Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been given a machine with Win XP already on it that has an interesting security feature enabled. Any file called "autorun.inf" cannot be accessed by the user, windows just throws up "Access denied" error instead. I can't even rename files with that name, the only action that succeeds is delete.

I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message.

I really don't want to have to format the machine over a single setting as it has a lot of software on, can anybody help me track down what is blocking access to these files?

share|improve this question
    
any type of file-in usb,cd? –  mic84 Nov 13 '10 at 16:18
    
Sometimes security software makes registry or file permissions changes, and simply removing the security software will not revert these changes, you would need to use the security software settings to make these changes. –  Moab Nov 13 '10 at 17:04
add comment

3 Answers 3

After further investigation it appears CleanWipe did not remove all of Symantec Endpoint Protection. After checking NTFS ACL's and finding nothing I started checking for rootkits and found these two:

SysPlant.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysPlant

wpsdrvnt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPS

These identify themselves as Symantec CMC Firewall SysPlant/Symantec Corporation.

My conclusion is that Symantec is indeed the problem and will not be installed on any of my future machines.

share|improve this answer
    
Also this page may be useful for anybody with a similar problem: antirootkit.com/software/index.htm –  Ralph Nov 18 '10 at 7:57
add comment

Even though it is too late, it might help some one facing the issue.

Q: I thought this might be due to Symantec Endpoint Protection which had been installed on the machine, however after removing this with CleanWipe I still get the same access denied message. Ans: Yes, SEP has been pre-configured to protect the system from Autorun virus by a technique called "Application and Device Control"

So instead of doing CleanWipe, just change the configuration settings.

In case your Symantec Endpoint Protection is unmanaged, Open the client GUI, Go to change settings, scroll down to client management and select configure settings.

Untick the "Enable Application and Device Control" option.

That's it. All your problems are solved.

Note: However if autorun is not so important ensure that you keep the above option checked.

share|improve this answer
add comment

The NTFS file system, which is the default for internal harddrives and external harddrives bigger than 32GB, allows setting permissions on each folder and file. Probably the security app removed the permissions for that files.

Right click in one of those files to get their properties and go to the Security tab, the Administrator group or your user must have read and write permissions (or full control) in order to delete the file.

If the security tab is missing you need to take additional steps depending on your edition of XP:

  • For XP Professional open Windows Explorer and go to Tools > Folder options, and the View tab uncheck Use simple file sharing (Recommended). The security tab will now appear for all files and folders of NTFS harddrives.

  • If your XP is a Home edition then that option is not available, you have to boot in Safe Mode or use the calcs command line utility:

    XP Home advanced file permissions

share|improve this answer
    
On switching to the security tab (I don't use simple file sharing) I get "You do not have permission to view the current permission settings for autorun.inf, but you can make permission changes". The group or usernames box is then blank. I add my local user and check full control, apply and I get "Unable to save permission changes on autorun.inf. Access is denied" –  Ralph Nov 18 '10 at 5:32
    
@Ralph Try taking ownership of the file if your user is not the current owner (you can do that in the advanced options of the security tab), since even administrators can't change permissions on files of other users if the permission list doesn't allow that (what differentiate administrators is that they can take ownership of any file, with the exception of some system files). –  Alberto Martinez Nov 18 '10 at 15:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.