Windows Vista shows error "A specified privilege does not exist" wuen running any administrative tool/process

06
2014-04
  • d4ryl3

    I'm troubleshooting a Windows Vista Ultimate Version 6.0. When I run regedit, msconfig, or even try to disable Microsoft Security Essentials's Real-time protection (for Combofix), it returns this error:

    enter image description here

    I had to run Combofix in Safe Mode and this is its log:

    ComboFix 13-11-23.02 - PaoLo 11/24/2013  12:07:01.2.2 - x86 NETWORK
    Microsoft® Windows Vista™ Ultimate   6.0.6000.0.1252.1.1033.18.2038.1567 [GMT 8:00]
    Running from: c:\users\PaoLo\Downloads\ComboFix.exe
    .
    .
    (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]\bootstrap.js
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]\chrome.manifest
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]\content\bg.js
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]\content\zy.xul
    c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\extensions\[email protected]\install.rdf
    c:\windows\system32\FlashPlayerApp.exe
    c:\windows\system32\X86
    .
    .
    (((((((((((((((((((((((((   Files Created from 2013-10-24 to 2013-11-24  )))))))))))))))))))))))))))))))
    .
    .
    2013-11-24 04:14 . 2013-11-24 04:14 --------    d-----w-    c:\windows\system32\config\systemprofile\AppData\Local\temp
    2013-11-24 04:14 . 2013-11-24 04:14 --------    d-----w-    c:\users\Default\AppData\Local\temp
    2013-11-24 01:17 . 2013-11-08 01:15 7772552 ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6699626-0560-45D6-8328-1F2B489BE5F1}\mpengine.dll
    2013-11-22 05:45 . 2013-11-08 01:15 7772552 ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2013-11-15 14:44 . 2013-11-15 14:44 --------    d-----w-    C:\MSI
    2013-11-06 00:03 . 2013-11-06 00:03 650936  ----a-w-    c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
    2013-11-03 06:35 . 2013-11-03 06:35 --------    d-----w-    c:\program files\iPod
    2013-11-03 06:35 . 2013-11-03 06:37 --------    d-----w-    c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
    2013-11-03 06:35 . 2013-11-03 06:37 --------    d-----w-    c:\program files\iTunes
    2013-11-03 05:58 . 2013-11-03 05:58 --------    d-----w-    c:\program files\Common Files\Java
    2013-11-03 05:56 . 2013-11-03 05:56 94632   ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
    2013-11-02 11:35 . 2013-10-26 01:54 272496  ----a-w-    c:\program files\Mozilla Firefox\browser\components\browsercomps.dll
    2013-11-02 11:32 . 2013-11-02 11:32 243128  ----a-w-    c:\windows\system32\drivers\dtsoftbus01.sys
    2013-11-02 11:31 . 2013-11-02 11:32 --------    d-----w-    c:\program files\DAEMON Tools Lite
    .
    .
    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-11-19 10:21 . 2009-10-03 02:10 230048  ------w-    c:\windows\system32\MpSigStub.exe
    2013-09-27 01:53 . 2013-09-27 01:53 214696  ----a-w-    c:\windows\system32\drivers\MpFilter.sys
    .
    .
    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown 
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2013-06-13 23:00    130736  ----a-w-    c:\users\PaoLo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2013-06-13 23:00    130736  ----a-w-    c:\users\PaoLo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2013-06-13 23:00    130736  ----a-w-    c:\users\PaoLo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2013-06-13 23:00    130736  ----a-w-    c:\users\PaoLo\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "uTorrent"="c:\users\PaoLo\AppData\Roaming\uTorrent\uTorrent.exe" [2013-09-01 1130576]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "tsnp2std"="c:\windows\tsnp2std.exe" [2007-05-12 270336]
    "snp2std"="c:\windows\vsnp2std.exe" [2007-09-28 344064]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-09-09 154136]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-09 178712]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
    "FixCamera"="c:\windows\FixCamera.exe" [2007-07-11 20480]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-04-30 421888]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-10-18 152392]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "SoftwareSASGeneration"= 3 (0x3)
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
    "{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    .
    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
    backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
    backupExtension=.CommonStartup
    .
    [HKLM\~\startupfolder\C:^Users^PaoLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
    path=c:\users\PaoLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    backup=c:\windows\pss\Dropbox.lnk.Startup
    backupExtension=.Startup
    .
    [HKLM\~\startupfolder\C:^Users^PaoLo^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
    path=c:\users\PaoLo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
    backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2013-04-04 21:06    958576  ----a-w-    c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
    2013-04-21 13:43    59720   ----a-w-    c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
    2013-10-28 08:29    3675352 ----a-w-    c:\program files\DAEMON Tools Lite\DTLite.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
    2006-11-02 12:34    125440  ----a-w-    c:\windows\ehome\ehtray.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
    2012-07-12 05:00    138096  ----atw-    c:\users\PaoLo\AppData\Local\Facebook\Update\FacebookUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
    2012-11-23 08:22    307712  ----a-w-    c:\program files\FileHippo.com\UpdateChecker.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
    2009-08-31 05:19    133104  ----atw-    c:\users\PaoLo\AppData\Local\Google\Update\GoogleUpdate.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
    2011-12-19 07:39    3817472 ----a-w-    c:\users\PaoLo\AppData\Roaming\Google\Google Talk\googletalk.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2013-10-18 21:31    152392  ----a-w-    c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
    2009-11-11 02:57    1451520 ----a-w-    c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2013-04-30 19:59    421888  ----a-w-    c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2013-07-02 01:16    254336  ----a-w-    c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
    "IgfxTray"=c:\windows\system32\igfxtray.exe
    "HDAudDeck"=c:\program files\VIA\VIAudioi\VDeck\VDeck.exe -r
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ    BthServ
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2008-08-22 06:11    451872  ----a-w-    c:\program files\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-11-24 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 02:34]
    .
    2013-11-23 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-812886578-3759993032-3091145522-1000Core.job
    - c:\users\PaoLo\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-23 05:00]
    .
    2013-11-24 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-812886578-3759993032-3091145522-1000UA.job
    - c:\users\PaoLo\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-12-23 05:00]
    .
    2013-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-812886578-3759993032-3091145522-1000Core.job
    - c:\users\PaoLo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-31 05:19]
    .
    2013-11-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-812886578-3759993032-3091145522-1000UA.job
    - c:\users\PaoLo\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-31 05:19]
    .
    2013-11-24 c:\windows\Tasks\User_Feed_Synchronization-{CE3A4985-B6F6-42AC-B6C6-70724635B444}.job
    - c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://isearch.babylon.com/?babsrc=HP_ss_btis2&mntrId=34A9001966CBF5F8&affID=119529&tsp=4924
    uDefault_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
    mStart Page = hxxp://search.easylifeapp.com/?pid=720&src=ie1&r=2013/03/09&hid=1458095096&lg=EN&cc=PH
    mSearch Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=PH&userid=e64b9f36-b430-79c3-f4ce-a16432f24e02&searchtype=ds&q={searchTerms}&installDate=22/08/2013
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
    TCP: DhcpNameServer = 124.106.4.2 124.106.5.2
    FF - ProfilePath - c:\users\PaoLo\AppData\Roaming\Mozilla\Firefox\Profiles\3yfh5i7f.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.easylifeapp.com/?pid=720&src=ff2&r=2013/03/09&hid=1458095096&lg=EN&cc=PH&l=1&q=
    FF - ExtSQL: !HIDDEN! 2009-09-03 08:07; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=100888
    FF - user.js: extensions.BabylonToolbar_i.babExt - 
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.id - 34a90308000000000000001966cbf5f8
    FF - user.js: extensions.BabylonToolbar_i.hardId - 34a90308000000000000001966cbf5f8
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15364
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1714:06
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    FF - user.js: extensions.delta.tlbrSrchUrl - 
    FF - user.js: extensions.delta.id - 34a90308000000000000001966cbf5f8
    FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
    FF - user.js: extensions.delta.instlDay - 15881
    FF - user.js: extensions.delta.vrsn - 1.8.21.5
    FF - user.js: extensions.delta.vrsni - 1.8.21.5
    FF - user.js: extensions.delta.vrsnTs - 1.8.21.520:33
    FF - user.js: extensions.delta.prtnrId - delta
    FF - user.js: extensions.delta.prdct - delta
    FF - user.js: extensions.delta.aflt - babsst
    FF - user.js: extensions.delta.smplGrp - none
    FF - user.js: extensions.delta.tlbrId - base
    FF - user.js: extensions.delta.instlRef - sst
    FF - user.js: extensions.delta.dfltLng - en
    FF - user.js: extensions.delta.excTlbr - false
    FF - user.js: extensions.delta.ffxUnstlRst - true
    FF - user.js: extensions.delta.admin - false
    FF - user.js: extensions.delta_i.babTrack - affID=119529&tsp=4924
    FF - user.js: extensions.delta_i.babExt - 
    FF - user.js: extensions.delta_i.srcExt - ss
    FF - user.js: extensions.delta.autoRvrt - false
    FF - user.js: extensions.delta.rvrt - false
    FF - user.js: extensions.delta.newTab - false
    .
    - - - - ORPHANS REMOVED - - - -
    .
    MSConfigStartUp-KiesPDLR - c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
    MSConfigStartUp-KiesPreload - c:\program files\Samsung\Kies\Kies.exe
    MSConfigStartUp-KiesTrayAgent - c:\program files\Samsung\Kies\KiesTrayAgent.exe
    MSConfigStartUp-Messenger (Yahoo!) - c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
    MSConfigStartUp-Pokki - %LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll
    MSConfigStartUp-RIMBBLaunchAgent - c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
    MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-11-24 12:14
    Windows 6.0.6000  NTFS
    .
    scanning hidden processes ...  
    .
    scanning hidden autostart entries ... 
    .
    scanning hidden files ...  
    .
    .
    c:\users\PaoLo\AppData\Local\Temp\catchme.dll 53248 bytes executable
    .
    scan completed successfully
    hidden files: 1
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-812886578-3759993032-3091145522-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    "scansk"=hex(0):5c,9f,ea,bb,82,eb,c7,a0,9e,7e,ec,3e,06,d3,ec,e7,d0,32,3f,b6,9a,
       ba,3b,dc,0b,41,5e,8e,65,04,8d,c6,fa,61,80,15,f2,13,9c,c8,00,00,00,00,00,00,\
    .
    [HKEY_USERS\S-1-5-21-812886578-3759993032-3091145522-1000_Classes\CLSID\{8aa74d11-5ab9-4973-8943-e1e5cbcb9e50}]
    @Denied: (Full) (Everyone)
    "Model"=dword:00000050
    "Therad"=dword:0000001f
    "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
       1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'Explorer.exe'(1984)
    c:\program files\Stardock\Fences\FencesMenu.dll
    c:\program files\stardock\fences\DesktopDock.dll
    .
    Completion time: 2013-11-24  12:16:56
    ComboFix-quarantined-files.txt  2013-11-24 04:16
    .
    Pre-Run: 3,903,877,120 bytes free
    Post-Run: 3,599,085,568 bytes free
    .
    - - End Of File - - E17E3920A390678D554E1659CCE00E8E
    5C616939100B85E558DA92B899A0FC36
    

    I'm stumped. Please help, thank you.

  • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    How do I run the Windows 7 Explorer shell with Administrator Privileges by default?
  • Barry Kelly

    The Windows 7 shell (Explorer) can be made to run with Administrator privileges by this manual process:

    1. Kill Explorer shell by holding down Shift+Ctrl, right-clicking the Shut down button in the Start Menu, and selecting Exit Explorer
    2. Start Task Manager with Ctrl+Shift+Esc
    3. Elevate Task Manager privileges by going to Processes tab and selecting Show processes from all users
    4. Then start up a new instance of the shell by File | Run in Task Manager, typing in explorer, and selecting the Create this task with administrative privileges.

    After following the above process, the Windows shell will be running with administrative privileges, and any programs it launches will also have administrative privileges. This makes performing tasks that require the privilege far easier, particularly for command-line applications, which usually fail silently or with an Access denied. message rather than giving an opportunity to use UAC to elevate the process's privileges.

    What I'm interested in, though, is creating an account which uses a privileged shell by default, rather than having to follow this laborious process every time. How can it be done?


  • Related Answers
  • Mark Allen

    As far as I know you can't create an account like this, but if you log in as "Administrator" (Not merely as an account that is a member of the Administrators group - that's not good enough.) then everything you launch will be launched elevated.

    Not something you should do normally, but if you need to then you need to.

  • davr

    This is a terrible idea. You want to go back to the Win XP days where everything runs as Administrator? You're giving up all the security gains made by Vista and Windows 7. GUI applications should all invoke UAC, so there's no need for this hack in that case.

    If you need to run command line apps as administrator, simply open an administrator command prompt. It's very easy, just press WIN, type 'cmd', then press ctrl+shift+enter. Or even simpler, you can make a shortcut to cmd, and in the settings set it to 'Run as administrator'

  • harrymc

    Why not turn on auto elevate for the built-in Administrator account?

    Launch Local Security Policy

    Go to: Local Policies \Security Options

    Look for: User Account Control: Admin Approval Mode For The Built-in Administrator Account and make sure it's disabled (this is the default value anyway).

    Now you can Fast Switch to the built-in Administrator account for all your admin needs.

  • AdamV

    If you turn UAC off then what is the remaining problem?

    You could try the methods in this article by Aaron Margosis, which is for Vista but may well work on Windows 7 (I have not tested this).

    @Andrew Some apps don't behave properly with UAC because they are not written properly to work with UAC, and often this is because they were not written properly in the first place. Usual suspects are things which try to write user-level registry settings under HKLM. UAC helps by virtualising this, but if a later part of the code which reads the setting is hard-coded it may bypass virtualisation, not find the setting and not behave as expected (this is also why it is a really bad idea to turn off UAC while you install and configure all your apps and then turn it back on afterwards, as the settings can end up in some strange places)

  • Langhard

    There is an option in the Explorer "folder options" to run every new explorer window as a seperate task. Whit this enabled you should be able to run a 2nd copy of explorer.exe elevated...

    Also possible is running an instance of eg. mspaint with the runas command (runas /user:yourdomain\youradminuser mspaint) and then go to file - open. Voila, you have your elevated explorer...