System Preferences is trying to modify system settings

You've installed some kind of "anti-virus" crapware.

Please read this whole message before doing anything.

This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find nothing has changed after you complete it.

Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software -- potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions -- they’re easy to carry out and won’t change anything on your Mac.

These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.

Below are four lines of text in monospaced type, which are actually shell commands -- little programs. They’re harmless, but they must be used exactly as given in order to work.

First and most important, don’t run these commands until you have verified that they’re legitimate. Never execute shell commands from an untrusted source without knowing what they do, or at least that they don’t do anything harmful. I’ve posted these same commands, with minor variations, many times on this site. You should be able to find other discussions in which they were used without ill effects. Do that before proceeding.

Some of the commands will probably line-wrap in your browser, but each one is really just a single long line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then either copy or drag it. The headings “Step 1” and so on are not part of the commands.

To begin, launch the Terminal application; e.g., by entering the first few letters of its name in a Spotlight search.

Step 1

Copy or drag -- do not type -- the line below into the Terminal window, then press return:

kextstat -kl | awk ' !/apple/ { print $6 $7 } '

Post the lines of output (if any) that appear below what you just entered (the text, please, not a screenshot.)

Step 2

Repeat with this line:

sudo launchctl list | sed 1d | awk ' !/0x|apple|com\.vix|edu\.|org\./ { print $3 } '

This time, you'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. You don't need to post the warning.

Step 3

launchctl list | sed 1d | awk ' !/0x|apple|edu\.|org\./ { print $3 } '

Step 4

ls -1A {,/}Library/{Ad,Compon,Ex,Fram,In,La,Mail/**,P*P,Priv,Qu,Scripti,Servi,Sta}* 2> /dev/null

Important: If you synchronize with a MobileMe account, your me.com email address will appear in the output of the above command. Change it to something like “user@me.com” before posting.

Remember, this is all drag-and-drop or copy-and-paste, whichever you prefer -- no typing, except your password.

You can then quit Terminal.

Simple things you can try:

1. remove the file "com.apple.systempreferences.plist" from the preferences folder in your user library. get to the library by pressing the Option key and select "Library" from the Finder's "Go" menu.
2. create a new admin account to see if the problem occurs in that one
3. Change your user account's password temporarily to see if that spurs a change

This behavior is not indicative of any antivirus or security software being on the system. However, it does raise suspicion of corruption in the system directory, or in the system preferences (perhaps in the preferences for it).

You can definitely try that. This will create a new directory node entry which should be free of corruption and should be placed in the appropriate system groups (ie, admin for administrators). If the problem is in your current account's configuration then this should show a difference in behavior.

That's step 1. What about steps 2-4?