Strange access demied problem

[Jes]

Hi,
I have a very odd problem, I have only seen on my
computer.

I have serched the knowledgebase to find similiar but non-
applicable solutions.

I use XP pro and my normal logon has full admin
priveleges. I am the only user of the computer.

When I click on the time in the system tray or when I
click on an item in control panel and in various other
places I receive the following alert, warning or error:

"Windows cannot access the specified device, path or
file. You may not have the appropriate permissions to
acsess the item"

Not so odd you say.
Ok, well this first happened when I was still an XP pro
novice over a year ago. I did a restore and all was well.

Well over the past few months and almost continuously
over the las two weeks I have had to perform restores to
regain my permissions.

I'll do a restore, clean up the registry, defrag, kill
the temp files, do a virus scan and spware scan, etc,
then reboot and check i still have permission, then make
a new restore point. as little as Hours later, sometimes
even without a reboot, I lose these permissions again.

Now instead of restoring, I have gone into safe mode as
admin and looked up my permissions for that account and
they all say I have full administrative priveliges.

I have changed to more limited permissions, rebooted,
changed back to full priveleges, all to no avail.
Only a restore gets me back.

There are KB articles that address similiar issues, such
as what to do when one does not have permissions and one
which states the permission does not derive just from
being an admin.

Article Q323309 in the KB states:
"SYMPTOMS
When your Windows XP Professional-based computer is
configured as a stand-alone computer or a workgroup
computer, effective permissions may not be correctly
displayed for user accounts. This problem may occur even
when security is correctly applied. Specifically, the
Windows XP Professional security configuration user
interface (UI) may indicate that users do not have
permissions to access a file or folder, even if their
user accounts are included in groups that are explicitly
or indirectly granted access. "

Though I do have a standalone and I di have simple file
sharing turned off, this has little bearing as my problem
is simply that I have but suddenly lose permissions.

Any help is greatly appreciated.

P.s. I have a firewall and i have all my win updates.
Persistence of problem has been independent of any
updates. It's happening too often argggg.

Aloha
Jes

 

[Shain Wray [MSFT]]

Hello Jes,

Just so I am clear, after the problem starts to happen if you go into Safe
Mode the problem also happens there?

The following may be reasons why this is occuring -

1. Rundll32.exe has been corrupted, what happens if you just restore this
file?

2. It could be due to the w32.yaha.k@mm worm. There are other variants of
it, but they
all do just about the same thing.

Information on removing and about this virus can be found at
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

There are steps listed here on how to remove the virus.

Let me know if this helps.

Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!

 

[Guest]

updated:

-----Original Message-----
Hello Jes,

Just so I am clear, after the problem starts to happen if you go into Safe
Mode the problem also happens there?

No it works in safe mode.
However I have now logged on as admin in normal mode and
I receiev the same error.
I will try the rundll32.exe restore but I am worried it
may be an older file.
what the hell I'll make a backup of the current.
I will fill you in on wether this works.

I searched for the virus in my registry and systemdir to
no avail, so I expect my virus scanner was correct to
state 'no viruses' to begin with.

I would never open an .exe, .com whatnot from an email, I
have been using the internet since 1994.

Thanks I'll be back.

 

[Shain Wray [MSFT]]

Hello Jes,

Okay, if the problem does not happen in Safe Mode it is not likely a
problem with the file being registered. Please use the following steps to
narrow down what process on yous system is causing the problem -

A) Go to Start\Run and type
MSCONFIG <OK>
B) In MSConfig, choose "Selective Startup"
C) Remove all check boxes and click "OK" and "Yes" to reboot.
Then test our issue.
D) If you don't see the problem at this point, check all except "System
Services" and "Startup Items", click "OK" and "Yes".
Reboot then test our issue.
E) If you don't see the problem at this point, check all except "System
Services", click "OK" and "Yes".
Reboot and then test our issue.
F) If the problem returns, it is due to a Startup Item. If not, it is a
Service.
For Services:
G) Click the Services tab and check the box for "Hide all Microsoft
Services."
H) Enable SOME of the disabled items, click "OK" and "Yes".
Reboot, then test our issue.
For Startup Items:
I) Click the Startup tab and enable SOME of the disabled items, click "OK"
and "Yes".
Reboot, then test our issue.
J) Repeat until you track down the offending component.

Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!