Operation has been cancelled due to restrictions in effect.....

[TonyFrim]

I have a computer with XP Home. It was infected by a virus (despite having
the McAfee Security suite).
I have replaced the McAfee with Kaspersky and successfully removed the virus.

However, my Control Panel icon has disappeared and whenever I try to access
Add/Remove Programs from other menus I get the error Operation has been
cancelled due to restrictions in effect on this computer. Please contact your
system administrator.

I am also unable to access Properties on My Computer and Windows Update fails.

I can access Regedit. Ihave already checked the Policy section of the
registry and cannot find anything amiss.
(HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

I have Administrative rights.

In safe mode everything has returned to normal when I login as Administrator.

 

[Detlev Dreyer]

Re: Operation has been cancelled due to restrictions in effect.....

"TonyFrim" <TonyFrim@discussions.microsoft.com> wrote:

> I have a computer with XP Home. It was infected by a virus (despite
> having the McAfee Security suite).
> I have replaced the McAfee with Kaspersky and successfully removed the
> virus.

No, you didn't.

> However, my Control Panel icon has disappeared and whenever I try to

"Cleaning a Compromised System"
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

--
d-d

 

[PA Bear]

Re: Operation has been cancelled due to restrictions in effect.....

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

TonyFrim wrote:
> I have a computer with XP Home. It was infected by a virus (despite
> having
> the McAfee Security suite).
> I have replaced the McAfee with Kaspersky and successfully removed the
> virus.
>
> However, my Control Panel icon has disappeared and whenever I try to
> access
> Add/Remove Programs from other menus I get the error Operation has been
> cancelled due to restrictions in effect on this computer. Please contact
> your system administrator.
>
> I am also unable to access Properties on My Computer and Windows Update
> fails.
>
> I can access Regedit. Ihave already checked the Policy section of the
> registry and cannot find anything amiss.
> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
>
> I have Administrative rights.
>
> In safe mode everything has returned to normal when I login as
> Administrator.

 

[TonyFrim]

Re: Operation has been cancelled due to restrictions in effect....

Re: Operation has been cancelled due to restrictions in effect....

Thanks. I had already tried this and found one instance of winter.exe still
lurking.
I am reasonably sure that I have now eliminated the original virus but would
like to allow Control Panel and Add/Remove programs to be operable from the
main user.

These do work in Safe Mode as Administartor, but not as the user. Will a
Windows Repair do the trick, or does it retain the existing (missing)
registry entries? Are there any registry keys I can look for that are in
other sections of the registry?

I'm getting desperate!!!!

Thanks


"PA Bear" wrote:

> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your hijackthis log
> to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
> http://aumha.org/a/quickfix.htm
> http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
> http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> It will help you to both identify and remove any hijackware/spyware with
> assistance from an expert. **Post your log to
> http://forums.spybot.info/forumdisplay.php?f=22,
> http://castlecops.com/forum67.html,
> http://forums.subratam.org/index.php?showforum=7,
> http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
> analysis, not here.**
>
> If the procedures look too complex - and there is no shame in admitting this
> isn't your cup of tea - take the machine to a local, reputable and
> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> TonyFrim wrote:
> > I have a computer with XP Home. It was infected by a virus (despite
> > having
> > the McAfee Security suite).
> > I have replaced the McAfee with Kaspersky and successfully removed the
> > virus.
> >
> > However, my Control Panel icon has disappeared and whenever I try to
> > access
> > Add/Remove Programs from other menus I get the error Operation has been
> > cancelled due to restrictions in effect on this computer. Please contact
> > your system administrator.
> >
> > I am also unable to access Properties on My Computer and Windows Update
> > fails.
> >
> > I can access Regedit. Ihave already checked the Policy section of the
> > registry and cannot find anything amiss.
> > (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
> >
> > I have Administrative rights.
> >
> > In safe mode everything has returned to normal when I login as
> > Administrator.
>
>

 

[PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

Re: Operation has been cancelled due to restrictions in effect....

Please post a link to the forum thread where you've posted your HijackThis
log for review.

A Repair Install will /not/ help; a format & reinstall should.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


TonyFrim wrote:
> Thanks. I had already tried this and found one instance of winter.exe
> still
> lurking.
> I am reasonably sure that I have now eliminated the original virus but
> would
> like to allow Control Panel and Add/Remove programs to be operable from
> the
> main user.
>
> These do work in Safe Mode as Administartor, but not as the user. Will a
> Windows Repair do the trick, or does it retain the existing (missing)
> registry entries? Are there any registry keys I can look for that are in
> other sections of the registry?
>
> I'm getting desperate!!!!
>
> Thanks
>
> "PA Bear" wrote:
>
>> Unexplained computer behavior may be caused by deceptive software
>> http://support.microsoft.com/kb/827315
>>
>> Run a /thorough/ check for hijackware, including posting your hijackthis
>> log to an appropriate forum.
>>
>> Checking for/Help with Hijackware
>> http://aumha.org/a/parasite.htm
>> http://aumha.org/a/quickfix.htm
>> http://aumha.net/viewtopic.php?t=5878
>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
>> http://mvps.org/winhelp2002/unwanted.htm
>> http://inetexplorer.mvps.org/data/prevention.htm
>> http://inetexplorer.mvps.org/tshoot.html
>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>> http://defendingyourmachine2.blogspot.com/
>> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>>
>> When all else fails, HijackThis v2.0.2
>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
>> It will help you to both identify and remove any hijackware/spyware with
>> assistance from an expert. **Post your log to
>> http://forums.spybot.info/forumdisplay.php?f=22,
>> http://castlecops.com/forum67.html,
>> http://forums.subratam.org/index.php?showforum=7,
>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>> expert
>> analysis, not here.**
>>
>> If the procedures look too complex - and there is no shame in admitting
>> this isn't your cup of tea - take the machine to a local, reputable and
>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> TonyFrim wrote:
>>> I have a computer with XP Home. It was infected by a virus (despite
>>> having
>>> the McAfee Security suite).
>>> I have replaced the McAfee with Kaspersky and successfully removed the
>>> virus.
>>>
>>> However, my Control Panel icon has disappeared and whenever I try to
>>> access
>>> Add/Remove Programs from other menus I get the error Operation has been
>>> cancelled due to restrictions in effect on this computer. Please contact
>>> your system administrator.
>>>
>>> I am also unable to access Properties on My Computer and Windows Update
>>> fails.
>>>
>>> I can access Regedit. Ihave already checked the Policy section of the
>>> registry and cannot find anything amiss.
>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
>>>
>>> I have Administrative rights.
>>>
>>> In safe mode everything has returned to normal when I login as
>>> Administrator.

 

[TonyFrim]

Re: Operation has been cancelled due to restrictions in effect....

Re: Operation has been cancelled due to restrictions in effect....

I have since done a meticulous scan through the HKCU section and found an
entry that disabled Control Panel.
After deleting this my Control Panel has reappeared and I no longer get the
above messages.
I don't know why HiJackThis didn't pick it up!

I still have one issue remaining. When I try to do a Windows Update I get
an error 0x8ddd0003
Since this is XP Home I don't know where to look since as far as I am aware
there are no Network Policy Settings to play with.

Perhaps you have an idea?

Many thanks

Tony

"PA Bear" wrote:

> Please post a link to the forum thread where you've posted your HijackThis
> log for review.
>
> A Repair Install will /not/ help; a format & reinstall should.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE, OE, Security, Shell/User)
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
>
> TonyFrim wrote:
> > Thanks. I had already tried this and found one instance of winter.exe
> > still
> > lurking.
> > I am reasonably sure that I have now eliminated the original virus but
> > would
> > like to allow Control Panel and Add/Remove programs to be operable from
> > the
> > main user.
> >
> > These do work in Safe Mode as Administartor, but not as the user. Will a
> > Windows Repair do the trick, or does it retain the existing (missing)
> > registry entries? Are there any registry keys I can look for that are in
> > other sections of the registry?
> >
> > I'm getting desperate!!!!
> >
> > Thanks
> >
> > "PA Bear" wrote:
> >
> >> Unexplained computer behavior may be caused by deceptive software
> >> http://support.microsoft.com/kb/827315
> >>
> >> Run a /thorough/ check for hijackware, including posting your hijackthis
> >> log to an appropriate forum.
> >>
> >> Checking for/Help with Hijackware
> >> http://aumha.org/a/parasite.htm
> >> http://aumha.org/a/quickfix.htm
> >> http://aumha.net/viewtopic.php?t=5878
> >> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
> >> http://mvps.org/winhelp2002/unwanted.htm
> >> http://inetexplorer.mvps.org/data/prevention.htm
> >> http://inetexplorer.mvps.org/tshoot.html
> >> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> >> http://defendingyourmachine2.blogspot.com/
> >> http://www.elephantboycomputers.com/page2.html#Removing_Malware
> >>
> >> When all else fails, HijackThis v2.0.2
> >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
> >> It will help you to both identify and remove any hijackware/spyware with
> >> assistance from an expert. **Post your log to
> >> http://forums.spybot.info/forumdisplay.php?f=22,
> >> http://castlecops.com/forum67.html,
> >> http://forums.subratam.org/index.php?showforum=7,
> >> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
> >> expert
> >> analysis, not here.**
> >>
> >> If the procedures look too complex - and there is no shame in admitting
> >> this isn't your cup of tea - take the machine to a local, reputable and
> >> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-Windows (IE, OE, Security, Shell/User)
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L http://dts-l.net/
> >>
> >> TonyFrim wrote:
> >>> I have a computer with XP Home. It was infected by a virus (despite
> >>> having
> >>> the McAfee Security suite).
> >>> I have replaced the McAfee with Kaspersky and successfully removed the
> >>> virus.
> >>>
> >>> However, my Control Panel icon has disappeared and whenever I try to
> >>> access
> >>> Add/Remove Programs from other menus I get the error Operation has been
> >>> cancelled due to restrictions in effect on this computer. Please contact
> >>> your system administrator.
> >>>
> >>> I am also unable to access Properties on My Computer and Windows Update
> >>> fails.
> >>>
> >>> I can access Regedit. Ihave already checked the Policy section of the
> >>> registry and cannot find anything amiss.
> >>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
> >>>
> >>> I have Administrative rights.
> >>>
> >>> In safe mode everything has returned to normal when I login as
> >>> Administrator.
>
>

 

[PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

Re: Operation has been cancelled due to restrictions in effect....

I'm sure HijackThis did pick it up but you didn't know what to look for.

Reposting:
>> Please post a link to the forum thread where you've posted your
>> HijackThis
>> log for review.

>>>> When all else fails, HijackThis v2.0.2
>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>> use.
>>>> It will help you to both identify and remove any hijackware/spyware
>>>> with
>>>> assistance from an expert. **Post your log to
>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>> http://castlecops.com/forum67.html,
>>>> http://forums.subratam.org/index.php?showforum=7,
>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>>>> expert analysis, not here.**
--
~PA Bear

TonyFrim wrote:
> I have since done a meticulous scan through the HKCU section and found an
> entry that disabled Control Panel.
> After deleting this my Control Panel has reappeared and I no longer get
> the
> above messages.
> I don't know why HiJackThis didn't pick it up!
>
> I still have one issue remaining. When I try to do a Windows Update I get
> an error 0x8ddd0003
> Since this is XP Home I don't know where to look since as far as I am
> aware
> there are no Network Policy Settings to play with.
>
> Perhaps you have an idea?
>
> Many thanks
>
> Tony
>
> "PA Bear" wrote:
>> Please post a link to the forum thread where you've posted your
>> HijackThis
>> log for review.
>>
>> A Repair Install will /not/ help; a format & reinstall should.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-Windows (IE, OE, Security, Shell/User)
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>>
>> TonyFrim wrote:
>>> Thanks. I had already tried this and found one instance of winter.exe
>>> still
>>> lurking.
>>> I am reasonably sure that I have now eliminated the original virus but
>>> would
>>> like to allow Control Panel and Add/Remove programs to be operable from
>>> the
>>> main user.
>>>
>>> These do work in Safe Mode as Administartor, but not as the user. Will a
>>> Windows Repair do the trick, or does it retain the existing (missing)
>>> registry entries? Are there any registry keys I can look for that are in
>>> other sections of the registry?
>>>
>>> I'm getting desperate!!!!
>>>
>>> Thanks
>>>
>>> "PA Bear" wrote:
>>>
>>>> Unexplained computer behavior may be caused by deceptive software
>>>> http://support.microsoft.com/kb/827315
>>>>
>>>> Run a /thorough/ check for hijackware, including posting your
>>>> hijackthis
>>>> log to an appropriate forum.
>>>>
>>>> Checking for/Help with Hijackware
>>>> http://aumha.org/a/parasite.htm
>>>> http://aumha.org/a/quickfix.htm
>>>> http://aumha.net/viewtopic.php?t=5878
>>>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>> http://inetexplorer.mvps.org/tshoot.html
>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>> http://defendingyourmachine2.blogspot.com/
>>>> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>>>>
>>>> When all else fails, HijackThis v2.0.2
>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>> use.
>>>> It will help you to both identify and remove any hijackware/spyware
>>>> with
>>>> assistance from an expert. **Post your log to
>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>> http://castlecops.com/forum67.html,
>>>> http://forums.subratam.org/index.php?showforum=7,
>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>>>> expert
>>>> analysis, not here.**
>>>>
>>>> If the procedures look too complex - and there is no shame in admitting
>>>> this isn't your cup of tea - take the machine to a local, reputable and
>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>> AumHa VSOP & Admin http://aumha.net
>>>> DTS-L http://dts-l.net/
>>>>
>>>> TonyFrim wrote:
>>>>> I have a computer with XP Home. It was infected by a virus (despite
>>>>> having
>>>>> the McAfee Security suite).
>>>>> I have replaced the McAfee with Kaspersky and successfully removed the
>>>>> virus.
>>>>>
>>>>> However, my Control Panel icon has disappeared and whenever I try to
>>>>> access
>>>>> Add/Remove Programs from other menus I get the error Operation has
>>>>> been
>>>>> cancelled due to restrictions in effect on this computer. Please
>>>>> contact
>>>>> your system administrator.
>>>>>
>>>>> I am also unable to access Properties on My Computer and Windows
>>>>> Update
>>>>> fails.
>>>>>
>>>>> I can access Regedit. Ihave already checked the Policy section of the
>>>>> registry and cannot find anything amiss.
>>>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
>>>>>
>>>>> I have Administrative rights.
>>>>>
>>>>> In safe mode everything has returned to normal when I login as
>>>>> Administrator.

 

[PA Bear]

Re: Operation has been cancelled due to restrictions in effect....

Re: Operation has been cancelled due to restrictions in effect....

cf. http://aumha.net/viewtopic.php?t=30889

[In recent days, OP has had McAfee VirusScan, NAV, and KAV7 installed.]
--
~PA Bear


PA Bear wrote:
> I'm sure HijackThis did pick it up but you didn't know what to look for.
>
> Reposting:
>>> Please post a link to the forum thread where you've posted your
>>> HijackThis
>>> log for review.
>
>>>>> When all else fails, HijackThis v2.0.2
>>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>>> use.
>>>>> It will help you to both identify and remove any hijackware/spyware
>>>>> with
>>>>> assistance from an expert. **Post your log to
>>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>>> http://castlecops.com/forum67.html,
>>>>> http://forums.subratam.org/index.php?showforum=7,
>>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>>>>> expert analysis, not here.**
>
> TonyFrim wrote:
>> I have since done a meticulous scan through the HKCU section and found an
>> entry that disabled Control Panel.
>> After deleting this my Control Panel has reappeared and I no longer get
>> the
>> above messages.
>> I don't know why HiJackThis didn't pick it up!
>>
>> I still have one issue remaining. When I try to do a Windows Update I
>> get
>> an error 0x8ddd0003
>> Since this is XP Home I don't know where to look since as far as I am
>> aware
>> there are no Network Policy Settings to play with.
>>
>> Perhaps you have an idea?
>>
>> Many thanks
>>
>> Tony
>>
>> "PA Bear" wrote:
>>> Please post a link to the forum thread where you've posted your
>>> HijackThis
>>> log for review.
>>>
>>> A Repair Install will /not/ help; a format & reinstall should.
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>> AumHa VSOP & Admin http://aumha.net
>>> DTS-L http://dts-l.net/
>>>
>>>
>>> TonyFrim wrote:
>>>> Thanks. I had already tried this and found one instance of winter.exe
>>>> still
>>>> lurking.
>>>> I am reasonably sure that I have now eliminated the original virus but
>>>> would
>>>> like to allow Control Panel and Add/Remove programs to be operable from
>>>> the
>>>> main user.
>>>>
>>>> These do work in Safe Mode as Administartor, but not as the user. Will
>>>> a
>>>> Windows Repair do the trick, or does it retain the existing (missing)
>>>> registry entries? Are there any registry keys I can look for that are
>>>> in
>>>> other sections of the registry?
>>>>
>>>> I'm getting desperate!!!!
>>>>
>>>> Thanks
>>>>
>>>> "PA Bear" wrote:
>>>>
>>>>> Unexplained computer behavior may be caused by deceptive software
>>>>> http://support.microsoft.com/kb/827315
>>>>>
>>>>> Run a /thorough/ check for hijackware, including posting your
>>>>> hijackthis
>>>>> log to an appropriate forum.
>>>>>
>>>>> Checking for/Help with Hijackware
>>>>> http://aumha.org/a/parasite.htm
>>>>> http://aumha.org/a/quickfix.htm
>>>>> http://aumha.net/viewtopic.php?t=5878
>>>>> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
>>>>> http://mvps.org/winhelp2002/unwanted.htm
>>>>> http://inetexplorer.mvps.org/data/prevention.htm
>>>>> http://inetexplorer.mvps.org/tshoot.html
>>>>> http://www.mvps.org/sramesh2k/Malware_Defence.htm
>>>>> http://defendingyourmachine2.blogspot.com/
>>>>> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>>>>>
>>>>> When all else fails, HijackThis v2.0.2
>>>>> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to
>>>>> use.
>>>>> It will help you to both identify and remove any hijackware/spyware
>>>>> with
>>>>> assistance from an expert. **Post your log to
>>>>> http://forums.spybot.info/forumdisplay.php?f=22,
>>>>> http://castlecops.com/forum67.html,
>>>>> http://forums.subratam.org/index.php?showforum=7,
>>>>> http://aumha.net/viewforum.php?f=30, or other appropriate forums for
>>>>> expert
>>>>> analysis, not here.**
>>>>>
>>>>> If the procedures look too complex - and there is no shame in
>>>>> admitting
>>>>> this isn't your cup of tea - take the machine to a local, reputable
>>>>> and
>>>>> independent (i.e., not BigBoxStoreUSA) computer repair shop.
>>>>> --
>>>>> ~Robear Dyer (PA Bear)
>>>>> MS MVP-Windows (IE, OE, Security, Shell/User)
>>>>> AumHa VSOP & Admin http://aumha.net
>>>>> DTS-L http://dts-l.net/
>>>>>
>>>>> TonyFrim wrote:
>>>>>> I have a computer with XP Home. It was infected by a virus (despite
>>>>>> having
>>>>>> the McAfee Security suite).
>>>>>> I have replaced the McAfee with Kaspersky and successfully removed
>>>>>> the
>>>>>> virus.
>>>>>>
>>>>>> However, my Control Panel icon has disappeared and whenever I try to
>>>>>> access
>>>>>> Add/Remove Programs from other menus I get the error Operation has
>>>>>> been
>>>>>> cancelled due to restrictions in effect on this computer. Please
>>>>>> contact
>>>>>> your system administrator.
>>>>>>
>>>>>> I am also unable to access Properties on My Computer and Windows
>>>>>> Update
>>>>>> fails.
>>>>>>
>>>>>> I can access Regedit. Ihave already checked the Policy section of
>>>>>> the
>>>>>> registry and cannot find anything amiss.
>>>>>> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
>>>>>>
>>>>>> I have Administrative rights.
>>>>>>
>>>>>> In safe mode everything has returned to normal when I login as
>>>>>> Administrator.

 

[aherm]

Re: Operation has been cancelled due to restrictions in effect.....


I have the exact issue described below. How exactly did you fix the
control panel issue through scanning the "HKCU" section. I am a novice
on the computer but can follow directions well. Any help would be
appreciated.


TonyFrim;462719 Wrote:
> I have since done a meticulous scan through the HKCU section and found
> an
> entry that disabled Control Panel.
> After deleting this my Control Panel has reappeared and I no longer get
> the
> above messages.
> I don't know why HiJackThis didn't pick it up!
>
> I still have one issue remaining. When I try to do a Windows Update I
> get
> an error 0x8ddd0003
> Since this is XP Home I don't know where to look since as far as I am
> aware
> there are no Network Policy Settings to play with.
>
> Perhaps you have an idea?
>
> Many thanks
>
> Tony
>
> "PA Bear" wrote:
>
> > Please post a link to the forum thread where you've posted your
> HijackThis
> > log for review.
> >
> > A Repair Install will /not/ help; a format & reinstall should.
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE, OE, Security, Shell/User)
> > AumHa VSOP & Admin 'AumHa Forums' (http://aumha.net)
> > DTS-L 'Welcome to DTS-L' (http://dts-l.net/)
> >
> >
> > TonyFrim wrote:
> > > Thanks. I had already tried this and found one instance of
> winter.exe
> > > still
> > > lurking.
> > > I am reasonably sure that I have now eliminated the original virus
> but
> > > would
> > > like to allow Control Panel and Add/Remove programs to be operable
> from
> > > the
> > > main user.
> > >
> > > These do work in Safe Mode as Administartor, but not as the user.
> Will a
> > > Windows Repair do the trick, or does it retain the existing
> (missing)
> > > registry entries? Are there any registry keys I can look for that
> are in
> > > other sections of the registry?
> > >
> > > I'm getting desperate!!!!
> > >
> > > Thanks
> > >
> > > "PA Bear" wrote:
> > >
> > >> Unexplained computer behavior may be caused by deceptive software
> > >> 'Unexplained computer behavior may be caused by deceptive
> software' (http://support.microsoft.com/kb/827315)
> > >>
> > >> Run a /thorough/ check for hijackware, including posting your
> hijackthis
> > >> log to an appropriate forum.
> > >>
> > >> Checking for/Help with Hijackware
> > >> 'The Parasite Fight' (http://aumha.org/a/parasite.htm)
> > >> 'The Parasite Fight - Quick Fix Protocol'
> (http://aumha.org/a/quickfix.htm)
> > >> 'AumHa Forums' (http://aumha.net/viewtopic.php?t=5878)
> > >> 'Malware Removal and Prevention: Introduction - CastleCopsWiki'
> (http://tinyurl.com/9ezyj)
> > >> 'Dealing with Unwanted Spyware and Parasites'
> (http://mvps.org/winhelp2002/unwanted.htm)
> > >> 'Prevent Browser Hijackings'
> (http://inetexplorer.mvps.org/data/prevention.htm)
> > >> 'Troubleshooting browser hijackings'
> (http://inetexplorer.mvps.org/tshoot.html)
> > >> 'Prevent Spyware from being installed'
> (http://www.mvps.org/sramesh2k/Malware_Defence.htm)
> > >> 'Defending Your Machine 2'
> (http://defendingyourmachine2.blogspot.com/)
> > >> 'page2'
> (http://www.elephantboycomputers.com/page2.html#Removing_Malware)
> > >>
> > >> When all else fails, HijackThis v2.0.2
> > >> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool
> to use.
> > >> It will help you to both identify and remove any
> hijackware/spyware with
> > >> assistance from an expert. **Post your log to
> > >> 'Malware Removal - Safer Networking Forums'
> (http://forums.spybot.info/forumdisplay.php?f=22),
> > >> 'CastleCops® Trend Micro HijackThis Logs'
> (http://castlecops.com/forum67.html),
> > >> 'Kill Spyware Forums -> HijackThis Logs and Malware Removal'
> (http://forums.subratam.org/index.php?showforum=7),
> > >> 'AumHa Forums' (http://aumha.net/viewforum.php?f=30), or other
> appropriate forums for
> > >> expert
> > >> analysis, not here.**
> > >>
> > >> If the procedures look too complex - and there is no shame in
> admitting
> > >> this isn't your cup of tea - take the machine to a local,
> reputable and
> > >> independent (i.e., not BigBoxStoreUSA) computer repair shop.
> > >> --
> > >> ~Robear Dyer (PA Bear)
> > >> MS MVP-Windows (IE, OE, Security, Shell/User)
> > >> AumHa VSOP & Admin 'AumHa Forums' (http://aumha.net)
> > >> DTS-L 'Welcome to DTS-L' (http://dts-l.net/)
> > >>
> > >> TonyFrim wrote:
> > >>> I have a computer with XP Home. It was infected by a virus
> (despite
> > >>> having
> > >>> the McAfee Security suite).
> > >>> I have replaced the McAfee with Kaspersky and successfully
> removed the
> > >>> virus.
> > >>>
> > >>> However, my Control Panel icon has disappeared and whenever I try
> to
> > >>> access
> > >>> Add/Remove Programs from other menus I get the error Operation
> has been
> > >>> cancelled due to restrictions in effect on this computer. Please
> contact
> > >>> your system administrator.
> > >>>
> > >>> I am also unable to access Properties on My Computer and Windows
> Update
> > >>> fails.
> > >>>
> > >>> I can access Regedit. Ihave already checked the Policy section
> of the
> > >>> registry and cannot find anything amiss.
> > >>>
> (HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)
> > >>>
> > >>> I have Administrative rights.
> > >>>
> > >>> In safe mode everything has returned to normal when I login as
> > >>> Administrator.
> >
> >