After a recent update of Comodo firewall, I started getting Event 1524 in the Event Log for Windows XP, SP2. The event message is “Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.” The event pointed to the CPF.EXE file. I downloaded and installed MS UPHCLEAN.EXE to force unloading of the registry at shutdown. Is this normal behavior for the Comodo firewall and can the settings be changed to avoid this event error message without using the UPHCLEAN program?
Hi whwmdw, welcome to the forums.
I think it is, although I don’t believe it should cause any fatal conflicts at shutdown (other than forcing UPHClean to wait a bit longer & issuing a informational log alert). By default CFP 2.4 protects its own registry tree (Security - Advanced - Miscellaneous), try turning this option off & see if that helps.
Actually UPHCLEAN speeds up computer shutdown by breaking the registry lock that CPF causes and eliminating the error events. I was interested if there was another option other than ending the registry protection offered by Comodo. The event error issue did not appear in earlier versions of Comodo.
This has been reported by some other users, and unfortunately I could never determine the root cause. If you exit CFP by right-clicking the systray icon, does the error remain in the Event Log? Will a clean reinstallation of CFP help, like in safe mode to ensure no software/driver conflicts?
I’m curious, too, as I have experienced this with lsass.exe as the culprit in the past for a couple of years and finally resolved it by updating to XP SP2.
Unchecking the option to have CPF protect its own registry files (under Security-Advanced-Miscellaneous) did not eliminate the Event Code. As I mentioned in my original post, this just started happening after an update. Unfortunately, I don’t recall which one.