App Control policy "AllowMicrosoft_2023-05-04" keeps returning after reboot and disables Microsoft Defender after confirmed Trojan infection

志军 龚 0 Reputation points
2026-09-13T14:06:52+00:00

Hello,

I am using a personal Windows PC, not a company/school-managed device and not intentionally enrolled in Intune/MDM.

I recently discovered what appears to be a serious malware infection with persistence mechanisms. I am trying to determine how to permanently remove a recurring App Control / WDAC policy without unnecessarily reinstalling Windows.

1. Confirmed malware detections

Microsoft Safety Scanner detected and removed:

Trojan:Win64/Dadc.YBD!MTB

360 Security later detected:

Trojan.Downloader.Win32.Agent.HW[Upx]

under a randomly named folder in:

C:\ProgramData\<random>\<random>.exe

360 also detected modifications to the Windows Hosts file that redirected several security/antivirus websites to 127.0.0.1.

2. Suspicious persistence

Autoruns showed multiple unsigned / Not Verified scheduled tasks with random English word names.

One confirmed example:

Powerful Capabilities Objective Business Features

Action:

C:\ProgramData\K2nlzsiW\UiAEfCIH.exe 1776

The process was running as:

C:\ProgramData\K2nlzsiW\UiAEfCIH.exe

Its parent process was:

svchost.exe -k netsvcs -p -s Schedule

I also found a process/startup entry:

C:\Users\Public\uW4l7D\LYInz8.exe

and suspicious Run entries named:

Tencent SecurityHealth

Alibaba SecurityHealtha

Alibaba SecurityHealthb

pointing to randomly named executables under C:\Users\Public and C:\Program Files (x86).

3. Microsoft Defender was disabled

Get-Service WinDefend showed:

Stopped

Get-MpComputerStatus initially showed:

AMServiceEnabled : False

AntivirusEnabled : False

RealTimeProtectionEnabled : False

There was no other registered third-party antivirus at that time.

Service Control Manager Event 7000 reported that Microsoft Defender Antivirus could not start because:

“The application control policy has blocked this file.”

Code Integrity Event 3077 showed that services.exe attempted to load:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MsMpEng.exe

but it was blocked by an Application Control / Code Integrity policy.

I verified the Microsoft Defender executable itself using:

Get-AuthenticodeSignature

and the signature status was Valid, signed by Microsoft Windows Publisher.

4. The recurring App Control policy

CiTool.exe -lp repeatedly shows:

Policy ID: a244370e-44c9-4c06-b551-f6016e563076

Base Policy ID: a244370e-44c9-4c06-b551-f6016e563076

Friendly Name: AllowMicrosoft_2023-05-04

Version: 10.0.5.6

Platform Policy: false

Policy is Signed: false

Has File on Disk: true

Is Currently Enforced: true

Is Authorized: true

Status: 0

I removed it using:

CiTool.exe -rp "{A244370E-44C9-4C06-B551-F6016E563076}"

followed by:

CiTool.exe -r

After removal, the policy disappeared from CiTool -lp, Microsoft Defender successfully started again, and:

AMServiceEnabled : True

AntivirusEnabled : True

RealTimeProtectionEnabled : True

BehaviorMonitorEnabled : True

IsTamperProtected : True

360 Security was also able to launch normally again.

However, after rebooting the computer, the exact same policy returned and became enforced again.

Defender stopped again, and third-party security software was again blocked with the message:

“Your organization used App Control for Business to block this app.”

I repeated the removal and again confirmed that disabling/removing the enforcement allows Defender and 360 to work, but reboot causes the issue to return.

At one point:

CiTool.exe -rp ... -json

returned:

{"OperationResult":-2147024891}

which appears to correspond to 0x80070005 / Access Denied.

Currently, when the policy is not enforced, Microsoft Defender and 360 both work normally.

5. Important context

This is a personal PC.

I have not intentionally configured WDAC/App Control for Business.

I am not knowingly managed by an organization.

The malware behavior I observed — random ProgramData/Public executables, word-salad scheduled task names, Task Scheduler persistence, Defender interference, and malicious Application Control policy behavior — appears very similar to Microsoft’s September 1, 2026 report:

“Counterfeit installers to system compromise: Tracking a deceptive software download campaign.”

My questions are:

  1. What is the correct Microsoft-supported method to determine where this AllowMicrosoft_2023-05-04 policy is being restored from after every reboot?

Should I inspect/remove copies from both:

C:\Windows\System32\CodeIntegrity\CiPolicies\Active

and the EFI System Partition:

EFI\Microsoft\Boot\CiPolicies\Active

as well as SiPolicy.p7b?

Are there any additional locations such as WMI, registry deployment settings, MDM policy stores, EFI variables, or another policy store that could recreate this policy at startup?

Is there a Microsoft-supported way to determine which process/component originally deployed or recreates this policy?

Given the confirmed Trojan detections and the fact that this policy returns after reboot, would Microsoft recommend further remediation, Microsoft Defender Offline, or a full clean installation of Windows?

I would prefer not to reinstall Windows unless necessary, but I also want to make sure the system can be trusted again.

Thank you.Hello,

I am using a personal Windows PC, not a company/school-managed device and not intentionally enrolled in Intune/MDM.

I recently discovered what appears to be a serious malware infection with persistence mechanisms. I am trying to determine how to permanently remove a recurring App Control / WDAC policy without unnecessarily reinstalling Windows.

1. Confirmed malware detections

Microsoft Safety Scanner detected and removed:

Trojan:Win64/Dadc.YBD!MTB

360 Security later detected:

Trojan.Downloader.Win32.Agent.HW[Upx]

under a randomly named folder in:

C:\ProgramData\<random>\<random>.exe

360 also detected modifications to the Windows Hosts file that redirected several security/antivirus websites to 127.0.0.1.

2. Suspicious persistence

Autoruns showed multiple unsigned / Not Verified scheduled tasks with random English word names.

One confirmed example:

Powerful Capabilities Objective Business Features

Action:

C:\ProgramData\K2nlzsiW\UiAEfCIH.exe 1776

The process was running as:

C:\ProgramData\K2nlzsiW\UiAEfCIH.exe

Its parent process was:

svchost.exe -k netsvcs -p -s Schedule

I also found a process/startup entry:

C:\Users\Public\uW4l7D\LYInz8.exe

and suspicious Run entries named:

Tencent SecurityHealth

Alibaba SecurityHealtha

Alibaba SecurityHealthb

pointing to randomly named executables under C:\Users\Public and C:\Program Files (x86).

3. Microsoft Defender was disabled

Get-Service WinDefend showed:

Stopped

Get-MpComputerStatus initially showed:

AMServiceEnabled : False

AntivirusEnabled : False

RealTimeProtectionEnabled : False

There was no other registered third-party antivirus at that time.

Service Control Manager Event 7000 reported that Microsoft Defender Antivirus could not start because:

“The application control policy has blocked this file.”

Code Integrity Event 3077 showed that services.exe attempted to load:

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.3-0\MsMpEng.exe

but it was blocked by an Application Control / Code Integrity policy.

I verified the Microsoft Defender executable itself using:

Get-AuthenticodeSignature

and the signature status was Valid, signed by Microsoft Windows Publisher.

4. The recurring App Control policy

CiTool.exe -lp repeatedly shows:

Policy ID: a244370e-44c9-4c06-b551-f6016e563076

Base Policy ID: a244370e-44c9-4c06-b551-f6016e563076

Friendly Name: AllowMicrosoft_2023-05-04

Version: 10.0.5.6

Platform Policy: false

Policy is Signed: false

Has File on Disk: true

Is Currently Enforced: true

Is Authorized: true

Status: 0

I removed it using:

CiTool.exe -rp "{A244370E-44C9-4C06-B551-F6016E563076}"

followed by:

CiTool.exe -r

After removal, the policy disappeared from CiTool -lp, Microsoft Defender successfully started again, and:

AMServiceEnabled : True

AntivirusEnabled : True

RealTimeProtectionEnabled : True

BehaviorMonitorEnabled : True

IsTamperProtected : True

360 Security was also able to launch normally again.

However, after rebooting the computer, the exact same policy returned and became enforced again.

Defender stopped again, and third-party security software was again blocked with the message:

“Your organization used App Control for Business to block this app.”

I repeated the removal and again confirmed that disabling/removing the enforcement allows Defender and 360 to work, but reboot causes the issue to return.

At one point:

CiTool.exe -rp ... -json

returned:

{"OperationResult":-2147024891}

which appears to correspond to 0x80070005 / Access Denied.

Currently, when the policy is not enforced, Microsoft Defender and 360 both work normally.

5. Important context

This is a personal PC.

I have not intentionally configured WDAC/App Control for Business.

I am not knowingly managed by an organization.

The malware behavior I observed — random ProgramData/Public executables, word-salad scheduled task names, Task Scheduler persistence, Defender interference, and malicious Application Control policy behavior — appears very similar to Microsoft’s September 1, 2026 report:

“Counterfeit installers to system compromise: Tracking a deceptive software download campaign.”

My questions are:

What is the correct Microsoft-supported method to determine where this AllowMicrosoft_2023-05-04 policy is being restored from after every reboot?

Should I inspect/remove copies from both:

C:\Windows\System32\CodeIntegrity\CiPolicies\Active

and the EFI System Partition:

EFI\Microsoft\Boot\CiPolicies\Active

as well as SiPolicy.p7b?

Are there any additional locations such as WMI, registry deployment settings, MDM policy stores, EFI variables, or another policy store that could recreate this policy at startup?

Is there a Microsoft-supported way to determine which process/component originally deployed or recreates this policy?

Given the confirmed Trojan detections and the fact that this policy returns after reboot, would Microsoft recommend further remediation, Microsoft Defender Offline, or a full clean installation of Windows?

I would prefer not to reinstall Windows unless necessary, but I also want to make sure the system can be trusted again.

Thank you.

Windows for home | Windows 11 | Security and privacy
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ramesh Srinivasan 87,350 Reputation points Independent Advisor
    2026-09-13T15:08:52.6266667+00:00

    Hi,

    The Farbar Scanner can be helpful to determine if the system is infected and if policies are configured on the computer. The PowerShell processes may be running as scheduled tasks.

    Please share your Farbar scan logs for analysis.

    • Download Farbar Recovery Scan Tool 64-bit FRST64.exe
    • If the OS language is not English, rename FRST64.exe to FRST64English.exe.
    • Run the program. Don't check or uncheck any options. Click "Scan".
    • Add the two logs, FRST.txt and Addition.txt, to a zip archive.
    • Share the zip file on OneDrive or GoFile.io, and post the link here.

    Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.

    Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as PUPs (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

    Was this answer helpful?

  2. AI answer

    2026-09-13T14:07:44.4066667+00:00

    The Microsoft-supported explanation for a policy that reappears after reboot is that it was not fully removed, the system has not yet completed the required reboot state for removal, or a copy of the policy still exists on disk in the System or EFI partition.

    For the specific policy ID A244370E-44C9-4C06-B551-F6016E563076, Microsoft documents an additional duplicate-policy case: a single-policy format policy with that PolicyId can also exist as both SiPolicy.p7b and {A244370E-44C9-4C06-B551-F6016E563076}.cip in the System and EFI partitions. If either copy remains, the policy can still appear active.

    The supported locations to inspect for removal are:

    1. Multiple-policy format (.cip) locations:
      • <EFI System Partition>\Microsoft\Boot\CiPolicies\Active\*{PolicyId GUID}*.cip
      • <OS Volume>\Windows\System32\CodeIntegrity\CiPolicies\Active\*{PolicyId GUID}*.cip
    2. Single-policy format locations:
      • <EFI System Partition>\Microsoft\Boot\SiPolicy.p7b
      • <OS Volume>\Windows\System32\CodeIntegrity\SiPolicy.p7b

    So yes: for this exact recurring policy ID, Microsoft-supported troubleshooting is to inspect both the Windows partition and the EFI System Partition, and also check for both .cip and SiPolicy.p7b copies.

    Microsoft also states that an unexpected active policy can be caused by:

    • a policy removed without the required reboot completing
    • a policy partially removed, with a copy still in System or EFI
    • incorrect deployment to the device
    • administrator-level tampering

    The provided documentation does not identify any additional supported WDAC/App Control restore locations such as WMI, registry deployment stores, EFI variables, or another hidden policy store. It also does not provide a Microsoft-supported method to identify the exact process that originally deployed or is recreating the policy.

    What is supported for tracing policy source is checking whether policy/settings came from management:

    • If using GPO: run GpResult.exe /h C:\temp\GpResult_output.html from an elevated Command Prompt.
    • If using Intune/MDM: run mdmdiagnosticstool.exe -out "c:\temp\MDMDiagReport.zip" from an elevated Command Prompt.
    • Also determine whether the setting was applied locally during imaging, via PowerShell, WMI, or direct registry modification.

    Since this is a personal PC and not intentionally managed, those checks are useful mainly to rule out accidental management or local deployment artifacts.

    For removal, Microsoft supports either:

    1. Removing the policy with CiTool.exe for unsigned policies on Windows 11 2024 update and later, or
    2. Deleting the policy files from disk using an elevated script, then restarting the computer.

    Important risk: if a policy is causing boot stop failures, Microsoft warns that signed policies are intentionally difficult to remove and tampering with or removing a signed policy can cause a BSOD. In the details provided, the policy is unsigned, which avoids that specific signed-policy removal warning, but deleting policy files from EFI/System partitions is still a high-risk action and should be done carefully.

    Given the confirmed Trojan detections and the fact that malware can reinstall itself after restart, Microsoft recommends running Microsoft Defender Offline when the same malware keeps returning after reboot. The documented path is:

    1. Start > Settings > Update & Security > Windows Security > Virus & threat protection
    2. Under Current threats, select Scan options
    3. Select Windows Defender Offline scan
    4. Select Scan now

    This scan restarts the PC and scans outside Windows to catch hidden threats.

    If malware has caused irreversible changes, Microsoft recommends resetting the PC and restoring data from clean backups. That is the Microsoft-supported escalation path in the provided material when trust in the system is no longer reliable.

    Practical Microsoft-supported sequence for this case:

    1. Run Microsoft Defender Offline.
    2. After the scan, inspect both App Control storage locations on the OS volume and EFI partition for *.cip matching A244370E-44C9-4C06-B551-F6016E563076.
    3. Also check for SiPolicy.p7b in both documented locations because this exact PolicyId is called out as a duplicate-policy case.
    4. Remove remaining policy file copies using an elevated script or supported removal method.
    5. Restart the computer.
    6. If the policy still returns, collect GPO/MDM diagnostics to rule out management-based redeployment.
    7. If malware persistence continues or Windows security components remain untrustworthy, move to reset/reinstall from clean backup.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.