Track down the culprit that resets the system tray customization in Windows 7

Question

The question is duplicated from http://answers.microsoft.com/en-us/windows/forum/windows_7-performance/track-down-the-culprit-that-resets-the-system-tray/7cff4c95-4d08-4a7f-b29d-ce67d8cd6247 as suggested by a support engineer.
Hi Almighty All,
For a while I'm experiencing problems with my system tray. Something regularly resets my customization, i.e. after reboot sometimes all icons that I marked as to show always are hidden again. I found out that the reason is that something erases HCU\Software\Classes\Local
Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify.
I decided to find out what is responsible. I turned on auidt policy for objects, then I setup audit for HCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify. The next time the icons customization was reset I found out
that HCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify was cleared again and on top of that the audit settings were gone! So I thought maybe something just removed the whole key altogether with the audit settings on the
way.
My next attempt was to set audit on HCU\Software\Classes\Local Settings\Software and just let Microsoft\Windows\CurrentVersion\TrayNotify inherit it. The next time the icons customization was reset I found out that HCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
was cleared again and on top of that the audit settings were gone again! Something removed the whole HCU\Software\Classes\Local Settings\Software?
The Event Log points out to one of the svchost.exe processes, which is just a container for the whole bunch of different services.
Any idea how to find out what service is responsible?
Dei nostra Matrix est.

Answer 1

Hi,
Interesting issue, what about other configuration or settings? Do they work fine or keep reverting after a reboot? Have you tested this issue in another user account? What is the result?
Regarding to unable to save settigs for current user hive, I doubt whether there's an application you installed recently or an malware\virus changes the permission of registry entry or value of registry keys like
HKCU\Software\Classes which causes this issue.
Yolanda Zhu
TechNet Community Support
Hmm... I don't understand. Nothing is reverting after a reboot, as well I'm
not unable to save settings in the current user's hive. The correspondent registry keys can be saved perfectly fine and they are
deleted, not reverted after a reboot. I pointed to the exact code that does it, the code is located in Microsoft DLL with all certificates and digital signatures intact. Permissions obviously don't matter, since svchost.exe is executed with the highest
integrity level and under the System user account, the keys in question inherit permissions, which allow System to do whatever it needs without restrictions
by default, you can't change it to allow more.
So can you explain how it can be some malware?
The issue is intermittent, I don't have a 100% repro, therefore “testing” under another user account is doubtful.
Dei nostra Matrix est.