Can't delete HKEY_LOCAL_MACHINE\SYS\Curr\Con\Set\Enum\Root\ESET_EPFWNDISMP

Discussion in 'ESET Smart Security' started by Slooshy, Oct 16, 2009.

Thread Status:
Not open for further replies.
  1. Slooshy

    Slooshy Registered Member

    Joined:
    Apr 12, 2009
    Posts:
    26
    Hello,

    I recently did a Windows 7 x64 upgrade, and after discovered that Eset's firewall explodes or rather doesn't enjoy Windows 7 upgrades (even a Windows 7 to Windows 7 upgrade no less, for repair purposes). So I uninstalled Eset 4.0.467.

    In device manager, I get a yellow exclamation mark next to "WAN Miniport (IP)-Eset Personal Firewall" under Network adapters. Well, booting into safe mode and deleting that doesn't work. Basically permissions are shut down even under an admin account with UAC disabled.

    I did a search, and I though I found the answer: https://www.wilderssecurity.com/showpost.php?p=1255666&postcount=25

    But in step 3 I get

    Microsoft Windows [Version 6.1.7600]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.


    C:\>cd C:\Program Files (x86)\Windows Resource Kits\Tools

    C:\Program Files (x86)\Windows Resource Kits\Tools>subinacl /subkeyreg \HKEY_LOC
    AL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\ESET _EPFWNDISMP /grant=administrat
    ors=f
    SYSTEM\CurrentControlSet\Enum\Root\ESET_EPFWNDISMP : new ace for builtin\adminis
    trators
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\ESET_EPFWNDISMP - RegSetKe
    ySecurity Error : 5 Access is denied.

    SYSTEM\CurrentControlSet\Enum\Root\ESET_EPFWNDISMP \0003 : new ace for builtin\ad
    ministrators
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\ESET_EPFWNDISMP\0003 - Reg
    SetKeySecurity Error : 5 Access is denied.

    SYSTEM\CurrentControlSet\Enum\Root\ESET_EPFWNDISMP \0003\Control : new ace for bu
    iltin\administrators
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\ESET_EPFWNDISMP\0003\Contr
    ol - RegSetKeySecurity Error : 5 Access is denied.

    SYSTEM\CurrentControlSet

    etc.etc.etc.

    Elapsed Time: 00 00:00:00
    Done: 25, Modified 0, Failed 25, Syntax errors 0
    Last Done : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\ESET_EPFWNDIS
    MP\0003\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0000000e\00000000
    Last Failed: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R oot\ESET_EPFWNDIS
    MP\0003\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0000000e\00000000 - Re
    gSetKeySecurity Error : 5 Access is denied.


    In step 4, I get a Windows security window popping up saying, "Cannot delete Eset_EPFWNDISMP: error while deleting key" with regedit.

    So Windows Security is basically blocking me despite the fact I had an admin account. If I try to change permissions for Eset_EPFWNDISMP, I get a Windows Security box that sates "Unable to save permission changes on Eset_EPFWNDISMP. Access is denied"

    Basically, I want to get this "WAN Miniport (IP)-Eset Personal Firewall" entry out of device manager, and I can't.

    Thanks in advance for advice.
     
  2. trencan

    trencan Eset Staff

    Joined:
    Nov 21, 2008
    Posts:
    120
    Re: Can't delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\ESET_EPFWNDISMP

    By default only System has rights to modify these keys.

    In regedit you had to set your admin account as owner of the key. Then check "Full Control" for "OWNER RIGHTS". Do this for each subkey in Eset_EPFWNDISMP key. Then you will be able to delete whole key.

    Or you can use ESET Uninstaller utility (http://kb.eset.com/esetkb/index?page=content&id=SOLN2289). Among others, it deletes Eset_EPFWNDISMP key under System account.
     
  3. Slooshy

    Slooshy Registered Member

    Joined:
    Apr 12, 2009
    Posts:
    26
    Re: Can't delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\ESET_EPFWNDISMP

    That worked! thank you
     
Thread Status:
Not open for further replies.