Here we go Delphin
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 248 N/A
csrss.exe 364 N/A
csrss.exe 420 N/A
wininit.exe 428 N/A
services.exe 480 N/A
winlogon.exe 504 N/A
lsass.exe 516 KeyIso, SamSs
lsm.exe 528 N/A
svchost.exe 632 DcomLaunch, PlugPlay, Power
svchost.exe 732 RpcEptMapper, RpcSs
atiesrxx.exe 820 AMD External Events Utility
svchost.exe 880 AudioSrv, Dhcp, eventlog,
HomeGroupProvider, lmhosts, wscsvc
svchost.exe 920 AudioEndpointBuilder, CscService,
HomeGroupListener, Netman, PcaSvc, SysMain,
TrkWks, UxSms, wudfsvc
svchost.exe 944 AeLookupSvc, AppMgmt, Browser, gpsvc,
iphlpsvc, LanmanServer, MMCSS, ProfSvc,
Schedule, SENS, ShellHWDetection, Themes,
Winmgmt, wuauserv
svchost.exe 320 EventSystem, fdPHost, netprofm, nsi,
WdiServiceHost
spoolsv.exe 1088 Spooler
sched.exe 1132 AntiVirSchedulerService
svchost.exe 1152 BFE, DPS, MpsSvc
svchost.exe 1220 CryptSvc, Dnscache, LanmanWorkstation,
NlaSvc
avguard.exe 1296 AntiVirService
atieclxx.exe 1716 N/A
taskhost.exe 1896 N/A
dwm.exe 1948 N/A
explorer.exe 2004 N/A
avgnt.exe 2052 N/A
SearchIndexer.exe 2548 WSearch
wmpnetwk.exe 2660 WMPNetworkSvc
svchost.exe 2912 FDResPub, SSDPSRV, upnphost, wcncsvc
svchost.exe 3032 p2pimsvc, p2psvc, PNRPsvc
svchost.exe 2260 SDRSVC
taskhost.exe 1784 N/A
audiodg.exe 2628 N/A
notepad.exe 3296 N/A
cmd.exe 2248 N/A
conhost.exe 2976 N/A
tasklist.exe 3448 N/A
WmiPrvSE.exe 3248 N/A
Log Name: Application
Source: Microsoft-Windows-User Profiles Service
Date: 8/27/2009 3:15:11 AM
Event ID: 1530
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: Home01
Description:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-783115880-3742272611-1246857717-1000:
Process 504 (\Device\HarddiskVolume7\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-783115880-3742272611-1246857717-1000
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2009-08-27T10:15:11.445216400Z" />
<EventRecordID>1057</EventRecordID>
<Correlation />
<Execution ProcessID="944" ThreadID="3528" />
<Channel>Application</Channel>
<Computer>Home01</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">1 user registry handles leaked from \Registry\User\S-1-5-21-783115880-3742272611-1246857717-1000:
Process 504 (\Device\HarddiskVolume7\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-783115880-3742272611-1246857717-1000
</Data>
</EventData>
</Event>
.
!
, I attached two pixs of my HDDs.
.
