Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -

1 user registry handles leaked from \Registry\User\S-1-5-21-3752391563-857441031-2975066921-1000_Classes:

Process 804 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3752391563-857441031-2975066921-1000_CLASSES



Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -

1 user registry handles leaked from \Registry\User\S-1-5-21-3752391563-857441031-2975066921-1000:

Process 804 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3752391563-857441031-2975066921-1000


The process is Windows defender

bump

Hmmm..... Does it happen for all users, or just the user represented by SID S-1-5-21-3752391563-857441031-2975066921-1000?

Did you try just a basic uninstall, restart, reinstall. I think Windows Defender is crap anyway though.

It ships with the OS (note those are Vista screenshots). He can't uninstall it.

The only thing I can think of is when I migrated from RC2 to Retail, my user setting and stuff could have run it askew.
I dont know why it is lurking in there anyway.
Heres a pic

Hmm. You may be onto something there - I've seen other windows defender prolblems from RC to RTM upgrades in the past, so this could be it. It's usually not fixable unless you want to disable defender, as far as I've been able to ascertain.