3 replies to this topic

[AshleyST]

Background : Attempting to install KB2598361 as part of the monthly Patch Tuesday updates failed with 57A error.
Manually downloaded fix and attempted install by hand which resulted in Error 1402, access denied to key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS

Was unable to view the parent key or any of the children (IMAIL, MAPI and MSFS) as all access permissions had been removed.
Manually added permissions to those keys and re-booted. Applied fix successfully but when checking the access
permissions noticed that the parent key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
was missing all it's permissions again. I had not checked the option on the child keys to inherit permissions so
they were (thankfully) still intact.

Diagnosis : Ran process monitor at boot time to see who/what was accessing that key. Only SASCORE and
SuperAntiSpyware task showed as having access but after SASCORE activity the SuperAntiSpyware task entries showed as access denied.

Added permissions back to key and uninstalled SuperAntiSpyware. Rebooted. Checked key and permissions were still there.

As soon as I re-install SuperAntiSpyware and re-boot the access permissions on registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
have been removed.

I'm using SuperAntiSpyware free edition on Windows 7 Professional SP1 with all the latest fixes.

Does anyone know anything regarding this problem ?
Thank you.

[SUPERAntiSpy]

We will look into this and see what possibly could be happening.

[SAS Customer Service]

Please create a support ticket at www.superantispyware.com/csr so we can issue a diagnostic.

[AshleyST]

Thanks.
I've opened a support ticket as requested.