I have Avast 18.8.2356 free on a Windows XP Sp3 x32 Home with all the latest fixes (no posready fixes).
I had been wondering why I was getting usrenv errors on OS shutdown in the system event log. The event Id’s are 1517, 1524.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 6/22/2019
Time: 1:56:36 PM
User: NT AUTHORITY\SYSTEM
Computer: PC863512472119
Description:
Windows saved user PC863512472119\user registry while an application or service was still using the registry during log off. The memory used by the user’s registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 6/22/2019
Time: 1:56:22 PM
User: PC863512472119\user
Computer: PC863512472119
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
To Track this down I installed UPHCLEAN v2.0.49 (non beta) and repeated the shutdown. It turns out it was AVAST creating this. See below for the system event errors. Two messages. The second entry after the first shows various HKC hex codes that change from one shutdown to the next. Event ID 1412, 1201.
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1412
Date: 6/22/2019
Time: 3:58:27 PM
User: PC863512472119\user
Computer: PC863512472119
Description:
Setup for handle remapping for process AvastSvc.exe (364) failed. Reverting to closing handle.
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 6/22/2019
Time: 4:35:10 PM
User: PC863512472119\user
Computer: PC863512472119
Description:
The following handles in user profile hive PC863512472119\user (S-1-5-21-2369171757-2308932244-330865317-1006) have been closed because they were preventing the profile from unloading successfully:
S-1-5-21-2369171757-2308932244-330865317-1006
Event Type: Information
Event Source: UPHClean
Event Category: None
Event ID: 1201
Date: 6/22/2019
Time: 3:58:27 PM
User: PC863512472119\user
Computer: PC863512472119
Description:
The following handles in user profile hive PC863512472119\user (S-1-5-21-2369171757-2308932244-330865317-1006) have been closed because they were preventing the profile from unloading successfully:
AvastSvc.exe (364)
HKCU (0x317c)
HKCU (0x3480)
HKCU (0x3a44)