Author Topic: User Rights  (Read 9404 times)

0 Members and 1 Guest are viewing this topic.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: User Rights
« Reply #30 on: April 18, 2008, 09:23:10 AM »
The registry is subject to additions and deletions all the time this person is running. 

This is 56M not 200M. I would also ask the original poster to confirm that this is the size of the SYSTEM file and not the SOFTWARE file. 
« Last Edit: April 18, 2008, 09:25:45 AM by alanrf »

Offline psw

  • Sr. Member
  • ****
  • Posts: 286
Re: User Rights
« Reply #31 on: April 18, 2008, 09:32:43 AM »
Microsoft Windows Internals, Fourth Edition
Quote
In some cases, hive sizes are limited. For example, Windows places a limit on the size of the HKLM\SYSTEM hive. It does so because Ntldr reads the entire HKLM\SYSTEM hive into physical memory near the start of the boot process when virtual memory paging is not enabled. Ntldr also loads Ntoskrnl and boot device drivers into physical memory, so it must constrain the amount of physical memory assigned to HKLM\SYSTEM. (See Chapter 6 for more information on the role Ntldr plays during the startup process.) On Windows 2000, Ntldr places a fixed upper limit on its size of 12 MB, but on Windows XP and Windows Server 2003 it is more flexible, allowing the hive to be up to 200 MB or one fourth the amount of physical memory on the system, whichever is lower.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: User Rights
« Reply #32 on: April 18, 2008, 09:42:14 AM »
Then I think you may have cracked it.

If her SYSTEM file really is 56M then it just exceeds the capacity of one quarter of the system memory (reported by avast as 223.34M  - a rather odd number).

So finding the space hog in that hive appears to be essential.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11678
    • AVAST Software
Re: User Rights
« Reply #33 on: April 18, 2008, 10:16:10 AM »
That's what I was saying here: :-)
http://forum.avast.com/index.php?topic=34759.msg292141#msg292141

I don't think the inability to create the key can be caused by other protection tools... I mean, it could be, but I'd expect a different error (ACCESS_DENIED, maybe SHARING_VIOLATION... but not NO_SYSTEM_RECOURCES, it's weird).

MS docs also mentions this:
Quote
A single registry key can be opened only 65534 times. When attempting the 65535th open operation, this function [RegCreateKeyEx] fails with ERROR_NO_SYSTEM_RESOURCES.

As I wrote in other post too, it might be possible to check by Process Explorer (looking for handles to Services key) - but I don't think this is the problem, I think it's more likely to be related to the hive size.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: User Rights
« Reply #34 on: April 18, 2008, 10:19:34 AM »
You are right Igor, it was foolish of me to expect MS documentation to be consistent ... "we have removed registry size limits in XP" .. well apart from these important limitations in the very small print.

Offline ymryan

  • Jr. Member
  • **
  • Posts: 28
Re: User Rights
« Reply #35 on: April 18, 2008, 11:45:02 PM »
So, what is my next step?

Thanks for all your help!

Offline ymryan

  • Jr. Member
  • **
  • Posts: 28
Re: User Rights
« Reply #36 on: April 22, 2008, 02:26:29 AM »
Hi There, I am now getting bombarded with JUNK! Do I really have no resolution to this?

Yvonne

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11678
    • AVAST Software
Re: User Rights
« Reply #37 on: April 22, 2008, 12:06:38 PM »
If the registry key cannot be created in the Services tree (btw, you didn't write if you're able to create it manually from regedit or not) - and if the registry compacting didn't help (=shrink the hive size), then I really don't know what to suggest (except for reinstalling the OS).

You may try to export the registry (HKEY_LOCAL_MACHINE\System) to a .reg file and then try to find what uses so much space there... but if the hive is corrupted internally, it doesn't have to be included in the exported file. And, even if you find a big subtree and even if it could be deleted - there's no guarantee than the hive could be compacted later. :(

Btw, I don't think this problem affects avast! only - I'd expect other programs couldn't be installed as well (at least those installing some services).