Hello Team ,

There is a specific key which store root kits or key loggers in registry due to which SEP install rolls back every time , can someone please share that key .

Thanks in advance

There could be many keys which rootkits like to add/alter, not one specific one. Also, the purpose of a rootkit is to hide itself so you may have a tougher time accomplishing this.

You can post the SEP_INST.log file located in %temp% which will show why it is rolling back.

If you think you're infected than try the Power Eraser tool or perhaps some other third party scanner.

There is a specific key i am looking for .

Depending of the type of rootkit/keylogger the reg location may be completely different. I believe there is not a single one specific location that would be "generally known" for all of them. Have a look at some documentation:

https://www-secure.symantec.com/connect/articles/rootkit-intruder-living-your-kernel

https://www-secure.symantec.com/connect/forums/what-are-rootkit-detection-and-removal-capabilities-sep

https://www-secure.symantec.com/connect/articles/introduction-spyware-keyloggers

You don't mean this one, do you?:

Installation fails with the message "Pending system changes that require a reboot have been detected"

i am sorry , i forgot to mention it is not for pending system changes

Hi Swapnil,

Solution

In the registry,

Find

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
value=%APPDATA%

and change it to

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
value=%USERPROFILE%\AppData\Roaming

Install SEP client again.
 

Check this artical

The installation of Symantec Endpoint Protection (SEP) client fails and rolls back around the point of registering with LiveUpdate

https://www-secure.symantec.com/connect/forums/rollback-issue-fix-works-windows-7-sep-1105

Check one of artical

SEP Installation Rollback on Windows 7, Windows Vista, Windows 2008

https://www-secure.symantec.com/connect/articles/sep-installation-rollback-windows-7-windows-vista-windows-2008

thanks all for your help i had to get machine re-imaged.

thank you