Removing access denied error on attempting to open certain filetypes

Question

I've been given a machine with Win XP already on it that has an interesting security feature enabled. Any file called "autorun.inf" cannot be accessed by the user, windows just throws up "Access denied" error instead. I can't even rename files with that name, the only action that succeeds is delete.

I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message.

I really don't want to have to format the machine over a single setting as it has a lot of software on, can anybody help me track down what is blocking access to these files?

Solution 1

Even though it is too late, it might help some one facing the issue.

Q: I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message. Ans: Yes, SEP has been pre-configured to protect the system from Autorun virus by a technique called "Application and Device Control"

So instead of doing CleanWipe, just change the configuration settings.

In case your Symantec Endpoint Protection is unmanaged, Open the client GUI, Go to change settings, scroll down to client management and select configure settings.

Untick the "Enable Application and Device Control" option.

That's it. All your problems are solved.

Note: However if autorun is not so important ensure that you keep the above option checked.

Solution 2

After further investigation it appears CleanWipe did not remove all of Symantec Endpoint Protection. After checking NTFS ACL's and finding nothing I started checking for rootkits and found these two:

SysPlant.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant

wpsdrvnt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPS

These identify themselves as Symantec CMC Firewall SysPlant/Symantec Corporation.

My conclusion is that Symantec is indeed the problem and will not be installed on any of my future machines.

Comments

[mic84]

any type of file-in usb,cd?

[Moab]

Sometimes security software makes registry or file permissions changes, and simply removing the security software will not revert these changes, you would need to use the security software settings to make these changes.

[Ralph]

On switching to the security tab (I don't use simple file sharing) I get "You do not have permission to view the current permission settings for autorun.inf, but you can make permission changes". The group or usernames box is then blank. I add my local user and check full control, apply and I get "Unable to save permission changes on autorun.inf. Access is denied"

[Ralph]

Also this page may be useful for anybody with a similar problem: antirootkit.com/software/index.htm

[Alberto Martinez]

@Ralph Try taking ownership of the file if your user is not the current owner (you can do that in the advanced options of the security tab), since even administrators can't change permissions on files of other users if the permission list doesn't allow that (what differentiate administrators is that they can take ownership of any file, with the exception of some system files).