Questions

XP SP2 - Administrator lost authority!

+
0 Votes
Locked

XP SP2 - Administrator lost authority!

cwr64
XP SP2 Desktop PC. When I try to apply a startup change of any kind using MSCONFIG, it pops up telling me I need to switch to a user with Administrator authority to do the change. I have only 1 user defined and it does have Administrator auth. I then added a new user with Administrator auth and logged on as the new user, but same problem. This is a new problem - used to work just fine. Any fix? Charlie
  • +
    0 Votes
    willcomp

    Could be malware. I've seen that before when changes to any settings that could stop the adserver/trojan from executing were blocked.

    I recommend Webroot SpySweeper for the job.

    +
    0 Votes
    cwr64

    I ran a system restore back to yesterday - did not help (but I don't run msconfig every week so I am not certain when things got messed up). I downloaded latest Spybot S&D files and ran Spybot. It didn't find anything new/unusual, but I let it remove what it found. It said it needed to run again during reboot (to fix 1 more thing) - so I let it - and I then booted again after Spybot ran the 2nd time. Problem did not get fixed. Anyone have another idea?

    +
    0 Votes
    willcomp

    I recommended Webroot SpySweeper for a reason. Althogh I still use Spybot for initial cleaning, it will not identify and/or remove a lot of the more severe malware.

    +
    0 Votes
    cwr64

    I installed/ran CounterSpy - rated 5 stars by CNET. It is free for a couple of weeks. It deleted and changed a few things but did not fix the problem. Webroot SpySweeper didn't look so good when I looked at ratings/reviews by the users.

    +
    0 Votes
    willcomp

    I clean 2 or 3 systems a week and have used numerous pieces of malware removal software, both freeware and commercial.

    SpySweeper is the best available and that is backed up by PC Magazine ratings as well.

    Use what you wish, but take CNet ratings with a grain of salt.

    +
    0 Votes
    cwr64

    I see your point about CNET. I assume the free trial of Spysweeper just says it found stuff, but to delete the trash you have to buy the product. I know it will find SOMETHING, but I hate to spend $30 and then find out the SOMETHINGs have nothing to do with my problem - same as with Spybot and Counterspy. If I could know in advance that it would fix my problem I would be happy to hand over the money. My PC software has not been reloaded from scratch in 2-3 years and I have a new and bigger harddrive to install, so maybe now is the time to forget the MSCONFIG issue and move on to a newly loaded harddrive. What do you think?

    +
    0 Votes
    bhatnagar_nitin

    Are you observing any change in the UI of the system also besides this behaviour? Like your windows explorer shows one extra menu in the menu bar for ex. "Advaced tasks" etc.
    If this is the case then your system is infected with some kind of task scheduler spyware and what it does is take control over your system and not allowing you to do any administrative thing on the system. I faced this issue on one of my PC and the solution lies in completely killing this task. This spyware adds a task in the windows task scheduler which is started as soon as you boot your system. The best solution lies in removing its startup entry from the registry and killing the process from the task scheduler.
    I would tell you the process later if this is the exact case you are facing. Meanwhile, if you have decided to buy another HDD then be careful to get the better antivirus, firewall and antispyware softwares for your system. The best I have exprienced with is McAfee Internet Security but it is a Licensed version.

    +
    0 Votes
    willcomp

    SpySweeper has a 14 day trial version that is fully functional. It is well disguised on their web site and not available from freeware/shareware sites like download.com.

    Navigate to bottom of page at this link:

    http://www.webroot.com/consumer/products/spysweeperwithantivirus/latestv.html

    A clean install of XP will do the job but problem will recur if you are not careful and don't have adequate protection.

    For what it's worth, I seen PCs with severe adware/spyware/rootkit problems that had Internet Security suites from McAfee, Norton, ZoneAlarm, and BellSouth installed. The adware\spyware portions of suites are no better than freeware applications. SpySweeper is far superior but even it is not 100% effective. It just comes closer than others.

    +
    0 Votes
    cwr64

    I downloaded and installed the Spysweeper you pointed me to. Because I wanted to see what additional things that Webroot would find that SPYBOT did not find, after installing Spysweeper I ran SPYBOT S&D, then deleted cookies & temp internet pages from IE7 and Firefox, and also used Windows disk cleanup to get rid of temp files, Recycle bin, and whatever.
    Then I rebooted. When rebooting, Spysweeper kept my McAfee AV etc. from starting properly, and McAfee got blown out. Because I was not at that point protected by a firewall (maybe), I removed the router cable from my PC. Then I ran a full scan with Webroot Spysweeper. After an hour of scanning both my harddrive and also my external USB harddrive, it ended OK and produced the report. It found zero problems and removed nothing. I then removed Webroot Spysweeper and rebooted. This time McAfee came up OK.
    Any other ideas? The only idea I have is to build a new system on my new harddrive.

    Another poster said I should look at my IE to see if there are new things on the menu bar that didn't used to be there. The answer is that I do not see anything new or that I didn't put there.

    I'm a mainframe person. These PC problems just kill me.

    +
    0 Votes
    willcomp

    Sure thought you had a malware problem. That's common behavior for them to block any changes that could disable their operation.

    I'm fresh out of options.

    +
    0 Votes
    katrina

    Kidding...sort of. I went through this a few months ago and fixed it. Found it was something WinXP SP2 did when it updated my system...as in it changed the permissions.

    Unfortunately, I don't remember how I fixed it; I've searched on Microsoft for the fix again, but can no longer find it. It sounds like you have the exact same thing, so I really don't think you have spyware or a hijacker on your system.

    Meanwhile...have you found a fix? This is driving me NUTS!

    Thanks,
    Katrina

    +
    0 Votes
    cwr64

    I have determined the culprit to be McAfee.
    Was previously using Norton System Works 2006.
    I installed McAfee "Total Protection 2007" to replace Norton when Norton expired. No fix available as far as I can determine.

    +
    0 Votes
    Why Me Worry?

    These nasty things change more registry keys and system policies than one can shake a stick at, usually requiring a complete format/reinstall of the O/S to clean up this mess. I really don't know how else to fix this, other than reinstalling the O/S and restoring any lost data from a clean backup, assuming you have one.

    +
    0 Votes
    cwr64

    My system is clean (I ran several different cleaner/checker/malware finders/AV's, etc.). And then I rebuilt the system clean on new harddrive recently. As soon as I install McAfee the problem is there. The problem is McAfee. For sure. There is info on the web that others have come to the same conclusion.

    +
    0 Votes
    katrina

    I no longer have McAfee or Norton installed, so it's neither one of these for me! Would feel better if it was, 'cause I'd rather think the cause was due to anti-spyware, rather than spyware or hijackers.

    I had a host of anti-leave-my-bloody-computer-alone software on my system and uninstalled all of it, just to see if it would make a difference...it didn't. So now I'm thinking it probably is some sort of invasive program. Bummer!

    +
    0 Votes
    xbox2007

    My computer is doing the exact same thing! I can't download anything...tells me I'm not authorized as administrator. I can't delete any programs...I'm not authorized. I'm not authorized to do anything and I AM the administrator. So was curious what happened.

    +
    0 Votes
    trevor

    Sorry, I can't help myself. I posted this tonight which might be of some use:
    http://techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=214445&messageID=2324902

  • +
    0 Votes
    willcomp

    Could be malware. I've seen that before when changes to any settings that could stop the adserver/trojan from executing were blocked.

    I recommend Webroot SpySweeper for the job.

    +
    0 Votes
    cwr64

    I ran a system restore back to yesterday - did not help (but I don't run msconfig every week so I am not certain when things got messed up). I downloaded latest Spybot S&D files and ran Spybot. It didn't find anything new/unusual, but I let it remove what it found. It said it needed to run again during reboot (to fix 1 more thing) - so I let it - and I then booted again after Spybot ran the 2nd time. Problem did not get fixed. Anyone have another idea?

    +
    0 Votes
    willcomp

    I recommended Webroot SpySweeper for a reason. Althogh I still use Spybot for initial cleaning, it will not identify and/or remove a lot of the more severe malware.

    +
    0 Votes
    cwr64

    I installed/ran CounterSpy - rated 5 stars by CNET. It is free for a couple of weeks. It deleted and changed a few things but did not fix the problem. Webroot SpySweeper didn't look so good when I looked at ratings/reviews by the users.

    +
    0 Votes
    willcomp

    I clean 2 or 3 systems a week and have used numerous pieces of malware removal software, both freeware and commercial.

    SpySweeper is the best available and that is backed up by PC Magazine ratings as well.

    Use what you wish, but take CNet ratings with a grain of salt.

    +
    0 Votes
    cwr64

    I see your point about CNET. I assume the free trial of Spysweeper just says it found stuff, but to delete the trash you have to buy the product. I know it will find SOMETHING, but I hate to spend $30 and then find out the SOMETHINGs have nothing to do with my problem - same as with Spybot and Counterspy. If I could know in advance that it would fix my problem I would be happy to hand over the money. My PC software has not been reloaded from scratch in 2-3 years and I have a new and bigger harddrive to install, so maybe now is the time to forget the MSCONFIG issue and move on to a newly loaded harddrive. What do you think?

    +
    0 Votes
    bhatnagar_nitin

    Are you observing any change in the UI of the system also besides this behaviour? Like your windows explorer shows one extra menu in the menu bar for ex. "Advaced tasks" etc.
    If this is the case then your system is infected with some kind of task scheduler spyware and what it does is take control over your system and not allowing you to do any administrative thing on the system. I faced this issue on one of my PC and the solution lies in completely killing this task. This spyware adds a task in the windows task scheduler which is started as soon as you boot your system. The best solution lies in removing its startup entry from the registry and killing the process from the task scheduler.
    I would tell you the process later if this is the exact case you are facing. Meanwhile, if you have decided to buy another HDD then be careful to get the better antivirus, firewall and antispyware softwares for your system. The best I have exprienced with is McAfee Internet Security but it is a Licensed version.

    +
    0 Votes
    willcomp

    SpySweeper has a 14 day trial version that is fully functional. It is well disguised on their web site and not available from freeware/shareware sites like download.com.

    Navigate to bottom of page at this link:

    http://www.webroot.com/consumer/products/spysweeperwithantivirus/latestv.html

    A clean install of XP will do the job but problem will recur if you are not careful and don't have adequate protection.

    For what it's worth, I seen PCs with severe adware/spyware/rootkit problems that had Internet Security suites from McAfee, Norton, ZoneAlarm, and BellSouth installed. The adware\spyware portions of suites are no better than freeware applications. SpySweeper is far superior but even it is not 100% effective. It just comes closer than others.

    +
    0 Votes
    cwr64

    I downloaded and installed the Spysweeper you pointed me to. Because I wanted to see what additional things that Webroot would find that SPYBOT did not find, after installing Spysweeper I ran SPYBOT S&D, then deleted cookies & temp internet pages from IE7 and Firefox, and also used Windows disk cleanup to get rid of temp files, Recycle bin, and whatever.
    Then I rebooted. When rebooting, Spysweeper kept my McAfee AV etc. from starting properly, and McAfee got blown out. Because I was not at that point protected by a firewall (maybe), I removed the router cable from my PC. Then I ran a full scan with Webroot Spysweeper. After an hour of scanning both my harddrive and also my external USB harddrive, it ended OK and produced the report. It found zero problems and removed nothing. I then removed Webroot Spysweeper and rebooted. This time McAfee came up OK.
    Any other ideas? The only idea I have is to build a new system on my new harddrive.

    Another poster said I should look at my IE to see if there are new things on the menu bar that didn't used to be there. The answer is that I do not see anything new or that I didn't put there.

    I'm a mainframe person. These PC problems just kill me.

    +
    0 Votes
    willcomp

    Sure thought you had a malware problem. That's common behavior for them to block any changes that could disable their operation.

    I'm fresh out of options.

    +
    0 Votes
    katrina

    Kidding...sort of. I went through this a few months ago and fixed it. Found it was something WinXP SP2 did when it updated my system...as in it changed the permissions.

    Unfortunately, I don't remember how I fixed it; I've searched on Microsoft for the fix again, but can no longer find it. It sounds like you have the exact same thing, so I really don't think you have spyware or a hijacker on your system.

    Meanwhile...have you found a fix? This is driving me NUTS!

    Thanks,
    Katrina

    +
    0 Votes
    cwr64

    I have determined the culprit to be McAfee.
    Was previously using Norton System Works 2006.
    I installed McAfee "Total Protection 2007" to replace Norton when Norton expired. No fix available as far as I can determine.

    +
    0 Votes
    Why Me Worry?

    These nasty things change more registry keys and system policies than one can shake a stick at, usually requiring a complete format/reinstall of the O/S to clean up this mess. I really don't know how else to fix this, other than reinstalling the O/S and restoring any lost data from a clean backup, assuming you have one.

    +
    0 Votes
    cwr64

    My system is clean (I ran several different cleaner/checker/malware finders/AV's, etc.). And then I rebuilt the system clean on new harddrive recently. As soon as I install McAfee the problem is there. The problem is McAfee. For sure. There is info on the web that others have come to the same conclusion.

    +
    0 Votes
    katrina

    I no longer have McAfee or Norton installed, so it's neither one of these for me! Would feel better if it was, 'cause I'd rather think the cause was due to anti-spyware, rather than spyware or hijackers.

    I had a host of anti-leave-my-bloody-computer-alone software on my system and uninstalled all of it, just to see if it would make a difference...it didn't. So now I'm thinking it probably is some sort of invasive program. Bummer!

    +
    0 Votes
    xbox2007

    My computer is doing the exact same thing! I can't download anything...tells me I'm not authorized as administrator. I can't delete any programs...I'm not authorized. I'm not authorized to do anything and I AM the administrator. So was curious what happened.

    +
    0 Votes
    trevor

    Sorry, I can't help myself. I posted this tonight which might be of some use:
    http://techrepublic.com.com/5208-6230-0.html?forumID=101&threadID=214445&messageID=2324902