Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

FixMBR error message - Non-Standard or Invalid Master Boot Record

MBR

  • Please log in to reply

#76
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

I found a Version 16 of FTM.  That's pretty close to what you have from what wiki says.

 

I have been playing with Process Monitor and the first thing that lsass (the exe file for IPSEC Services) looks at is 

 

HKLM\Security\Policy\SecDesc

 

I wonder if it is wrong?  We may need to change the security permissions but let's see what reg query says:

 

 

reg query HKLM\Security\Policy /s >\junk.txt

notepad \junk.txt

 

Copy the two line then open a command prompt and right click and paste or edit then paste.  Hit Enter if notepad does not open.

 

If it's not empty, copy and paste the text into a reply.


  • 0

Advertisements


#77
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

Hi,

 

I've been a little busy all day (off work) and didn't spot your post until now (8:45pm Chicago CST).

 

Ran the two lines, didn't get very far, and Notepad opened clean.

Cmd.exe line came back with "Error:  Access is denied" in response to the first line.

 

You may be on to something.

 

Also note: for the last couple days IE8 has been acting real squirelly.  A new page takes up to 30 secs to load, the cursor in editor sometimes doesn't even react to my typing efforts.  Sometimes I have to bang "Use full editor" several times before it switches and still is bothersome to use.  I had to redo this entry 3 times before it would "take".

 

In addition, I just tried using FireFox and IT'S hanging too!  Opening videos take forever even here.  At least Firefox was working way better than IE8 just a couple days ago.

 

What next?

 

Vernon


Edited by vhende2000, 12 May 2014 - 08:07 PM.

  • 0

#78
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

Open regedit and see if you can take ownership of HKLM\Security\Policy and give Administrator Full Control. 

 

http://www.microsoft...n.mspx?mfr=true

 

Check the box that talks about child object permissions.  We want them visible too.   Reboot and run the same reg query as before.


  • 0

#79
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

That may be a bit of a trick to pull off:

 

I don't HAVE a key for HKLM\Security\Policy.

 

I've got HKey_Local_Machine.  Under that I have +HARDWARE and then +SAM and then SECURITY (no +).

Security has only one key, (Default) with (value not set).  That's it, there is only +SOFTWARE and +SYSTEM.

 

Interesting, huh?

 

Your turn..


  • 0

#80
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

OK then take ownership of the Security key and its children.  Maybe then you will be able to see them.


  • 0

#81
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

Going to be off-line for a few hours.  Wife says I have to watch TV with her.


  • 0

#82
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

OK, I'll admit I was a bit confused with folowing Microsoft's instructions, some of it seemed illogical at first, but I found another article online at www.mihirbabu.com that had a little bit more info and really good pictures to follow step by step.

 

I think I got it at least mostly right.  I can now see the subkeys.

 

I reran the cmd line entry and got a different error: "The system was unable to find the specified registry key or value".

However, notepad did come up with some data:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

First, the good stuff:

 

HKEY_LOCAL_MACHINE\Security\Policy\SecDesc
    <NO NAME>    REG_NONE    0100048098000000A800000000000000140000000200840006000000010014000008000001010000000000050700000000001800FF1F0F0001020000000000052000000020020000000014000108020001010000000000010000000000001400010800000101000000000005070000000000140000100000010100000000000513000000000014000010000001010000000000051400000001020000000000052000000020020000010100000000000512000000

 

Now, the whole batch:

 

Junk.txt
! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Security\Policy
    <NO NAME>    REG_SZ    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\ActSysAc
    <NO NAME>    REG_NONE    00000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\Privilgs
    <NO NAME>    REG_NONE    0100000000000000170000000000000003000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\Sid
    <NO NAME>    REG_NONE    010100000000000100000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\Privilgs
    <NO NAME>    REG_NONE    0300000000000000150000000000000000000000050000000000000000000000030000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\Sid
    <NO NAME>    REG_NONE    010100000000000513000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\ActSysAc
    <NO NAME>    REG_NONE    10000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\Privilgs
    <NO NAME>    REG_NONE    0300000000000000150000000000000000000000050000000000000000000000030000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\Sid
    <NO NAME>    REG_NONE    010100000000000514000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\ActSysAc
    <NO NAME>    REG_NONE    C4000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DEA030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\ActSysAc
    <NO NAME>    REG_NONE    04000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DEB030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\ActSysAc
    <NO NAME>    REG_NONE    56080000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\Privilgs
    <NO NAME>    REG_NONE    01000000000000001D0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DED030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\ActSysAc
    <NO NAME>    REG_NONE    C3000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DF5010000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\ActSysAc
    <NO NAME>    REG_NONE    10000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\Sid
    <NO NAME>    REG_NONE    010100000000000520000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\ActSysAc
    <NO NAME>    REG_NONE    01040000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\Privilgs
    <NO NAME>    REG_NONE    14000000000000000800000000000000000000001100000000000000030000001200000000000000000000000C00000000000000000000001300000000000000000000001800000000000000000000000900000000000000000000001400000000000000000000001600000000000000000000000B00000000000000000000000D00000000000000000000000E00000000000000000000000A00000000000000000000000F00000000000000000000000500000000000000000000001700000000000000000000001900000000000000000000001C00000000000000000000001D00000000000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\Sid
    <NO NAME>    REG_NONE    01020000000000052000000020020000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\ActSysAc
    <NO NAME>    REG_NONE    03000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\Privilgs
    <NO NAME>    REG_NONE    0300000000000000130000000000000000000000170000000000000000000000190000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\Sid
    <NO NAME>    REG_NONE    01020000000000052000000021020000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\Privilgs
    <NO NAME>    REG_NONE    01000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\Sid
    <NO NAME>    REG_NONE    010100000000000504000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\Privilgs
    <NO NAME>    REG_NONE    02000000000000001D00000000000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\Sid
    <NO NAME>    REG_NONE    010100000000000506000000

HKEY_LOCAL_MACHINE\Security\Policy\DefQuota
    <NO NAME>    REG_NONE    0000000200001000000001000000000F00000000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Domains
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmN
    <NO NAME>    REG_NONE    1E00200008000000440041004C0045002D0043004200320039003400460038003300410039000000

HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmS
    <NO NAME>    REG_NONE    010400000000000515000000C99CC026CB702351E143C04D

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtEv
    <NO NAME>    REG_NONE    01FA070003000000030000000000000000000000000000000300000003000000000000000300000009000000

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtFL
    <NO NAME>    REG_NONE    0000

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtLg
    <NO NAME>    REG_NONE    0000000000200000433582000000000000FC070048DD907C566604000000000090FC0700FFFFFFFF

HKEY_LOCAL_MACHINE\Security\Policy\PolDnDDN
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolDnDmG
    <NO NAME>    REG_NONE    00000000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\PolDnTrN
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolMod
    <NO NAME>    REG_NONE    010000000000000090F1A955208BC401

HKEY_LOCAL_MACHINE\Security\Policy\PolPrDmN
    <NO NAME>    REG_NONE    0C000E00080000004D00530048004F004D0045000000

HKEY_LOCAL_MACHINE\Security\Policy\PolPrDmS
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolRevision
    <NO NAME>    REG_NONE    07000100

HKEY_LOCAL_MACHINE\Security\Policy\PolSecretEncryptionKey
    <NO NAME>    REG_NONE    0100000001000000000000003104C9ECE3425B8D99A411A22216BE728844FC93444EA0D6FFCD216D4CC0881D4C1C66D98F35674FD6DAB7764D99AF6C1705A11F6D7CCC321524C508D1BF9605

HKEY_LOCAL_MACHINE\Security\Policy\PolState
    <NO NAME>    REG_NONE    00000000

HKEY_LOCAL_MACHINE\Security\Policy\QuAbsMax
    <NO NAME>    REG_NONE    FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\QuAbsMin
    <NO NAME>    REG_NONE    0000010000000100010000000010000000100000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\SecDesc
    <NO NAME>    REG_NONE    0100048098000000A800000000000000140000000200840006000000010014000008000001010000000000050700000000001800FF1F0F0001020000000000052000000020020000000014000108020001010000000000010000000000001400010800000101000000000005070000000000140000100000010100000000000513000000000014000010000001010000000000051400000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\CupdTime
    <NO NAME>    REG_NONE    5E76F3D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\CurrVal
    <NO NAME>    REG_NONE    28000000280000205C850C00B3695EF779F800547D1806CEE674C370F439193D55A0B48F147E77C56544F0476174B8F16A607A2D

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\OupdTime
    <NO NAME>    REG_NONE    167C77D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\CupdTime
    <NO NAME>    REG_NONE    8E63E0D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\CurrVal
    <NO NAME>    REG_NONE    28000000280000205C850C00B2688C2B4EC1D69B19CBAF16CC5FFBBC2685EEC1B23D9CC89344DF18A09B446EE82E606BC3C057F3

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\OupdTime
    <NO NAME>    REG_NONE    9A538FD2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\CupdTime
    <NO NAME>    REG_NONE    6A66A2D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\CurrVal
    <NO NAME>    REG_NONE    080000000800002034300E00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\OupdTime
    <NO NAME>    REG_NONE    C4882C55C11EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\CupdTime
    <NO NAME>    REG_NONE    0A679B162D43CF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\CurrVal
    <NO NAME>    REG_NONE    280000002800002074181200B2688C2B4EC1D69B4DBDD3E04899AA2C065117F9A28D75E73CAAC51C61D5DECF864C546AD91FE292

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\OldVal
    <NO NAME>    REG_NONE    2800000028000020DCDC1100B2688C2B4EC1D69B22E936E3952E2055B686019D847C89FCA5F5155A5E22C927359C82D1FB3FFFEE

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\OupdTime
    <NO NAME>    REG_NONE    2C9AA3012B43CF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\CupdTime
    <NO NAME>    REG_NONE    5A0843D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\CurrVal
    <NO NAME>    REG_NONE    0800000008000020C4BB0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\OldVal
    <NO NAME>    REG_NONE    080000000800002034300E00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\OupdTime
    <NO NAME>    REG_NONE    E0D7DA81BD1EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\CupdTime
    <NO NAME>    REG_NONE    9E5055D5C11EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\CurrVal
    <NO NAME>    REG_NONE    38000000380000200C8B0C00A59F8293733109D3F8C3E5BBBE6B2AEB54498AB45AD321D86885AF2C02BD6FB9A6398037DB522FCBE8E2A150562B12615FF8DCA0BEC6A74D

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\OldVal
    <NO NAME>    REG_NONE    38000000380000205C8B0C00A59F8293733109D372E2AED87E18C6D6D50AC29A78BD3CF29A97530738D0556E5B45CDDA451182FC04BCF71C05B883745C7F95529D9E1594

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\OupdTime
    <NO NAME>    REG_NONE    00395474BD1EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\CupdTime
    <NO NAME>    REG_NONE    52ABF3D5C31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\CurrVal
    <NO NAME>    REG_NONE    1800000018000020FCD00D00C4249D72431A6DBD358F210DAAF168C268D8ECDEBBC3AB95

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\OupdTime
    <NO NAME>    REG_NONE    DAC38AD5C31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\CupdTime
    <NO NAME>    REG_NONE    662BC8DBC31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\CurrVal
    <NO NAME>    REG_NONE    8801000088010020BC930C006B8EA361DC9CC9C35039871453B996E43BB66F42848F837DFD98C7564089EA37D26F99CC834EF275B0670B851BD573912EE11D69A5904B72E67223610AB4C015BEB0EB2D553820ED9E440693F323B76AACDCCE05E1AA2BF652CDA9648F76DD39C10B77D921B7E331F921B55D082FA09C8C300275E24201CAC1131F99FF8C77B95C67168B82DEFD30CCAF161DBA5D329919847775F316FAD34E29C7FA0C51CB081F54BE233D955E5ABB6F0A1EF7B1A25CDB53DD2A8001F8BFCA3F90C8BD4354A594379D3E11C92EA9C61A87D7C8D9CC607B8EEE92A85E85AC5481EE35BC6582762B07026B2077C023F08E82DEBFC23F8192BDE33716C19DE4665C96AB967B6D8E0437007954249410248F646BE8EA1E04D6793EACB0A4051178B1F5A0F425B4541408485F53FFDD95A2F3FA0703672D55CE387D40888C3CD3332FC075CCB74F35A6FD56E1958DCBE4DC541DC4B4615B5E6767CA2A1D1304627E0F5FD319415EBAB9DC7D54331B3F0F791EC69DA247D6F5C1BECC835C4316CA7E0F5FD319415EBAB9DC7D54331B3F0F

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\OupdTime
    <NO NAME>    REG_NONE    041A96DBC31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\CupdTime
    <NO NAME>    REG_NONE    60C730285D8BC401

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\CurrVal
    <NO NAME>    REG_NONE    10000000100000200C7C0C0047DE89FC59BF829BF8D6394F7B4399F6

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\OldVal
    <NO NAME>    REG_NONE    100000001000002064810C0047DE89FC59BF829BF8D6394F7B4399F6

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\OupdTime
    <NO NAME>    REG_NONE    60C730285D8BC401

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\CupdTime
    <NO NAME>    REG_NONE    CCCAE2BD426ECF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\CurrVal
    <NO NAME>    REG_NONE    40000000400000205C401800117F8113C84EC4C2531D7F8E3F65C8B95B2E0A6499729C9F75A7B3F3AC99EC632EAA034646231D8833846659762099B465A199C93226CD99C7C7A508D7C546CA

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\OldVal
    <NO NAME>    REG_NONE    40000000400000205C741100117F8113C84EC4C2531D7F8E3F65C8B95B2E0A6499729C9FA781FF0C4807D1913C103B4F75583CC1D1B09D62C0D78C124668D9C2CF81E78CDFD5DC83E1C27528

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\OupdTime
    <NO NAME>    REG_NONE    14289372106ECF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\CupdTime
    <NO NAME>    REG_NONE    A40D9BAABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\CurrVal
    <NO NAME>    REG_NONE    080000000800002074BD0B00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\OldVal
    <NO NAME>    REG_NONE    08000000080000202C550F00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\OupdTime
    <NO NAME>    REG_NONE    BE2451AABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\CupdTime
    <NO NAME>    REG_NONE    04E874AABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\CurrVal
    <NO NAME>    REG_NONE    08000000080000202C550F00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\OldVal
    <NO NAME>    REG_NONE    080000000800002074BD0B00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\OupdTime
    <NO NAME>    REG_NONE    D2C32FAABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\CupdTime
    <NO NAME>    REG_NONE    DE73D420F94ACD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\CurrVal
    <NO NAME>    REG_NONE    48000000480000209466100076A7F833901CD5F0752E3F8623150BBACE958D51E487FCB476CBEC1935B93E6FB9B24618247AC7C5688E29E6516268C030F796E87E23EA82AC6ACA495A81AEBF83D33FA4DA3D85DA

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\OupdTime
    <NO NAME>    REG_NONE    4C75B520F94ACD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\SAC

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

That's all for now, I may come back in a bit to add on anything else.

~~~~~~~~~~~~~~~~~~~

OK, I admit I was curious and tried the reinstall the CD version of FTM 2005 once more.

The result was slightly different, instead of an immediate error message like before, I got a .pdf file of an installation and how-to guide.

When I quit out of it and retried again,later I got the original error message "Access denied".

 

I thought I had something and then "poof".

 

Oh,well.

 

 

 

Vernon


Edited by vhende2000, 12 May 2014 - 11:21 PM.

  • 0

#83
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

Comparing mine to yours you do not have an entry for S-1-5-18 which MS says is "LOCAL_SYSTEM  An account that is used by the operating system."

 

I'm going to send you a zip file in the next post.  Save it, right click on it and extract all.  Then right click on the secmain.reg file and merge.  Then I suppose you should reboot and see if ipsec services is running.


  • 0

#84
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

Here it is


  • 0

#85
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

OK, Ron,

 

Saved the .zip file, unzipped and ran it (merge).  Rebooted.  Everything looks OK to me, the missing line was there.  Checked on IPSEC and could not start it.

Same error message as before.

 

It's being quite stubborn.

 

Vernon


  • 0

Advertisements


#86
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

OK.  Look in regedit under HKEY_USERS.  Do you see

 

S-1-5-18


  • 0

#87
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

Yes, I do have S-1-5-18 under HKEY_USERS with quite a bit of sub-keys.


  • 0

#88
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

OK let's try this again:

 

reg query HKLM\Security /s > \junk.txt

notepad \junk.txt


  • 0

#89
vhende2000

vhende2000

    Member

  • Topic Starter
  • Member
  • PipPip
  • 67 posts

OK, it still comes back with the same error on the first line - "The system was unable to find the specified registry key or value".

 

Junk.txt

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Security

HKEY_LOCAL_MACHINE\Security\Cache
    NL$1    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$Control    REG_BINARY    040001000A000000
    NL$2    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$3    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$4    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$5    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$6    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$7    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$8    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$9    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    NL$10    REG_BINARY    000000000000000000000000000000000000000000000000000000000000000000000000000000000400010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy
    <NO NAME>    REG_SZ    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\ActSysAc
    <NO NAME>    REG_NONE    00000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\Privilgs
    <NO NAME>    REG_NONE    0100000000000000170000000000000003000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-1-0\Sid
    <NO NAME>    REG_NONE    010100000000000100000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-18
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-18\Privilgs
    <NO NAME>    REG_NONE    0100000000000000130000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-18\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-18\Sid
    <NO NAME>    REG_NONE    010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\Privilgs
    <NO NAME>    REG_NONE    0300000000000000150000000000000000000000050000000000000000000000030000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-19\Sid
    <NO NAME>    REG_NONE    010100000000000513000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\ActSysAc
    <NO NAME>    REG_NONE    10000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\Privilgs
    <NO NAME>    REG_NONE    0300000000000000150000000000000000000000050000000000000000000000030000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-20\Sid
    <NO NAME>    REG_NONE    010100000000000514000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\ActSysAc
    <NO NAME>    REG_NONE    C4000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1002\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DEA030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\ActSysAc
    <NO NAME>    REG_NONE    04000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1003\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DEB030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\ActSysAc
    <NO NAME>    REG_NONE    56080000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\Privilgs
    <NO NAME>    REG_NONE    01000000000000001D0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-1005\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DED030000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\ActSysAc
    <NO NAME>    REG_NONE    C3000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-21-650157257-1361277131-1304445921-501\Sid
    <NO NAME>    REG_NONE    010500000000000515000000C99CC026CB702351E143C04DF5010000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\ActSysAc
    <NO NAME>    REG_NONE    10000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32\Sid
    <NO NAME>    REG_NONE    010100000000000520000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\ActSysAc
    <NO NAME>    REG_NONE    01040000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\Privilgs
    <NO NAME>    REG_NONE    14000000000000000800000000000000000000001100000000000000030000001200000000000000000000000C00000000000000000000001300000000000000000000001800000000000000000000000900000000000000000000001400000000000000000000001600000000000000000000000B00000000000000000000000D00000000000000000000000E00000000000000000000000A00000000000000000000000F00000000000000000000000500000000000000000000001700000000000000000000001900000000000000000000001C00000000000000000000001D00000000000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-544\Sid
    <NO NAME>    REG_NONE    01020000000000052000000020020000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\ActSysAc
    <NO NAME>    REG_NONE    03000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\Privilgs
    <NO NAME>    REG_NONE    0300000000000000130000000000000000000000170000000000000000000000190000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-32-545\Sid
    <NO NAME>    REG_NONE    01020000000000052000000021020000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\Privilgs
    <NO NAME>    REG_NONE    01000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-4\Sid
    <NO NAME>    REG_NONE    010100000000000504000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6
    <NO NAME>    REG_BINARY    

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\Privilgs
    <NO NAME>    REG_NONE    02000000000000001D00000000000000000000001E0000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\SecDesc
    <NO NAME>    REG_NONE    01000480480000005800000000000000140000000200340002000000000018000F000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Accounts\S-1-5-6\Sid
    <NO NAME>    REG_NONE    010100000000000506000000

HKEY_LOCAL_MACHINE\Security\Policy\DefQuota
    <NO NAME>    REG_NONE    0000000200001000000001000000000F00000000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\Domains
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmN
    <NO NAME>    REG_NONE    1E00200008000000440041004C0045002D0043004200320039003400460038003300410039000000

HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmS
    <NO NAME>    REG_NONE    010400000000000515000000C99CC026CB702351E143C04D

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtEv
    <NO NAME>    REG_NONE    01FA070003000000030000000000000000000000000000000300000003000000000000000300000009000000

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtFL
    <NO NAME>    REG_NONE    0000

HKEY_LOCAL_MACHINE\Security\Policy\PolAdtLg
    <NO NAME>    REG_NONE    0000000000200000433582000000000000FC070048DD907C566604000000000090FC0700FFFFFFFF

HKEY_LOCAL_MACHINE\Security\Policy\PolDnDDN
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolDnDmG
    <NO NAME>    REG_NONE    00000000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\PolDnTrN
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolMod
    <NO NAME>    REG_NONE    010000000000000090F1A955208BC401

HKEY_LOCAL_MACHINE\Security\Policy\PolPrDmN
    <NO NAME>    REG_NONE    0C000E00080000004D00530048004F004D0045000000

HKEY_LOCAL_MACHINE\Security\Policy\PolPrDmS
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\PolRevision
    <NO NAME>    REG_NONE    07000100

HKEY_LOCAL_MACHINE\Security\Policy\PolSecretEncryptionKey
    <NO NAME>    REG_NONE    0100000001000000000000003104C9ECE3425B8D99A411A22216BE728844FC93444EA0D6FFCD216D4CC0881D4C1C66D98F35674FD6DAB7764D99AF6C1705A11F6D7CCC321524C508D1BF9605

HKEY_LOCAL_MACHINE\Security\Policy\PolState
    <NO NAME>    REG_NONE    00000000

HKEY_LOCAL_MACHINE\Security\Policy\QuAbsMax
    <NO NAME>    REG_NONE    FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\QuAbsMin
    <NO NAME>    REG_NONE    0000010000000100010000000010000000100000000000000000000000000000

HKEY_LOCAL_MACHINE\Security\Policy\SecDesc
    <NO NAME>    REG_NONE    0100048098000000A800000000000000140000000200840006000000010014000008000001010000000000050700000000001800FF1F0F0001020000000000052000000020020000000014000108020001010000000000010000000000001400010800000101000000000005070000000000140000100000010100000000000513000000000014000010000001010000000000051400000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\CupdTime
    <NO NAME>    REG_NONE    5E76F3D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\CurrVal
    <NO NAME>    REG_NONE    28000000280000205C850C00B3695EF779F800547D1806CEE674C370F439193D55A0B48F147E77C56544F0476174B8F16A607A2D

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\OupdTime
    <NO NAME>    REG_NONE    167C77D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantAccount\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\CupdTime
    <NO NAME>    REG_NONE    8E63E0D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\CurrVal
    <NO NAME>    REG_NONE    28000000280000205C850C00B2688C2B4EC1D69B19CBAF16CC5FFBBC2685EEC1B23D9CC89344DF18A09B446EE82E606BC3C057F3

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\OupdTime
    <NO NAME>    REG_NONE    9A538FD2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\0083343a-f925-4ed7-b1d6-d95d17a0b57b-RemoteDesktopHelpAssistantSID\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\CupdTime
    <NO NAME>    REG_NONE    6A66A2D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\CurrVal
    <NO NAME>    REG_NONE    080000000800002034300E00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\OldVal
    <NO NAME>    REG_NONE    08000000080000200CCC0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\OupdTime
    <NO NAME>    REG_NONE    C4882C55C11EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\20ed87e2-3b82-4114-81f9-5e219ed4c481-SALEMHELPACCOUNT\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\CupdTime
    <NO NAME>    REG_NONE    0A679B162D43CF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\CurrVal
    <NO NAME>    REG_NONE    280000002800002074181200B2688C2B4EC1D69B4DBDD3E04899AA2C065117F9A28D75E73CAAC51C61D5DECF864C546AD91FE292

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\OldVal
    <NO NAME>    REG_NONE    2800000028000020DCDC1100B2688C2B4EC1D69B22E936E3952E2055B686019D847C89FCA5F5155A5E22C927359C82D1FB3FFFEE

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\OupdTime
    <NO NAME>    REG_NONE    2C9AA3012B43CF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\aspnet_WP_PASSWORD\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\CupdTime
    <NO NAME>    REG_NONE    5A0843D2C21EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\CurrVal
    <NO NAME>    REG_NONE    0800000008000020C4BB0D00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\OldVal
    <NO NAME>    REG_NONE    080000000800002034300E00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\OupdTime
    <NO NAME>    REG_NONE    E0D7DA81BD1EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\c261dd33-c55b-4a37-924b-746bbf3569ad-RemoteDesktopHelpAssistantEncrypt\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\CupdTime
    <NO NAME>    REG_NONE    9E5055D5C11EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\CurrVal
    <NO NAME>    REG_NONE    38000000380000200C8B0C00A59F8293733109D3F8C3E5BBBE6B2AEB54498AB45AD321D86885AF2C02BD6FB9A6398037DB522FCBE8E2A150562B12615FF8DCA0BEC6A74D

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\OldVal
    <NO NAME>    REG_NONE    38000000380000205C8B0C00A59F8293733109D372E2AED87E18C6D6D50AC29A78BD3CF29A97530738D0556E5B45CDDA451182FC04BCF71C05B883745C7F95529D9E1594

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\OupdTime
    <NO NAME>    REG_NONE    00395474BD1EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\DPAPI_SYSTEM\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\CupdTime
    <NO NAME>    REG_NONE    52ABF3D5C31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\CurrVal
    <NO NAME>    REG_NONE    1800000018000020FCD00D00C4249D72431A6DBD358F210DAAF168C268D8ECDEBBC3AB95

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\OupdTime
    <NO NAME>    REG_NONE    DAC38AD5C31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\G${ED8F4747-E13D-47bc-856B-5CEFE1A81A7F}\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\CupdTime
    <NO NAME>    REG_NONE    662BC8DBC31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\CurrVal
    <NO NAME>    REG_NONE    8801000088010020BC930C006B8EA361DC9CC9C35039871453B996E43BB66F42848F837DFD98C7564089EA37D26F99CC834EF275B0670B851BD573912EE11D69A5904B72E67223610AB4C015BEB0EB2D553820ED9E440693F323B76AACDCCE05E1AA2BF652CDA9648F76DD39C10B77D921B7E331F921B55D082FA09C8C300275E24201CAC1131F99FF8C77B95C67168B82DEFD30CCAF161DBA5D329919847775F316FAD34E29C7FA0C51CB081F54BE233D955E5ABB6F0A1EF7B1A25CDB53DD2A8001F8BFCA3F90C8BD4354A594379D3E11C92EA9C61A87D7C8D9CC607B8EEE92A85E85AC5481EE35BC6582762B07026B2077C023F08E82DEBFC23F8192BDE33716C19DE4665C96AB967B6D8E0437007954249410248F646BE8EA1E04D6793EACB0A4051178B1F5A0F425B4541408485F53FFDD95A2F3FA0703672D55CE387D40888C3CD3332FC075CCB74F35A6FD56E1958DCBE4DC541DC4B4615B5E6767CA2A1D1304627E0F5FD319415EBAB9DC7D54331B3F0F791EC69DA247D6F5C1BECC835C4316CA7E0F5FD319415EBAB9DC7D54331B3F0F

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\OupdTime
    <NO NAME>    REG_NONE    041A96DBC31EC801

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\CupdTime
    <NO NAME>    REG_NONE    60C730285D8BC401

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\CurrVal
    <NO NAME>    REG_NONE    10000000100000200C7C0C0047DE89FC59BF829BF8D6394F7B4399F6

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\OldVal
    <NO NAME>    REG_NONE    100000001000002064810C0047DE89FC59BF829BF8D6394F7B4399F6

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\OupdTime
    <NO NAME>    REG_NONE    60C730285D8BC401

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L$RTMTIMEBOMB_1320153D-8DA3-4e8e-B27B-0D888223A588\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\CupdTime
    <NO NAME>    REG_NONE    50E36FB6AC6ECF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\CurrVal
    <NO NAME>    REG_NONE    400000004000002064D60F00117F8113C84EC4C2531D7F8E3F65C8B95B2E0A6499729C9F75A7B3F3AC99EC63BF850B36CF18636D5D4CEA74A739A7827D933D9F17AA129D4118046EC884FE78

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\OldVal
    <NO NAME>    REG_NONE    400000004000002074C90F00117F8113C84EC4C2531D7F8E3F65C8B95B2E0A6499729C9F75A7B3F3AC99EC632EAA034646231D8833846659762099B465A199C93226CD99C7C7A508D7C546CA

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\OupdTime
    <NO NAME>    REG_NONE    CCCAE2BD426ECF01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\L${6B3E6424-AF3E-4bff-ACB6-DA535F0DDC0A}\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\CupdTime
    <NO NAME>    REG_NONE    A40D9BAABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\CurrVal
    <NO NAME>    REG_NONE    080000000800002074BD0B00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\OldVal
    <NO NAME>    REG_NONE    08000000080000202C550F00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\OupdTime
    <NO NAME>    REG_NONE    BE2451AABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUN\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\CupdTime
    <NO NAME>    REG_NONE    04E874AABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\CurrVal
    <NO NAME>    REG_NONE    08000000080000202C550F00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\OldVal
    <NO NAME>    REG_NONE    080000000800002074BD0B00744D6370E6606E32

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\OupdTime
    <NO NAME>    REG_NONE    D2C32FAABBBECD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\LMIRSCUP\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM
    <NO NAME>    REG_DWORD    0x30000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\CupdTime
    <NO NAME>    REG_NONE    DE73D420F94ACD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\CurrVal
    <NO NAME>    REG_NONE    48000000480000209466100076A7F833901CD5F0752E3F8623150BBACE958D51E487FCB476CBEC1935B93E6FB9B24618247AC7C5688E29E6516268C030F796E87E23EA82AC6ACA495A81AEBF83D33FA4DA3D85DA

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\OldVal
    <NO NAME>    REG_NONE    

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\OupdTime
    <NO NAME>    REG_NONE    4C75B520F94ACD01

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\NL$KM\SecDesc
    <NO NAME>    REG_NONE    010004804800000058000000000000001400000002003400020000000000180003000F0001020000000000052000000020020000000014000000020001010000000000010000000001020000000000052000000020020000010100000000000512000000

HKEY_LOCAL_MACHINE\Security\Policy\Secrets\SAC

 

 

 


  • 0

#90
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,019 posts
  • MVP

There is probably some more hidden registry stuff that we can't see which is why we get the error.

 

Go back into regedit and go to the same HKEY/Security/Policy area and check each entry.  Make sure that it and its subs have Full Control set for Administrator


  • 0






Similar Topics


Also tagged with one or more of these keywords: MBR

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP