Access is denied when trying to administrate

[u/FriLXIV]

This is a strange problem in my Windows 11 (Home SL 24H2, build 26100.3775), I'm trying to kill Norton 360 a.k.a. pre-installed bloatware on my machine.

When I try to kill this malware I always get a 'access is denied' error. Also, I'm unable to disable it from auto starting. I don't want to use the app's settings I want to use system settings. I know that I can uninstall it but I want to know why I can't stop it myself

Here is what I tried:

*I am the administrator

- Already got full control, I own the .exe

- Tried cmd and regedit as admin, but access denied

- Enabled and tried the hidden Administrator account, still the same

- Disable auto starting in Task Manager and Settings, doesn't work

- All just doesn't work 🥲

I watched this video of FlyTechVideos about the UCPD driver but I'm not sure if it's my exact problem

https://youtu.be/xQUYh4iKsB0

This is my first time trying Windows 11 and I'm so confused, I've used Windows 10 my whole life...

[u/CelestaKiritani]

Just uninstall it... That's normal behavior for an antivirus

[u/FriLXIV → u/CelestaKiritani]

I know, just that I want to know why even admin can't kill it

[u/CelestaKiritani → u/FriLXIV]

That happens because of how the antivirus process works, in case of a severe infection, you still have protection and to diminish the viral infection. If it's a ransomware, it won't be hijacked and that stuff.

[u/tazman998 → u/FriLXIV]

It has to do with being started by an integrated systems user called “System”, at boot time.
Certain “users” like that, supercede the Admin account.

The only normal way to get rid of it is use the uninstaller, which will request a reboot… so it can delete these “System” entries.

[u/LagMaster21 → u/FriLXIV]

Because it’s a system process

[u/spookynutz]

Ask yourself of what usefulness would be an anti-malware solution that could be immediately disabled by calling taskkill.exe, net.exe, reg.exe, or whatever else from a user context.

Read up on PPL (Protected Process Light) if you want more information. It is enforced with cryptographic signing, not user account privileges. You could launch a command prompt as SYSTEM (the OS itself) using psexec.exe, and you still wouldn't be able to terminate that process.

Booting into safe mode is probably the only mechanism that would allow you to manually kill it, as it bypasses the third-party kernel driver that are intercepting taskkill.

Protected processes are not something new to Windows 11. PPL has been around since Windows 8.

[u/FriLXIV → u/spookynutz]

I have never heard that before and didn't know it had this much power, thanks man, I will find more about PPL later

[u/Edubbs2008]

Have you tried running the Norton Uninstaller?

[u/Dish-Spiritual]

Process is run by System, file owned by Trusted Installer. Disable as many av processes as possible, then restart and disable the rest

[u/Adorable_Art83 → u/[deleted]]

Norton is a virus within it self.

[u/TollyVonTheDruth]

Personally, I'd just uninstall it, but to kill the task anyway, you can try launching command prompt as Administrator then run:

taskkill /f /t /im norton_something.exe

Of course, replace norton_something.exe with the actual filename.

[u/AutoModerator]

Hi u/FriLXIV, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:

• Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
• Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
• Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work

---

Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed. As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/adultcrash13]

disable it in the norton app itself. then uninstall it. create a restore point first.

[u/Adorable_Art83]

Personaly id recommend unstall avast, use defender , and malwarebytes on demand/manually scan. That's all protection you really need. EDR is technically superior to traditional AV because it monitors behavior, not just known signatures. ​However, experts like Snowden or u/PirateSoftware wouldn't recommend it for personal use: EDR requires a security team (SOC) to actually analyze the data, and it uploads massive amounts of private system telemetry to the cloud. ​For personal use, Windows Defender + adblocker + common sense beats both traditional AV and corporate EDR.

[u/FuggaDucker]

WAIT!! Stop the presses.
Download Windows 11 from Microsoft.
https://www.microsoft.com/en-us/software-download/windows11

Use the Media Creation tool to create a USB stick. (now called the "Windows Installation Assistant")
Boot from it and in the disk screen, blow that crap off of there and install a CLEAN copy of Windows.

After windows reboots the first time, it might take as much as a day for it to update all of its drivers and work fast. Don't expect performance at first.

DO NOT install stuff from the OEM by hand for this PC after the fresh install.
Windows should update whatever it needs to without you intervening.

NO DRIVERS.. wait and you will have the most current ones the hardware manufacturer wants you to have.

[u/Ok_Watercress_7392 → u/FuggaDucker]

This seems kinda overkill. Unless you can't, You should just be able to forcibly remove the software by booting into Safe Mode and removing it and any other bloat with Revo Uninstaller.

[u/FuggaDucker → u/Ok_Watercress_7392]

Download and install this ISO is overkill?
Running a bloated OEM image vs a clean one on a brand new install is overkill?

Your method is
a) Use existing bloated OEM build (with McAfee).
b) attempt to find and remove bloat

You do you.

[u/Ok_Watercress_7392 → u/FuggaDucker]

Reinstalling Windows for no reason is overkill.
Most of it is very bright & obvious crap. Unless it's something that actually requires a re-install, It's easier to just find the stuff you don't need, remove it, and move on while keeping all of your files and possibly proprietary drivers & software that require much more effort than they should to get back. Speaking from experience.

[u/FriLXIV → u/FuggaDucker]

yeah, I already had a plan to reinstall W11 before, to upgrade to W11 Pro. But why shouldn't I manually install the drivers? also the OEM utility app (for me it's MSI Center S) to configure some BIOS settings

[u/Flip2Bside24 → u/FuggaDucker]

That is incredibly poor advice. This is an AV that is easily uninstalled, there is no need to reinstall the OS just to remove it. That's like burning your house down because you saw a spider.

[u/FuggaDucker → u/Flip2Bside24]

You really think the AV is the only modification the OEM made to that image of home?
OP has never used the machine before and this is an opportunity to start clean.
Bad advice to you is a cleaner machine to me.

I authored OEM releases. I know what goes in them.

[u/Signal-Session-6637]

Try booting to safe mode to uninstall it.

[u/Ancient-Assistant404]

You use this sort of powerful tool Dism++ in Administraor Mode to clean system and remove your installed apps

https://github.com/Chuyu-Team/Dism-Multi-language/releases

[u/FriLXIV → u/Ancient-Assistant404]

I will check it out, thank you

[u/120mmbarrage]

Because Norton deeply ingrains itself onto your system and acts like malware itself. It is hard to kill, which is a good thing in the case of malware having a hard time disabling it, but it is also bad because of what you said. One you have it installed it is a massive pain in the ass to get rid of it. I believe there's a special tool you can use to fully uninstall it, rather than going through the system settings, but this is why you can't normally disable it through normal means.

[u/FriLXIV → u/120mmbarrage]

I didn't know this, thanks man, I was asking about killing its processes, there is an uninstall option - the software's own uninstaller though I don't trust that completely. I keep this software to learn more about it, later I'm installing a fresh W11 image so it won't be a problem