > Control Panel > System and Security > System
Scroll down to a section called: Windows Activation
Use the Snipping Tool to obtain a capture of the info, however, block out the Product ID.

Please provide the capture in your reply.

Thanks!

Please note Edit in the code box of Post #2.

Dealing with Registry hives is beyond me. Don't know if there is really an issue here or not;
Registry file C:\Users\*\AppData\Local\Microsoft\Windows\\UsrClass.dat is loaded at HKU\S-1-5-21-*-1000_Classes

Called an Expert for help.

Thanks for your patience. :)

That entry in the Event Viewer is perfectly normal.

The Registry is a complex database which Windows loads from a number of different sources at boot, depending on the environment, and the user profile.
It's best left well alone unless you know what you're doing - and specifically, AVOID use of any Registry 'Cleaners' or 'Optimisers', as they are all snake-oil products designed to lighten the wallet, rather than anything else.

The specific entry you have opened there tells us that the registry has loaded User data from a location in the user profile's AppData folder to the User's area of the registry - in this case we can see that the user is the first one created after the machine was installed ( see the -1000 and the end of the HKU string?)
If you have any other user accounts on the machine, they will have the same HKU ID string, apart from the final part, which is incremented by one for each user created, and never reused, even if the user is later deleted and re-created with the same name. It's these ID's which the machine uses for all security purposes, rather than the user name itself.

HTH?

HTH means Hope This Helps I believe .