Help! 'Access Denied' on cmd.exe ?

[John W]

OK. Do I have a Virus (even though I have NAV Pro and a
Software firewall running, and I am behind a router)?

I do not know how long this has been a problem, but I
cannot run the XP command prompt (running XP Pro with all
patches). My login ID is an administrator. It has been
at least a few months since I last ran cmd.exe.

When I try to run it today (start -> run -> cmd), I get a
windows box saying I do not have rights (or something like
that).

I seached the drive for other copies of cmd.exe and found
one in the C:\WINDOWS\system32\dllcache directory. I can
run that one fine.

I compared the C:\WINDOWS\system32\dllcache\cmd.exe to
C:\WINDOWS\system32\cmd.exe and they are the same.

C:\WINDOWS\system32\dllcache>fc cmd.exe c:\windows\system32
\cmd.exe
Comparing files cmd.exe and C:\WINDOWS\SYSTEM32\CMD.EXE
FC: no differences encountered

Keeping the cmd session open, this is what happened when I
moved up the directory and try to run the copy of CMD.EXE
in the C:\WINDOWS\system32:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32\dllcache>cd..
C:\WINDOWS\system32>cmd
Access is denied.

How can I fix this problem? Has something hosed my
system authorization system?

Any tips would greatly be appreciated.

Sincerely,

John W

 

[Doug Knox MS-MVP]

See www.dougknox.com, Win XP Utilities, Windows XP Security Console. You can control this restriction, among many others, with this application. Its in the System Security section.

 

[John Ward]

Do anyone have any other ideas? I have tried everything I could find on
the net to fix the problem.

I ran a complete scan with NAV Pro 2003 as well as an online scan with
another Antivirus Vendor.
I ran two spyware removal tools which only found a few cookies that needed
to be removed.
I even tried copying cmd.exe from the dllcache directory to the system32
directory.
I checked the registry values in the
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore
r an made sure DisallowRun was set to 0 if it existed.

The error messages I receive can be viewed here at this URL:
http://www.b4ward.com/help

Help or ideas from anyone would be greatly appreciated!

Sincerely,

John

 

[John]

I wanted to let everyone know that I solved the problem. Unfortunately I
was up until 2:00am last night trying to solve it without success. Today I
came home from work with a fresh mind, and decided to try something I should
have done first. I disabled the firewall and NAV. Bingo, cmd.exe in the
system32 directory works.

Further research directed me to Kerio Personal Firewall, where I found in
the Application Security, System Security settings for cmd.exe, the option
"When this application is starting" was set to Deny. Don't ask me how it
got that way. I changed it to Permit and my problems are gone.

Thanks every for your help.

John