Registry Write Error

Hello,

I have a problem on a vsita home premium machine.

If I boot in safe mode I can write to the following registry key.

hkey_local_machine\system\currentcontrolset\services

If I boot in normal mode, I get an error access is denied.

I have looked for viruses, rootkits, using combofix and unhackme.

Has anyone else had this problem??

I have also tried to redo the permission on this key but to no avale.

Thanks

Kevin
doctickAsked:
Who is Participating?
 
cantorisCommented:
Run Process Explorer from
http://live.sysinternals.com/tools/procexp.exe
With it running, add in the column "Process Image - Integrity Level".
Then start regedit.exe.  Look at its entry in Process Explorer - is it running with a level of "High"?

Also, if you open regedit's properties in there and look on the security tab you can check on the list of Privileges your account currently has (when it launched it).  There should be a load listed - if there are only a few then it would appear UAC is still active.

Also, "handle -a" can show registry handles in case something else is using it:
http://technet.microsoft.com/en-gb/sysinternals/bb896655.aspx

Come to think of it, are we missing the obvious ... try stopping/disabling the service whose keys you are playing with!  If it's not listed in the Services.msc, then look in Device Manager with the hidden devices enabled option.  Look under Non-Plug and Play Devices - you can disable it in there if it was not a normal Service.
0
 
cantorisCommented:
I think UAC is your problem.  If you temporarily turn off User Account Control then you will be able to launch regedit.exe with full admin rights and edit the key.  Or just shift right-click regedit.exe and Run As Administrator.
I suspect UAC is not active in Safe Mode.

Note also that some keys within CurrentControlSet require you to take ownership of them before you can do anything else to them.
0
 
doctickAuthor Commented:
Hello Cantoris,

Nope, I have already turned off UAC.  

I have tried taking ownership of the key as well, still does not work.

any other suggestions??
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.