Removing access denied error on attempting to open certain filetypes

Question

I've been given a machine with Win XP already on it that has an interesting security feature enabled. Any file called "autorun.inf" cannot be accessed by the user, windows just throws up "Access denied" error instead. I can't even rename files with that name, the only action that succeeds is delete.

I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message.

I really don't want to have to format the machine over a single setting as it has a lot of software on, can anybody help me track down what is blocking access to these files?

Answer 1

After further investigation it appears CleanWipe did not remove all of Symantec Endpoint Protection. After checking NTFS ACL's and finding nothing I started checking for rootkits and found these two:

SysPlant.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant

wpsdrvnt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPS

These identify themselves as Symantec CMC Firewall SysPlant/Symantec Corporation.

My conclusion is that Symantec is indeed the problem and will not be installed on any of my future machines.

Answer 2

Even though it is too late, it might help some one facing the issue.

Q: I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message. Ans: Yes, SEP has been pre-configured to protect the system from Autorun virus by a technique called "Application and Device Control"

So instead of doing CleanWipe, just change the configuration settings.

In case your Symantec Endpoint Protection is unmanaged, Open the client GUI, Go to change settings, scroll down to client management and select configure settings.

Untick the "Enable Application and Device Control" option.

That's it. All your problems are solved.

Note: However if autorun is not so important ensure that you keep the above option checked.

Answer 3

The NTFS file system, which is the default for internal harddrives and external harddrives bigger than 32GB, allows setting permissions on each folder and file. Probably the security app removed the permissions for that files.

Right click in one of those files to get their properties and go to the Security tab, the Administrator group or your user must have read and write permissions (or full control) in order to delete the file.

If the security tab is missing you need to take additional steps depending on your edition of XP:

• For XP Professional open Windows Explorer and go to Tools > Folder options, and the View tab uncheck Use simple file sharing (Recommended). The security tab will now appear for all files and folders of NTFS harddrives.

• If your XP is a Home edition then that option is not available, you have to boot in Safe Mode or use the calcs command line utility:

  XP Home advanced file permissions