NT Authority\System + registry: access denied? (BFE, Firewall, Defende


Recommended Posts

hi

Someone brought me a laptop where "the internet did not function anymore". I attempted a system restore, still the problem existed.

I tried scanning with a few anti-malware programs (MBAM, Avast), nothing was found.

MSE can also not be installed.

I noticed a firewall issue, but it's much more than that. The Base Filtering Engine did not start, so several depending services couldn't be started, so no internet... I fixed the internet problem by changing some permissions to a reg key, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BSE or something like that. Internet access is back. I now have the firewall service running, but not the firewall. Also Windows Defender fails to start.

Thanks to ProcMon, I noticed that "NT Authority\System" returns "access denied" while accessing the registry in nearly all those instances. Yet when I check, "SYSTEM" is found in (most of) the permissions for the reg keys, and has full access in (nearly) all cases.

So before I manually change anything: are there any hints on what might be causing this? (I solved one or two by adding FULL CONTROL permissions for EVERYONE, which is definitely not the way to go. NT Authority\SYSTEM has also been added to the ADMINISTRATORS group, but no avail).

Thank you very much in advance!

( Windows 7 Home Premium )

Are you positive that there is not a virus or malware on the system? I had one on my system the MWB detected and removed, but it still came back, and it was masquerading as a system file (csrss.exe) but it was loading it from a hidden/system folder simply called Nvida. I would also recommend trying NTFS Access and see if perhaps the NTFS permissions are screwed up. One other check that can be done easily is: Open command prompt, and do

dir/ah

you also might want to include the /s switch and see if anything looks out of the ordinary.

No, not positive the malware has been removed (and yes, it's very likely it's malware, but my usual set of tools didn't pick up anything - and MSE even failed to (re)install, it's also gone).

As for the access, I really mean the rights in the registry. Those keys ( HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BSE / HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winsock2/Parameters / HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Epoch2 or something like that) all returned "NT AUTHORITY\SYSTEM" "access denied", although the rights are in fact granted if I check everything.

One other thing to attempt: open an elevated command prompt, and type in

sfc/scannow

this process will take some time, but should be able to fix any corrupted system files.

Found this doing a google search:

I had some problems with my registery permissions a while ago, I couldn?t delete any thing any more, so I was looking for something that could reset my registery permissions to defaults. Here is the solution that worked for me

If you want to reset the entire registry permissions to defaults follow these steps

Note:- Before Doing any changes to registry plesae take a backup and start your changes

First you need to download SubInACL from here

SubInACL is a command-line tool that enables administrators to obtain security information about files, registry keys, and services, and transfer this information from user to user, from local or global group to group, and from domain to domain.

Create a file with the name reset.cmd under C:\Program Files\Windows Resource Kits\Tools folder

Now you need to Edit the reset.cmd file and add the following lines

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

subinacl /subdirectories %SystemDrive% /grant=system=f

Save and exit your file

Now you need to open command prompt run the following command

cdcd ?C:\Program Files\Windows Resource Kits\Tools?

after this press enter and enter the following command

reset.cmd

after entering this please press enter

after a few minutes by processing subinacl, the permission will be reset

Thanks. Still no fix though. Yesterday I managed to have an internet connection, working, just not the firewall, today I'm offline again.

Even the Diagnostics Policy Service fails (also access denied).

This must have been / be one serious malware infection!

Have you attempted to create a new user account? I would try and see if perhaps just that profile is corrupt. If not then it seems that your only remaining choice would be a reinstall!

"So far, never had to format any PC after malware"

Sad as it may be, this really is no longer a viable option with the sophistication and complexity of modern day infections.

Sometimes you just have to "nuke it from orbit" as the only sure way of being sure its clean.

If you can not be reasonably sure that you have cleaned it after a specific time frame, a nuke is most likely going to be the safest approach both in time spent and confidence that it is actually clean.

It is a good practice once you create a system and get your applications/tools installed and configured how you like it to take an image. And then update this image as you make major changes to the system, say after a specific number of patches, install of new major applications, etc. This way if the need arises you can get back to a clean usable install in just a few minutes.

Never use a laptop/desktop when you bought it off from someone. Who knows what it might have.

The safest way is to first the drivers for the computer and second do a clean install.

Never use a stranger's computer ever.

I didn't buy it, it's someone who brought it to me to have a look at the problem. I only buy new stuff ;)

I had already tried the creation of a new user account, but I had the same issues.

Last night, I tried a repair install (the fake upgrade method) of Windows 7. Lots of previously-unable-to-start services running again, although I did get a warning that the hard disk might be failing soon (but I think it's a consequence of removing SP1 so I could attempt the repair install). I'll be looking further into it tonight and keep you posted.

I'll say it again: You might as well format the HDD and reinstall the OS! Whatever is going on in the system is going to continue until you remove it, and based on what you are saying, you can not install any A/V or malware scanner, so the next most likely option is a reinstall :/

Something is really screwed up in that system :/ It might be worth while to ask your friend what he/she was doing prior to all hell breaking loose. At least in that case you might have a pretty good idea when/where the infection took place.

Screwed, beyond any malware infection I've seen so far (except for an XP one a couple of months ago).

No, they're the typical user who doesn't know why stuff happened... I bet adult sites, since apparently there was some warning in French about porn and having to pay up and stuff.

Current status: after the repair install, I got a bad HDD warning. On reboot, Windows hang on the logo. Win7 Start-up repair didn't help, I attached the drive to another laptop to make a back-up and try some chkdsk-stuff (which all was fine!). Ultimately, I was lucky and got it running again. Internet connection OK, just immensely slow for my taste, but that could be the PC itself, I obviously can't judge how slow it used to be let's say two weeks ago. Hope tonight it still works, since I need to re-apply lots of updates.

So how many days we into this now? If you would of just nuked it after say 2 hours dicking with it and not getting anywhere, the user would already have their machine back.

"I'm just too obsessed with the cause"

The cause is the USER ;) What they actually infected themselves with, it could be MULTIPLE things and the combo of them really messed things up. Does not always come down to 1 infection. Most machines I have cleaned in the past were infected with a plethora of things!!

I can understand your curiosity, I am inflected with the same trait!! But to be honest it comes down to the fact it was compromised in some fashion. The only real way to be sure that the infection is gone is nuke it.

New crap comes out hourly, its code changes at that same kind of rate - your going to see lots of different variants of the same infection. Most of the antivirus players don't always give lots of details of what a specific virus/malware/crapware does, etc.. So even if you had a name of the infection to work with - getting the details you seek might not be possible.

Your symptoms may be the cause of virus A doing X, then virus B doing Y, then C.. doing Z... etc..

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • The quantum search for Time's origin had an equally mind-boggling conclusion by Sayan Sen Image by Steve Johnson via Pexels A theoretical study from researchers at the University of Surrey suggested that the direction of time may not be fundamentally fixed in certain quantum systems. The work, published in Scientific Reports, examined how the “arrow of time” could emerge from microscopic physics and found that time-reversal symmetry can remain intact even in models used to describe processes such as energy loss and thermalisation. The arrow of time refers to the observed one-way direction from past to future in everyday life. In macroscopic processes, this is easy to see. Spilled milk spreads across a table and does not gather back into a glass, and heat flows from hotter objects to colder ones. These processes shape the common sense idea that time moves in a single direction. However, at the level of fundamental physics, many equations do not prefer a direction of time. Time-reversal symmetry means that the same physical laws can describe a system whether time moves forward or backward. This has made it difficult to explain why irreversible behaviour appears in the large-scale world even when the underlying rules do not require it. Dr Andrea Rocco, Associate Professor in Physics and Mathematical Biology at the University of Surrey, described this contrast: "One way to explain this is when you look at a process like spilt milk spreading across a table, it's clear that time is moving forward. But if you were to play that in reverse, like a movie, you'd immediately know something was wrong – it would be hard to believe milk could just gather back into a glass. However, there are processes, such as the motion of a pendulum, that look just as believable in reverse. The puzzle is that, at the most fundamental level, the laws of physics resemble the pendulum; they do not account for irreversible processes. Our findings suggest that while our common experience tells us that time only moves one way, we are just unaware that the opposite direction would have been equally possible." The study focused on open quantum systems, which are quantum systems that interact with a surrounding environment. This environment, often described as a heat bath, can exchange energy and information with the system. The researchers used this framework to study how a direction of time might appear even when the underlying physics does not enforce one. A key part of the analysis involved the Markov approximation. This is a simplification used in many models where the system is assumed not to retain memory of its past states. The idea is that changes depend only on the current state, not on earlier history. This is commonly used when studying thermalisation, which is the process where a system settles into equilibrium with its environment. The study also used concepts such as master equations, including the Lindblad and Pauli equations, which describe how probabilities of different quantum states change over time. Another related model discussed was quantum Brownian motion, which describes the random-like movement of a quantum particle interacting continuously with its environment. In these descriptions, a “memory kernel” can appear, which is a mathematical term that accounts for how past states influence current behaviour. The researchers found that applying the Markov approximation did not break time-reversal symmetry. Even when the system interacted with an effectively infinite heat bath, the resulting equations of motion remained symmetric in time. This meant that the same mathematical description could, in principle, run forward or backward in time without contradiction. The study further showed that standard frameworks used in open quantum systems, including quantum Brownian motion and master equations like the Lindblad and Pauli forms, could be written in a time-symmetric way. These equations are typically used to describe processes that look irreversible, such as dissipation and thermalisation, but the results suggested they can also be interpreted as allowing evolution in both time directions. Thomas Guff, Research Fellow in Quantum Thermodynamics, said: "The surprising part of this project was that even after making the standard simplifying assumption to our equations describing open quantum systems, the equations still behaved the same way whether the system was moving forwards or backwards in time. When we carefully worked through the maths, we found that this behaviour had to be the case because a key part of the equation, the "memory kernel," is symmetrical in time. We also found a small but important detail which is usually overlooked – a time discontinuous factor emerged that kept the time-symmetry property intact. It’s unusual to see such a mathematical mechanism in a physics equation because it's not continuous, and it was very surprising to see it appear so naturally." The researchers also noted that deriving a one-way arrow of time from time-reversal symmetric microscopic dynamics remains an open problem across fields such as thermodynamics, statistical mechanics, particle physics, and cosmology. Their results suggested that some standard descriptions of irreversible behaviour in open quantum systems may be better understood using a time-symmetric formulation of Markovianity. According to the study, processes such as thermalisation, which are usually treated as irreversible, could in theory be described in a way that allows evolution in either time direction under the same rules. This does not imply that time reversal occurs in everyday life, but rather that the underlying equations do not strictly enforce a single direction. Overall, the findings suggested that the perceived direction of time may emerge from how physical systems are modelled and approximated, rather than from a fundamental asymmetry in the laws themselves. The researchers noted that this perspective could have implications for ongoing work in quantum mechanics, thermodynamics, and cosmology on the origin of time’s arrow. Source: University of Surrey, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing
    • A bit premature... 100% Marketing. Bizarre.
    • A $300 price hike is insane! No one is going to want to pay that much!
    • Since the 1st one flopped, there is really no reason to make another one. It's just losing money left and right.
  • Recent Achievements

    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
    • One Month Later
      eurospharma62 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      581
    2. 2
      +Edouard
      182
    3. 3
      PsYcHoKiLLa
      75
    4. 4
      Michael Scrip
      73
    5. 5
      neufuse
      64
  • Tell a friend

    Love Neowin? Tell a friend!