Имя журнала: Application
Источник: Microsoft-Windows-User Profiles Service
Дата: 13.10.2010 22:42:39
Код события: 1530
Категория задачи:Отсутствует
Уровень: Предупреждение
Ключевые слова:
Пользователь: система
Компьютер: АНДРЕЙ-ПК
Описание:
Система Windows обнаружила, что файл реестра используется другими приложениями или службами. Файл будет сейчас выгружен. Приложения или службы, которые используют файл реестра, могут впоследствии работать неправильно.
ПОДРОБНО -
15 user registry handles leaked from \Registry\User\S-1-5-21-496691400-528679468-1940224800-1000:
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\trust
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\My
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\TrustedPeople
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\CA
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\Root
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\Disallowed
Xml события:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
<EventID>1530</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2010-10-13T19:42:39.504618400Z" />
<EventRecordID>9213</EventRecordID>
<Correlation ActivityID="{00000100-0000-0001-0444-F8BDFF6ACB01}" />
<Execution ProcessID="584" ThreadID="1716" />
<Channel>Application</Channel>
<Computer>АНДРЕЙ-ПК</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="EVENT_HIVE_LEAK">
<Data Name="Detail">15 user registry handles leaked from \Registry\User\S-1-5-21-496691400-528679468-1940224800-1000:
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\trust
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\My
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\TrustedPeople
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\CA
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Policies\Microsoft\SystemCertificates
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\Root
Process 1964 (\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe) has opened key \REGISTRY\USER\S-1-5-21-496691400-528679468-1940224800-1000\Software\Microsoft\SystemCertificates\Disallowed
</Data>
</EventData>
</Event>
