Operation has been cancelled due to restrictions in effect.....

[Guest TonyFrim]

I have a computer with XP Home. It was infected by a virus (despite having

the McAfee Security suite).

I have replaced the McAfee with Kaspersky and successfully removed the virus.

 

However, my Control Panel icon has disappeared and whenever I try to access

Add/Remove Programs from other menus I get the error Operation has been

cancelled due to restrictions in effect on this computer. Please contact your

system administrator.

 

I am also unable to access Properties on My Computer and Windows Update fails.

 

I can access Regedit. Ihave already checked the Policy section of the

registry and cannot find anything amiss.

(HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

 

I have Administrative rights.

 

In safe mode everything has returned to normal when I login as Administrator.

[Guest Detlev Dreyer]

Re: Operation has been cancelled due to restrictions in effect.....

 

"TonyFrim" <TonyFrim@discussions.microsoft.com> wrote:

> I have a computer with XP Home. It was infected by a virus (despite

> having the McAfee Security suite).

> I have replaced the McAfee with Kaspersky and successfully removed the

> virus.

 

No, you didn't.

> However, my Control Panel icon has disappeared and whenever I try to

 

"Cleaning a Compromised System"

http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

 

--

d-d

[Guest PA Bear]

Re: Operation has been cancelled due to restrictions in effect.....

 

Unexplained computer behavior may be caused by deceptive software

http://support.microsoft.com/kb/827315

 

Run a /thorough/ check for hijackware, including posting your hijackthis log

to an appropriate forum.

 

Checking for/Help with Hijackware

http://aumha.org/a/parasite.htm

http://aumha.org/a/quickfix.htm

http://aumha.net/viewtopic.php?t=5878

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://mvps.org/winhelp2002/unwanted.htm

http://inetexplorer.mvps.org/data/prevention.htm

http://inetexplorer.mvps.org/tshoot.html

http://www.mvps.org/sramesh2k/Malware_Defence.htm

http://defendingyourmachine2.blogspot.com/

http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

When all else fails, HijackThis v2.0.2

(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.

It will help you to both identify and remove any hijackware/spyware with

assistance from an expert. **Post your log to

http://forums.spybot.info/forumdisplay.php?f=22,

http://castlecops.com/forum67.html,

http://forums.subratam.org/index.php?showforum=7,

http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert

analysis, not here.**

 

If the procedures look too complex - and there is no shame in admitting this

isn't your cup of tea - take the machine to a local, reputable and

independent (i.e., not BigBoxStoreUSA) computer repair shop.

--

~Robear Dyer (PA Bear)

MS MVP-Windows (IE, OE, Security, Shell/User)

AumHa VSOP & Admin http://aumha.net

DTS-L http://dts-l.net/

 

TonyFrim wrote:

> I have a computer with XP Home. It was infected by a virus (despite

> having

> the McAfee Security suite).

> I have replaced the McAfee with Kaspersky and successfully removed the

> virus.

>

> However, my Control Panel icon has disappeared and whenever I try to

> access

> Add/Remove Programs from other menus I get the error Operation has been

> cancelled due to restrictions in effect on this computer. Please contact

> your system administrator.

>

> I am also unable to access Properties on My Computer and Windows Update

> fails.

>

> I can access Regedit. Ihave already checked the Policy section of the

> registry and cannot find anything amiss.

> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

>

> I have Administrative rights.

>

> In safe mode everything has returned to normal when I login as

> Administrator.

[Guest TonyFrim]

Re: Operation has been cancelled due to restrictions in effect....

 

Re: Operation has been cancelled due to restrictions in effect....

 

Thanks. I had already tried this and found one instance of winter.exe still

lurking.

I am reasonably sure that I have now eliminated the original virus but would

like to allow Control Panel and Add/Remove programs to be operable from the

main user.

 

These do work in Safe Mode as Administartor, but not as the user. Will a

Windows Repair do the trick, or does it retain the existing (missing)

registry entries? Are there any registry keys I can look for that are in

other sections of the registry?

 

I'm getting desperate!!!!

 

Thanks

 

 

"PA Bear" wrote:

> Unexplained computer behavior may be caused by deceptive software

> http://support.microsoft.com/kb/827315

>

> Run a /thorough/ check for hijackware, including posting your hijackthis log

> to an appropriate forum.

>

> Checking for/Help with Hijackware

> http://aumha.org/a/parasite.htm

> http://aumha.org/a/quickfix.htm

> http://aumha.net/viewtopic.php?t=5878

> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

> http://mvps.org/winhelp2002/unwanted.htm

> http://inetexplorer.mvps.org/data/prevention.htm

> http://inetexplorer.mvps.org/tshoot.html

> http://www.mvps.org/sramesh2k/Malware_Defence.htm

> http://defendingyourmachine2.blogspot.com/

> http://www.elephantboycomputers.com/page2.html#Removing_Malware

>

> When all else fails, HijackThis v2.0.2

> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.

> It will help you to both identify and remove any hijackware/spyware with

> assistance from an expert. **Post your log to

> http://forums.spybot.info/forumdisplay.php?f=22,

> http://castlecops.com/forum67.html,

> http://forums.subratam.org/index.php?showforum=7,

> http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert

> analysis, not here.**

>

> If the procedures look too complex - and there is no shame in admitting this

> isn't your cup of tea - take the machine to a local, reputable and

> independent (i.e., not BigBoxStoreUSA) computer repair shop.

> --

> ~Robear Dyer (PA Bear)

> MS MVP-Windows (IE, OE, Security, Shell/User)

> AumHa VSOP & Admin http://aumha.net

> DTS-L http://dts-l.net/

>

> TonyFrim wrote:

> > I have a computer with XP Home. It was infected by a virus (despite

> > having

> > the McAfee Security suite).

> > I have replaced the McAfee with Kaspersky and successfully removed the

> > virus.

> >

> > However, my Control Panel icon has disappeared and whenever I try to

> > access

> > Add/Remove Programs from other menus I get the error Operation has been

> > cancelled due to restrictions in effect on this computer. Please contact

> > your system administrator.

> >

> > I am also unable to access Properties on My Computer and Windows Update

> > fails.

> >

> > I can access Regedit. Ihave already checked the Policy section of the

> > registry and cannot find anything amiss.

> > (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

> >

> > I have Administrative rights.

> >

> > In safe mode everything has returned to normal when I login as

> > Administrator.

>

>

[Guest PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

 

Re: Operation has been cancelled due to restrictions in effect....

 

Please post a link to the forum thread where you've posted your HijackThis

log for review.

 

A Repair Install will /not/ help; a format & reinstall should.

--

~Robear Dyer (PA Bear)

MS MVP-Windows (IE, OE, Security, Shell/User)

AumHa VSOP & Admin http://aumha.net

DTS-L http://dts-l.net/

 

 

TonyFrim wrote:

> Thanks. I had already tried this and found one instance of winter.exe

> still

> lurking.

> I am reasonably sure that I have now eliminated the original virus but

> would

> like to allow Control Panel and Add/Remove programs to be operable from

> the

> main user.

>

> These do work in Safe Mode as Administartor, but not as the user. Will a

> Windows Repair do the trick, or does it retain the existing (missing)

> registry entries? Are there any registry keys I can look for that are in

> other sections of the registry?

>

> I'm getting desperate!!!!

>

> Thanks

>

> "PA Bear" wrote:

>

>> Unexplained computer behavior may be caused by deceptive software

>> http://support.microsoft.com/kb/827315

>>

>> Run a /thorough/ check for hijackware, including posting your hijackthis

>> log to an appropriate forum.

>>

>> Checking for/Help with Hijackware

>> http://aumha.org/a/parasite.htm

>> http://aumha.org/a/quickfix.htm

>> http://aumha.net/viewtopic.php?t=5878

>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

>> http://mvps.org/winhelp2002/unwanted.htm

>> http://inetexplorer.mvps.org/data/prevention.htm

>> http://inetexplorer.mvps.org/tshoot.html

>> http://www.mvps.org/sramesh2k/Malware_Defence.htm

>> http://defendingyourmachine2.blogspot.com/

>> http://www.elephantboycomputers.com/page2.html#Removing_Malware

>>

>> When all else fails, HijackThis v2.0.2

>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.

>> It will help you to both identify and remove any hijackware/spyware with

>> assistance from an expert. **Post your log to

>> http://forums.spybot.info/forumdisplay.php?f=22,

>> http://castlecops.com/forum67.html,

>> http://forums.subratam.org/index.php?showforum=7,

>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

>> expert

>> analysis, not here.**

>>

>> If the procedures look too complex - and there is no shame in admitting

>> this isn't your cup of tea - take the machine to a local, reputable and

>> independent (i.e., not BigBoxStoreUSA) computer repair shop.

>> --

>> ~Robear Dyer (PA Bear)

>> MS MVP-Windows (IE, OE, Security, Shell/User)

>> AumHa VSOP & Admin http://aumha.net

>> DTS-L http://dts-l.net/

>>

>> TonyFrim wrote:

>>> I have a computer with XP Home. It was infected by a virus (despite

>>> having

>>> the McAfee Security suite).

>>> I have replaced the McAfee with Kaspersky and successfully removed the

>>> virus.

>>>

>>> However, my Control Panel icon has disappeared and whenever I try to

>>> access

>>> Add/Remove Programs from other menus I get the error Operation has been

>>> cancelled due to restrictions in effect on this computer. Please contact

>>> your system administrator.

>>>

>>> I am also unable to access Properties on My Computer and Windows Update

>>> fails.

>>>

>>> I can access Regedit. Ihave already checked the Policy section of the

>>> registry and cannot find anything amiss.

>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

>>>

>>> I have Administrative rights.

>>>

>>> In safe mode everything has returned to normal when I login as

>>> Administrator.

[Guest TonyFrim]

Re: Operation has been cancelled due to restrictions in effect....

 

Re: Operation has been cancelled due to restrictions in effect....

 

I have since done a meticulous scan through the HKCU section and found an

entry that disabled Control Panel.

After deleting this my Control Panel has reappeared and I no longer get the

above messages.

I don't know why HiJackThis didn't pick it up!

 

I still have one issue remaining. When I try to do a Windows Update I get

an error 0x8ddd0003

Since this is XP Home I don't know where to look since as far as I am aware

there are no Network Policy Settings to play with.

 

Perhaps you have an idea?

 

Many thanks

 

Tony

 

"PA Bear" wrote:

> Please post a link to the forum thread where you've posted your HijackThis

> log for review.

>

> A Repair Install will /not/ help; a format & reinstall should.

> --

> ~Robear Dyer (PA Bear)

> MS MVP-Windows (IE, OE, Security, Shell/User)

> AumHa VSOP & Admin http://aumha.net

> DTS-L http://dts-l.net/

>

>

> TonyFrim wrote:

> > Thanks. I had already tried this and found one instance of winter.exe

> > still

> > lurking.

> > I am reasonably sure that I have now eliminated the original virus but

> > would

> > like to allow Control Panel and Add/Remove programs to be operable from

> > the

> > main user.

> >

> > These do work in Safe Mode as Administartor, but not as the user. Will a

> > Windows Repair do the trick, or does it retain the existing (missing)

> > registry entries? Are there any registry keys I can look for that are in

> > other sections of the registry?

> >

> > I'm getting desperate!!!!

> >

> > Thanks

> >

> > "PA Bear" wrote:

> >

> >> Unexplained computer behavior may be caused by deceptive software

> >> http://support.microsoft.com/kb/827315

> >>

> >> Run a /thorough/ check for hijackware, including posting your hijackthis

> >> log to an appropriate forum.

> >>

> >> Checking for/Help with Hijackware

> >> http://aumha.org/a/parasite.htm

> >> http://aumha.org/a/quickfix.htm

> >> http://aumha.net/viewtopic.php?t=5878

> >> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

> >> http://mvps.org/winhelp2002/unwanted.htm

> >> http://inetexplorer.mvps.org/data/prevention.htm

> >> http://inetexplorer.mvps.org/tshoot.html

> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm

> >> http://defendingyourmachine2.blogspot.com/

> >> http://www.elephantboycomputers.com/page2.html#Removing_Malware

> >>

> >> When all else fails, HijackThis v2.0.2

> >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.

> >> It will help you to both identify and remove any hijackware/spyware with

> >> assistance from an expert. **Post your log to

> >> http://forums.spybot.info/forumdisplay.php?f=22,

> >> http://castlecops.com/forum67.html,

> >> http://forums.subratam.org/index.php?showforum=7,

> >> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

> >> expert

> >> analysis, not here.**

> >>

> >> If the procedures look too complex - and there is no shame in admitting

> >> this isn't your cup of tea - take the machine to a local, reputable and

> >> independent (i.e., not BigBoxStoreUSA) computer repair shop.

> >> --

> >> ~Robear Dyer (PA Bear)

> >> MS MVP-Windows (IE, OE, Security, Shell/User)

> >> AumHa VSOP & Admin http://aumha.net

> >> DTS-L http://dts-l.net/

> >>

> >> TonyFrim wrote:

> >>> I have a computer with XP Home. It was infected by a virus (despite

> >>> having

> >>> the McAfee Security suite).

> >>> I have replaced the McAfee with Kaspersky and successfully removed the

> >>> virus.

> >>>

> >>> However, my Control Panel icon has disappeared and whenever I try to

> >>> access

> >>> Add/Remove Programs from other menus I get the error Operation has been

> >>> cancelled due to restrictions in effect on this computer. Please contact

> >>> your system administrator.

> >>>

> >>> I am also unable to access Properties on My Computer and Windows Update

> >>> fails.

> >>>

> >>> I can access Regedit. Ihave already checked the Policy section of the

> >>> registry and cannot find anything amiss.

> >>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

> >>>

> >>> I have Administrative rights.

> >>>

> >>> In safe mode everything has returned to normal when I login as

> >>> Administrator.

>

>

[Guest PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

 

Re: Operation has been cancelled due to restrictions in effect....

 

I'm sure HijackThis did pick it up but you didn't know what to look for.

 

Reposting:

>> Please post a link to the forum thread where you've posted your

>> HijackThis

>> log for review.

>>>> When all else fails, HijackThis v2.0.2

>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to

>>>> use.

>>>> It will help you to both identify and remove any hijackware/spyware

>>>> with

>>>> assistance from an expert. **Post your log to

>>>> http://forums.spybot.info/forumdisplay.php?f=22,

>>>> http://castlecops.com/forum67.html,

>>>> http://forums.subratam.org/index.php?showforum=7,

>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

>>>> expert analysis, not here.**

--

~PA Bear

 

TonyFrim wrote:

> I have since done a meticulous scan through the HKCU section and found an

> entry that disabled Control Panel.

> After deleting this my Control Panel has reappeared and I no longer get

> the

> above messages.

> I don't know why HiJackThis didn't pick it up!

>

> I still have one issue remaining. When I try to do a Windows Update I get

> an error 0x8ddd0003

> Since this is XP Home I don't know where to look since as far as I am

> aware

> there are no Network Policy Settings to play with.

>

> Perhaps you have an idea?

>

> Many thanks

>

> Tony

>

> "PA Bear" wrote:

>> Please post a link to the forum thread where you've posted your

>> HijackThis

>> log for review.

>>

>> A Repair Install will /not/ help; a format & reinstall should.

>> --

>> ~Robear Dyer (PA Bear)

>> MS MVP-Windows (IE, OE, Security, Shell/User)

>> AumHa VSOP & Admin http://aumha.net

>> DTS-L http://dts-l.net/

>>

>>

>> TonyFrim wrote:

>>> Thanks. I had already tried this and found one instance of winter.exe

>>> still

>>> lurking.

>>> I am reasonably sure that I have now eliminated the original virus but

>>> would

>>> like to allow Control Panel and Add/Remove programs to be operable from

>>> the

>>> main user.

>>>

>>> These do work in Safe Mode as Administartor, but not as the user. Will a

>>> Windows Repair do the trick, or does it retain the existing (missing)

>>> registry entries? Are there any registry keys I can look for that are in

>>> other sections of the registry?

>>>

>>> I'm getting desperate!!!!

>>>

>>> Thanks

>>>

>>> "PA Bear" wrote:

>>>

>>>> Unexplained computer behavior may be caused by deceptive software

>>>> http://support.microsoft.com/kb/827315

>>>>

>>>> Run a /thorough/ check for hijackware, including posting your

>>>> hijackthis

>>>> log to an appropriate forum.

>>>>

>>>> Checking for/Help with Hijackware

>>>> http://aumha.org/a/parasite.htm

>>>> http://aumha.org/a/quickfix.htm

>>>> http://aumha.net/viewtopic.php?t=5878

>>>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

>>>> http://mvps.org/winhelp2002/unwanted.htm

>>>> http://inetexplorer.mvps.org/data/prevention.htm

>>>> http://inetexplorer.mvps.org/tshoot.html

>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm

>>>> http://defendingyourmachine2.blogspot.com/

>>>> http://www.elephantboycomputers.com/page2.html#Removing_Malware

>>>>

>>>> When all else fails, HijackThis v2.0.2

>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to

>>>> use.

>>>> It will help you to both identify and remove any hijackware/spyware

>>>> with

>>>> assistance from an expert. **Post your log to

>>>> http://forums.spybot.info/forumdisplay.php?f=22,

>>>> http://castlecops.com/forum67.html,

>>>> http://forums.subratam.org/index.php?showforum=7,

>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

>>>> expert

>>>> analysis, not here.**

>>>>

>>>> If the procedures look too complex - and there is no shame in admitting

>>>> this isn't your cup of tea - take the machine to a local, reputable and

>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.

>>>> --

>>>> ~Robear Dyer (PA Bear)

>>>> MS MVP-Windows (IE, OE, Security, Shell/User)

>>>> AumHa VSOP & Admin http://aumha.net

>>>> DTS-L http://dts-l.net/

>>>>

>>>> TonyFrim wrote:

>>>>> I have a computer with XP Home. It was infected by a virus (despite

>>>>> having

>>>>> the McAfee Security suite).

>>>>> I have replaced the McAfee with Kaspersky and successfully removed the

>>>>> virus.

>>>>>

>>>>> However, my Control Panel icon has disappeared and whenever I try to

>>>>> access

>>>>> Add/Remove Programs from other menus I get the error Operation has

>>>>> been

>>>>> cancelled due to restrictions in effect on this computer. Please

>>>>> contact

>>>>> your system administrator.

>>>>>

>>>>> I am also unable to access Properties on My Computer and Windows

>>>>> Update

>>>>> fails.

>>>>>

>>>>> I can access Regedit. Ihave already checked the Policy section of the

>>>>> registry and cannot find anything amiss.

>>>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

>>>>>

>>>>> I have Administrative rights.

>>>>>

>>>>> In safe mode everything has returned to normal when I login as

>>>>> Administrator.

[Guest PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

 

Re: Operation has been cancelled due to restrictions in effect....

 

cf. http://aumha.net/viewtopic.php?t=30889

 

[in recent days, OP has had McAfee VirusScan, NAV, and KAV7 installed.]

--

~PA Bear

 

 

PA Bear wrote:

> I'm sure HijackThis did pick it up but you didn't know what to look for.

>

> Reposting:

>>> Please post a link to the forum thread where you've posted your

>>> HijackThis

>>> log for review.

>

>>>>> When all else fails, HijackThis v2.0.2

>>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to

>>>>> use.

>>>>> It will help you to both identify and remove any hijackware/spyware

>>>>> with

>>>>> assistance from an expert. **Post your log to

>>>>> http://forums.spybot.info/forumdisplay.php?f=22,

>>>>> http://castlecops.com/forum67.html,

>>>>> http://forums.subratam.org/index.php?showforum=7,

>>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

>>>>> expert analysis, not here.**

>

> TonyFrim wrote:

>> I have since done a meticulous scan through the HKCU section and found an

>> entry that disabled Control Panel.

>> After deleting this my Control Panel has reappeared and I no longer get

>> the

>> above messages.

>> I don't know why HiJackThis didn't pick it up!

>>

>> I still have one issue remaining. When I try to do a Windows Update I

>> get

>> an error 0x8ddd0003

>> Since this is XP Home I don't know where to look since as far as I am

>> aware

>> there are no Network Policy Settings to play with.

>>

>> Perhaps you have an idea?

>>

>> Many thanks

>>

>> Tony

>>

>> "PA Bear" wrote:

>>> Please post a link to the forum thread where you've posted your

>>> HijackThis

>>> log for review.

>>>

>>> A Repair Install will /not/ help; a format & reinstall should.

>>> --

>>> ~Robear Dyer (PA Bear)

>>> MS MVP-Windows (IE, OE, Security, Shell/User)

>>> AumHa VSOP & Admin http://aumha.net

>>> DTS-L http://dts-l.net/

>>>

>>>

>>> TonyFrim wrote:

>>>> Thanks. I had already tried this and found one instance of winter.exe

>>>> still

>>>> lurking.

>>>> I am reasonably sure that I have now eliminated the original virus but

>>>> would

>>>> like to allow Control Panel and Add/Remove programs to be operable from

>>>> the

>>>> main user.

>>>>

>>>> These do work in Safe Mode as Administartor, but not as the user. Will

>>>> a

>>>> Windows Repair do the trick, or does it retain the existing (missing)

>>>> registry entries? Are there any registry keys I can look for that are

>>>> in

>>>> other sections of the registry?

>>>>

>>>> I'm getting desperate!!!!

>>>>

>>>> Thanks

>>>>

>>>> "PA Bear" wrote:

>>>>

>>>>> Unexplained computer behavior may be caused by deceptive software

>>>>> http://support.microsoft.com/kb/827315

>>>>>

>>>>> Run a /thorough/ check for hijackware, including posting your

>>>>> hijackthis

>>>>> log to an appropriate forum.

>>>>>

>>>>> Checking for/Help with Hijackware

>>>>> http://aumha.org/a/parasite.htm

>>>>> http://aumha.org/a/quickfix.htm

>>>>> http://aumha.net/viewtopic.php?t=5878

>>>>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

>>>>> http://mvps.org/winhelp2002/unwanted.htm

>>>>> http://inetexplorer.mvps.org/data/prevention.htm

>>>>> http://inetexplorer.mvps.org/tshoot.html

>>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm

>>>>> http://defendingyourmachine2.blogspot.com/

>>>>> http://www.elephantboycomputers.com/page2.html#Removing_Malware

>>>>>

>>>>> When all else fails, HijackThis v2.0.2

>>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to

>>>>> use.

>>>>> It will help you to both identify and remove any hijackware/spyware

>>>>> with

>>>>> assistance from an expert. **Post your log to

>>>>> http://forums.spybot.info/forumdisplay.php?f=22,

>>>>> http://castlecops.com/forum67.html,

>>>>> http://forums.subratam.org/index.php?showforum=7,

>>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for

>>>>> expert

>>>>> analysis, not here.**

>>>>>

>>>>> If the procedures look too complex - and there is no shame in

>>>>> admitting

>>>>> this isn't your cup of tea - take the machine to a local, reputable

>>>>> and

>>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.

>>>>> --

>>>>> ~Robear Dyer (PA Bear)

>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)

>>>>> AumHa VSOP & Admin http://aumha.net

>>>>> DTS-L http://dts-l.net/

>>>>>

>>>>> TonyFrim wrote:

>>>>>> I have a computer with XP Home. It was infected by a virus (despite

>>>>>> having

>>>>>> the McAfee Security suite).

>>>>>> I have replaced the McAfee with Kaspersky and successfully removed

>>>>>> the

>>>>>> virus.

>>>>>>

>>>>>> However, my Control Panel icon has disappeared and whenever I try to

>>>>>> access

>>>>>> Add/Remove Programs from other menus I get the error Operation has

>>>>>> been

>>>>>> cancelled due to restrictions in effect on this computer. Please

>>>>>> contact

>>>>>> your system administrator.

>>>>>>

>>>>>> I am also unable to access Properties on My Computer and Windows

>>>>>> Update

>>>>>> fails.

>>>>>>

>>>>>> I can access Regedit. Ihave already checked the Policy section of

>>>>>> the

>>>>>> registry and cannot find anything amiss.

>>>>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

>>>>>>

>>>>>> I have Administrative rights.

>>>>>>

>>>>>> In safe mode everything has returned to normal when I login as

>>>>>> Administrator.

[Guest aherm]

Re: Operation has been cancelled due to restrictions in effect.....

 

 

I have the exact issue described below. How exactly did you fix the

control panel issue through scanning the "HKCU" section. I am a novice

on the computer but can follow directions well. Any help would be

appreciated.

 

 

TonyFrim;462719 Wrote:

> I have since done a meticulous scan through the HKCU section and found

> an

> entry that disabled Control Panel.

> After deleting this my Control Panel has reappeared and I no longer get

> the

> above messages.

> I don't know why HiJackThis didn't pick it up!

>

> I still have one issue remaining. When I try to do a Windows Update I

> get

> an error 0x8ddd0003

> Since this is XP Home I don't know where to look since as far as I am

> aware

> there are no Network Policy Settings to play with.

>

> Perhaps you have an idea?

>

> Many thanks

>

> Tony

>

> "PA Bear" wrote:

>

> > Please post a link to the forum thread where you've posted your

> HijackThis

> > log for review.

> >

> > A Repair Install will /not/ help; a format & reinstall should.

> > --

> > ~Robear Dyer (PA Bear)

> > MS MVP-Windows (IE, OE, Security, Shell/User)

> > AumHa VSOP & Admin 'AumHa Forums' (http://aumha.net)

> > DTS-L 'Welcome to DTS-L' (http://dts-l.net/)

> >

> >

> > TonyFrim wrote:

> > > Thanks. I had already tried this and found one instance of

> winter.exe

> > > still

> > > lurking.

> > > I am reasonably sure that I have now eliminated the original virus

> but

> > > would

> > > like to allow Control Panel and Add/Remove programs to be operable

> from

> > > the

> > > main user.

> > >

> > > These do work in Safe Mode as Administartor, but not as the user.

> Will a

> > > Windows Repair do the trick, or does it retain the existing

> (missing)

> > > registry entries? Are there any registry keys I can look for that

> are in

> > > other sections of the registry?

> > >

> > > I'm getting desperate!!!!

> > >

> > > Thanks

> > >

> > > "PA Bear" wrote:

> > >

> > >> Unexplained computer behavior may be caused by deceptive software

> > >> 'Unexplained computer behavior may be caused by deceptive

> software' (http://support.microsoft.com/kb/827315)

> > >>

> > >> Run a /thorough/ check for hijackware, including posting your

> hijackthis

> > >> log to an appropriate forum.

> > >>

> > >> Checking for/Help with Hijackware

> > >> 'The Parasite Fight' (http://aumha.org/a/parasite.htm)

> > >> 'The Parasite Fight - Quick Fix Protocol'

> (http://aumha.org/a/quickfix.htm)

> > >> 'AumHa Forums' (http://aumha.net/viewtopic.php?t=5878)

> > >> 'Malware Removal and Prevention: Introduction - CastleCopsWiki'

> (http://tinyurl.com/9ezyj)

> > >> 'Dealing with Unwanted Spyware and Parasites'

> (http://mvps.org/winhelp2002/unwanted.htm)

> > >> 'Prevent Browser Hijackings'

> (http://inetexplorer.mvps.org/data/prevention.htm)

> > >> 'Troubleshooting browser hijackings'

> (http://inetexplorer.mvps.org/tshoot.html)

> > >> 'Prevent Spyware from being installed'

> (http://www.mvps.org/sramesh2k/Malware_Defence.htm)

> > >> 'Defending Your Machine 2'

> (http://defendingyourmachine2.blogspot.com/)

> > >> 'page2'

> (http://www.elephantboycomputers.com/page2.html#Removing_Malware)

> > >>

> > >> When all else fails, HijackThis v2.0.2

> > >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool

> to use.

> > >> It will help you to both identify and remove any

> hijackware/spyware with

> > >> assistance from an expert. **Post your log to

> > >> 'Malware Removal - Safer Networking Forums'

> (http://forums.spybot.info/forumdisplay.php?f=22),

> > >> 'CastleCops® Trend Micro HijackThis Logs'

> (http://castlecops.com/forum67.html),

> > >> 'Kill Spyware Forums -> HijackThis Logs and Malware Removal'

> (http://forums.subratam.org/index.php?showforum=7),

> > >> 'AumHa Forums' (http://aumha.net/viewforum.php?f=30), or other

> appropriate forums for

> > >> expert

> > >> analysis, not here.**

> > >>

> > >> If the procedures look too complex - and there is no shame in

> admitting

> > >> this isn't your cup of tea - take the machine to a local,

> reputable and

> > >> independent (i.e., not BigBoxStoreUSA) computer repair shop.

> > >> --

> > >> ~Robear Dyer (PA Bear)

> > >> MS MVP-Windows (IE, OE, Security, Shell/User)

> > >> AumHa VSOP & Admin 'AumHa Forums' (http://aumha.net)

> > >> DTS-L 'Welcome to DTS-L' (http://dts-l.net/)

> > >>

> > >> TonyFrim wrote:

> > >>> I have a computer with XP Home. It was infected by a virus

> (despite

> > >>> having

> > >>> the McAfee Security suite).

> > >>> I have replaced the McAfee with Kaspersky and successfully

> removed the

> > >>> virus.

> > >>>

> > >>> However, my Control Panel icon has disappeared and whenever I try

> to

> > >>> access

> > >>> Add/Remove Programs from other menus I get the error Operation

> has been

> > >>> cancelled due to restrictions in effect on this computer. Please

> contact

> > >>> your system administrator.

> > >>>

> > >>> I am also unable to access Properties on My Computer and Windows

> Update

> > >>> fails.

> > >>>

> > >>> I can access Regedit. Ihave already checked the Policy section

> of the

> > >>> registry and cannot find anything amiss.

> > >>>

> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

> > >>>

> > >>> I have Administrative rights.

> > >>>

> > >>> In safe mode everything has returned to normal when I login as

> > >>> Administrator.

> >

> >