Restoring SeDebugPrivilege

It is becoming a very common problem these days for malware to change SeDebugPrivilege on administrator type accounts. They do this to prevent you from running various tools to help in the removal of malware. Tools like rootkit detectors and Look2Me-Destroyer commonly make use of this priviledge to help locate and/or remove stubborn malware. If you run a tool and receive a message similar to below (note this is an example for F-Secure's BlackLight Rootkit tool)

F-Secure BlackLight was unable to acquire necessary privileges (SeDebugPrivilege)

it means that the application cannot run and that you must restore the SeDebugPrivilege level on the user account being used. The below steps will do this for you.

• Download SeDebug-Restore
• Save to your desktop and double click to run.