1

I am trying to change the startup type (from auto to disabled) of a Windows service (happens to be the ZoneAlarm vsmon service) on Windows 7. The program sets permissions on the service such that only the SYSTEM account can make changes.

enter image description here

When I am running as administrator-equivalent for example, the following sc.exe command

sc config vsmon start= disabled

gives a permissions error. To work around this I launched a command prompt as the SYSTEM user using the psexec utility.

psexec -i -s -d cmd.exe

then I confirmed I was indeed running as SYSTEM:

whoami

which outputted:

nt authority\system

but I got the same permissions error.

Next I ran regedit from that same SYSTEM command prompt and verified that it was indeed running as SYSTEM:

enter image description here

Navigated to the service's key at HKLM\System\CurrentControlSet\Services\vsmon and tried to change the startup type value manually but again got a permissions error:

enter image description here

Finally as a test I added Everyone with Full Control but got the same error.

What gives?

| |
3

I do not know for sure if Zone Alarm does this but I do know that ESET will install kernal mode drivers that monitor all I/O activity and prevent its own active monitoring system from being disabled (Remember, if it was easy for you to disable it then it would be easy for malware to disable it too). That kernal mode driver could be monitoring writes to the system registry and intercepting and blocking them, even if they came from the SYSTEM user.

Usually your only two options is disable the active monitoring through the GUI of Zone Alarm which wont stop the service but may speed things up (if that is why you are tying to disable the service), or uninstall the program completely.

| |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.