From: mifisher01 on
permissions were changed and so was systemroot changed to fsystemroot check
bits key as well

"KHemmingsen" wrote:

> I have done this process repeatedly to resolve the same problem, but I dont
> get 9b/ and 9c/ as described. 9b/ is unchecked already and 9c/ does not
> appear. When I follow through with remainder steps, and althought I change
> permissions for 'Administrators' to 'allow' it seem to reset itself, and will
> not allow me to change key. Do I need to be logged on as 'Administrator' even
> if user has Administrator rights?
>
> "paulatkinson" wrote:
>
> >
> > Sounds like permissions were changed because of the spyware. Below are
> > the steps for Windows XP Professional you need to follow. In the other
> > versions of XP or Windows 2000 its the same idea except maybe with minor
> > differences in the steps.
> > 1) Open Regedit
> > 2) Select Key "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv"
> > 3) Right Click Key - Select Permissions
> > If permissions are effected Administrators will not have Full Control"
> > follow Step 4 -11. If Administrators have Full Control then you have
> > another problem. Don't even bother doing steps 4-11
> > 4) Select Advanced Button
> > 5) Select Owner Tab
> > 6) Add "Administrators" if it is not there. If it is Highlight
> > Administrators and click Apply Button
> > 7) Click "OK" this will close "Advanced Security for wuauserv" box
> > 8) Select "Administrators" in "Permissions for wuauser" box
> > 9) Check Allow - Full Control box (If check boxes are greyed out then
> > 9a) Select Advanced Button
> > 9b) Uncheck "Inherit from parent...defined here" box
> > 9c) Click "Copy" button
> > 9d) Click "OK" in "Advanced Security for Wuaserv" Box
> > 9e) You should now be able to check the Allow Full Contol box
> > 10) Click "Apply" - If you don't receive an error your golden
> > 11) Click "OK"
> >
> > You should then be able to modify the value ImagePath.
> >
> > The spyware that you had probably effected several registry keys so you
> > may have to follow steps 3 - 11 again if you can't modify other keys.
> >
> >
> > Good Luck!!!
> >
> >
> > --
> > paulatkinson
> > ------------------------------------------------------------------------
> > paulatkinson's Profile: http://forums.techarena.in/members/89791.htm
> > View this thread: http://forums.techarena.in/windows-update/1149963.htm
> >
> > http://forums.techarena.in
> >
> >
From: PA Bear [MS MVP] on
is your refrigerator running too?

mifisher01 wrote:
> permissions were changed and so was systemroot changed to fsystemroot
> check
> bits key as well
>
> "KHemmingsen" wrote:
>
>> I have done this process repeatedly to resolve the same problem, but I
>> dont
>> get 9b/ and 9c/ as described. 9b/ is unchecked already and 9c/ does not
>> appear. When I follow through with remainder steps, and althought I
>> change
>> permissions for 'Administrators' to 'allow' it seem to reset itself, and
>> will not allow me to change key. Do I need to be logged on as
>> 'Administrator' even if user has Administrator rights?
>>
>> "paulatkinson" wrote:
>>
>>>
>>> Sounds like permissions were changed because of the spyware. Below are
>>> the steps for Windows XP Professional you need to follow. In the other
>>> versions of XP or Windows 2000 its the same idea except maybe with minor
>>> differences in the steps.
>>> 1) Open Regedit
>>> 2) Select Key "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv"
>>> 3) Right Click Key - Select Permissions
>>> If permissions are effected Administrators will not have Full Control"
>>> follow Step 4 -11. If Administrators have Full Control then you have
>>> another problem. Don't even bother doing steps 4-11
>>> 4) Select Advanced Button
>>> 5) Select Owner Tab
>>> 6) Add "Administrators" if it is not there. If it is Highlight
>>> Administrators and click Apply Button
>>> 7) Click "OK" this will close "Advanced Security for wuauserv" box
>>> 8) Select "Administrators" in "Permissions for wuauser" box
>>> 9) Check Allow - Full Control box (If check boxes are greyed out then
>>> 9a) Select Advanced Button
>>> 9b) Uncheck "Inherit from parent...defined here" box
>>> 9c) Click "Copy" button
>>> 9d) Click "OK" in "Advanced Security for Wuaserv" Box
>>> 9e) You should now be able to check the Allow Full Contol box
>>> 10) Click "Apply" - If you don't receive an error your golden
>>> 11) Click "OK"
>>>
>>> You should then be able to modify the value ImagePath.
>>>
>>> The spyware that you had probably effected several registry keys so you
>>> may have to follow steps 3 - 11 again if you can't modify other keys.
>>>
>>>
>>> Good Luck!!!
>>>
>>>
>>> --
>>> paulatkinson
>>> ------------------------------------------------------------------------
>>> paulatkinson's Profile: http://forums.techarena.in/members/89791.htm
>>> View this thread: http://forums.techarena.in/windows-update/1149963.htm
>>>
>>> http://forums.techarena.in

From: MowGreen on
mifisher01 wrote:
> permissions were changed and so was systemroot changed to fsystemroot check
> bits key as well

systemroot changed to fsystemroot is a clear indication that the system
is infected. Your original post indicated an error that is *also* caused
by malware, Error Code: 0x8024D007.

You either need to contact Microsoft for NO CHARGE ( FREE ) assistance
in cleaning up the system or, you can reformat and reinstall it. Start
here: http://www.microsoft.com/protect/support/default.mspx

Under " Scanning, detecting, and removing threats " click the
' I think my computer is infected ' link.

If there was one that said " I know my computer is infected ", I'd tell
you to click that one. The next page will provide a link to the OneCare
Safety Scanner. Click it and see if it can detect and remove the malware
on the system.
If you have run the Safety Scanner, click the Continue button.
Confirm Your Country, click Continue.
Click the " type of support you want for Consumer Security "
The Phone and all of the other options are *free*.


MowGreen
================
*-343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked