Windows Defender hogging Classes registry file?

[ADB100]

I have a Windows 2003 Server (SP2) that is used as a workstation. I have Windows Defender installed and for some reason it hogs the Classes Registry file when I attempt to log off or shut down. There is quite a delay when the dialogue box 'Saving your settings appears'. In the Application Event log I get the following two messages:

Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

Windows saved user DOMAIN\user registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use. 

 This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

I have no services running under the user accound, the only thing that runs under a user account is an IAS backup batch file that runs under a different account anyway.
I have installed UPHClean and it logs the event:

The following handles opened in user profile hive DOMAIN\user (S-1-5-21-2288350156-3556764418-3253175386-1120) are preventing the profile from unloading: 
 
MsMpEng.exe (772)
  HKCU (0x420)
  HKCU\Software\Classes (0x4f4)

I have searched on MS and google but can't find a solution, any ideas?

Andy

 

[karlisi]

It is well known issue on Windows 2000 and XP and not connected with Windows Defender. The same problem with not-unloading registry hives you can find on almost every Windows XP computer and most of Windows 2000, even servers. Installing UPHClean on every computer is the best solution I know.

===
Karlis
ECDL; MCSA