Operation has been cancelled due to restrictions in effect.....

  • Thread starter Thread starter TonyFrim
  • Start date Start date
T

TonyFrim

I have a computer with XP Home. It was infected by a virus (despite having
the McAfee Security suite).
I have replaced the McAfee with Kaspersky and successfully removed the virus.

However, my Control Panel icon has disappeared and whenever I try to access
Add/Remove Programs from other menus I get the error Operation has been
cancelled due to restrictions in effect on this computer. Please contact your
system administrator.

I am also unable to access Properties on My Computer and Windows Update fails.

I can access Regedit. Ihave already checked the Policy section of the
registry and cannot find anything amiss.
(HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies....)

I have Administrative rights.

In safe mode everything has returned to normal when I login as Administrator.
 
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
 
Thanks. I had already tried this and found one instance of winter.exe still
lurking.
I am reasonably sure that I have now eliminated the original virus but would
like to allow Control Panel and Add/Remove programs to be operable from the
main user.

These do work in Safe Mode as Administartor, but not as the user. Will a
Windows Repair do the trick, or does it retain the existing (missing)
registry entries? Are there any registry keys I can look for that are in
other sections of the registry?

I'm getting desperate!!!!

Thanks
 
Please post a link to the forum thread where you've posted your HijackThis
log for review.

A Repair Install will /not/ help; a format & reinstall should.
 
I have since done a meticulous scan through the HKCU section and found an
entry that disabled Control Panel.
After deleting this my Control Panel has reappeared and I no longer get the
above messages.
I don't know why HiJackThis didn't pick it up!

I still have one issue remaining. When I try to do a Windows Update I get
an error 0x8ddd0003
Since this is XP Home I don't know where to look since as far as I am aware
there are no Network Policy Settings to play with.

Perhaps you have an idea?

Many thanks

Tony
 
I'm sure HijackThis did pick it up but you didn't know what to look for.

Reposting:--
~PA Bear
 
Back
Top