user account admin permissions issue on XP

tvout · 14-01-2012, 14:51

Hi all,
If anyone knows of a fix for this (lighter than an OS reinstall) then I would be really grateful as I've tried loads of things to fix it.
Basically, when loaded into Windows normally, my user account at some point lost the ability to end any process in task manager, it comes up access denied even if it was app I started. I can use process manager fine to the end the processes, as well as killibox but also got an access denied error when using msconfig to load diagnostic startup, it came up at the end saying I needed to make the change under an admin account.
In safe mode I don't have the issue, I can end any process fine under the same user account. I was also able to select diagnostic startup on the admin account and loaded into my user account fine in normal mode but even with diagnostic startup I had the same permissions issues.
I also had a script error when I went into user accounts on the admin account in safe mode and the limited accounts were missing. I had to go to control userpasswords2 to change permissions.
I tried creating a new account with admin permissions but that had exactly the same problem.
Tried also doing sfc /scannow several times and have run loads of different AV scans/malware apps/online scans and can't find anything. I also ran Combifix and still the same.

Any ideas anyone on what could be the issue?

XP SP3 with all latest hotfixes/updates
Comodo Firewall
Avira Free Antivirus (up to date)

Tried running Trend Micro Housecall/Dr Web CureIT/Malwarebytes/Spybot/Bitdefender scans.

Scrubbs · 14-01-2012, 15:08

I know you don't want a complete re-install but... I seem to remember having a "repair" facility with the xp disc running?? that just checks your system for corrupt files and replaces them accordingly?

**Kymmy** · 14-01-2012, 15:14

http://helpdeskgeek.com/how-to/reset...curity-policy/

tvout · 14-01-2012, 21:58

Many thanks both, I tried the command in the link but sadly it didn't work. Tried it under the admin account in safemode and still not working.
I also found another site with a file that can reset all permissions in the registry and files/folders so that administrators and system had full access but that didn't do it either. This was the fix I tried:
http://www.winhelponline.com/blog/re...in-windows-xp/
What I'm curious about is within the registry at the following location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies
I noticed that my (admin) account only had read permissions yet the administrators group had full control. There was also an account called 'Restricted' which also had read access, no idea what that is...
I'm not sure if this is normal or not, possibly the permissions specific to the user account being read only overrides the administrators group having full access?

**Kymmy** · 14-01-2012, 22:07

Last time I saw that was when a friend decided to download some warez and it changed his whole security policies and installed a load of malware.

He was locked out of any admin policies and the quickest way out of the mess was a reinstall (not a repair as that won't change security or group policies..)

tvout · 15-01-2012, 00:31

Thanks Kymmy, I managed to find out what it was in the end:
http://superuser.com/questions/31260...n-task-manager
It was the Comodo Firewall defense+ being hyperactive and seemingly blocking task manager. When I disabled defense+ all worked fine. I worked out it had to be something that wasn't running in safe mode and checked Comodo defense+ before but it said task manager was trusted etc...

**Kymmy** · 15-01-2012, 09:10

I discounted anything external to the OS as you said you'd used the diag startup and would have thought that you would have stopped anything like that

tvout · 15-01-2012, 11:51

Quote:

Originally Posted by Kymmy

I discounted anything external to the OS as you said you'd used the diag startup and would have thought that you would have stopped anything like that

Did seem strange as nothing loaded on startup (nothing in the system tray, no icons etc), it must have been a driver or something for the firewall as even if I exited the Comodo Firewall application altogether it would still give me access denied in task manager.