[texansays]

Although I've read oodles and oodles of forums and threads about the basic error that I'm getting
(this operation has been cancelled due to restriction in effect on this computer. Please contact your system administrator.)
none of the solutions work for me because I no longer have control panel anywhere on my computer .. its just plain GONE!

Besides that all basic computer operations get the same error
ex: My computer - no control panel exists
click 'add or remove programs' - get the error
click to open windows calendar - get the error
click to 'view system information' - get the error
click desktop to change properties - get the error

I can do normal functions such as opening my files, internet access etc etc but no computer functions.

It all began several months ago when browsing the internet and the windows virus alert popped up telling me I was infected. It did not identify the virus/trojan, nor did my McAffee, Ad-aware and AVG programs alarm.
I immediately unplugged internet and ran both antivirus programs. Both told me they found a problem but could not correct/quaranteen/delete as the technology for that particular unnamed entity was not currently available.
I then downloaded 4 other antivirus programs (cureit, regcure, f-prod, avast) and ran them as well as running reg supreme .. each found issues that the others did not and with combined efforts of all programs I was able to keep my computer running well.

A day later I tried to adjust the date/time on the computer and got the first occurance of the error: this operation has been cancelled due to restriction in effect on this computer. Please contact your system administrator.
It was an annoyance but not a huge deal so I continued to work and forgot about it. A week later I wanted to uninstall some software so went to where 'control panel' should have been - it was no longer there. I did a search via windows and via DOS prompt to no avail.
Again an annoyance, allbeit a much bigger annoyance but again did nothing further and continued working.
A month passed of more and more annoyances so I decided to upgrade my OS from Millenium to XP thinking that would cure the problem ... it didn't, I'm still getting the same errors.

Reading instructions from several Microsoft troubleshooting articles as well as numberous posts over the web,
I've Tried the following:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions and changing the 1 to 0 as in so many posts .. however, I do not have the Internet Explorer folder there at all. This is what I have:
HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates
and
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows
thats it.

I've run a search of the registry for ' NoBrowserOptions' and found no results.

went down to 'HKEY_CURRENT_USER\Software\Policies\Zone Labs\ZoneAlarm'
changed 'ViolationDialogSeverity' (type= 'REG_DWORD') Data 0x00000001 (1) to 0x00000001 (0)
Rebooted
did not help so put it back to original state

went to gpedit.msc (from MS troubleshooting article)
clicked User Configuration
clicked Administrative Templates
clicked System
clicked Group Policy
clicked Create New Group Plicy object links disabled by default
it was 'Not Configured'
so I 'Disabled' it ..
clicked 'Apply'
clicked 'OK'
rebooted
did not help so put it back to original state

Since installing a whole new OS didn't work I have no clue where to turn next ... can someone PLEASE HELP!?!?

[techychick]

Sounds like malware IMO, I would try to install hijack this and post a log file

[rainforest123]

YUP!
sounds similar to http://forums.techguy.org/showthread...2&goto=newpost


Click here and then scroll down to and click on hijackthis self installer to download HJTsetup.exe
here = = http://thespykiller.co.uk/index.php?...pmod;dl=item10

* Save HJTsetup.exe to your desktop.
* Double click on the HJTsetup.exe icon on your desktop.
* By default it will install to C:\Program Files\Hijack This.
* Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
* Put a check by Create a desktop icon then click Next again.
* Continue to follow the rest of the prompts from there.
* At the final dialogue box click Finish and it will launch Hijack This.
* Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
* Click Save to save the log file and then the log will open in notepad.
* Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
* Come back here to this thread and Paste the log in your next reply.
* DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Source:
http://forums.techguy.org/malware-re...-download.html

RF123

[managed]

As you upgraded WinME to XP it seems whatever was wrong is still present.

If nothing else works you could do a clean install, then you would be sure any Malware was gone.

If your XP disk is an upgrade version you would need an older windows version CD to do it, if you have a Win ME CD that would do fine.

[texansays]

Originally Posted by rainforest123

YUP!
sounds similar to http://forums.techguy.org/showthread...2&goto=newpost


Click here and then scroll down to and click on hijackthis self installer to download HJTsetup.exe
here = = http://thespykiller.co.uk/index.php?...pmod;dl=item10

* Save HJTsetup.exe to your desktop.
* Double click on the HJTsetup.exe icon on your desktop.
* By default it will install to C:\Program Files\Hijack This.
* Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
* Put a check by Create a desktop icon then click Next again.
* Continue to follow the rest of the prompts from there.
* At the final dialogue box click Finish and it will launch Hijack This.
* Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
* Click Save to save the log file and then the log will open in notepad.
* Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
* Come back here to this thread and Paste the log in your next reply.
* DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Source:
http://forums.techguy.org/malware-re...-download.html

RF123

I've done as instructed ... here is the logfile:

------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:54:40 AM, on 3/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRAM FILES\COMMON FILES\AOL\1165003462\EE\aolsoftware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Win32 Classes -
O16 - DPF: {192F9A01-8030-48CE-9BC6-B03DE3E613C6} (PeoplePC Web Installer) - https://www.peoplepc.com/ppcos/ISP60...ad/ppcwebi.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-48.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46.../bejeweled.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} (WwLuxor Control) - http://www.worldwinner.com/games/v49/luxor/luxor.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/amp...1.11_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7A549098-93A8-4720-B947-6358C5D0ADE3}: NameServer = 205.188.146.145

--
End of file - 5083 bytes
--------------------------------------------------------

To clarify, this is a home office PC with no network.
Obviously I'm the owner. I really can't do a clean install of XP at this time as I don't have enough external storage to backup ALL of mybusiness files (6 years of large pdf files).

*Crossing fingers* that one of you guys can come to the rescue!!

[rainforest123]

Please click on the red / white triangle, to bring this thread to the attention of a moderator. Request a transferral of this thread to the malware removal forum.

I recommend that you quickly develop a scheme for backing up your data.

Possibilities:
Flash drives
DVDs
Storage Area Networks
Additional external hard disk drives.

Best of success.

RF123

[AcaCandy]

I've moved you to the correct forum, but will add this....have you ever thought about a hard drive failure? If your files are so important to you, it is in your best interest to get them backed up NOW....maybe even twice.

[dvk01]

if I didn't know better I would say that was a hjt log from a 98 or ME computer not an XP one

I warn you now, it is not likely that this will be fixable but we might get some limited functionality from it, just about enough to allow you to backup in preparation for a new install to solve the problems

I have NEVER seen any XP computer with no services

No Antivirus installed or running

taht computer is a disater waiting to happen

Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

• Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
  • In the Processes group click Non-Microsoft
  • In the Win32 Services group click Non-Microsoft
  • In the Driver Services group click Non-Microsoft
  • In the Registry group click ALL
  • In the Files Created Within group click 90 days Make sure Non-Microsoft only is CHECKED
  • In the Files Modified Within group select 90 days Make sure Non-Microsoft only is CHECKED
  • In the File String Search group select ALL
  in the Additional scans sections please press select all and then uncheck non-microsoft only
• Now click the Run Scan button on the toolbar.
• The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Save that notepad file

Use the Reply button and attach the notepad file here. I will review it when it comes in.

[texansays]

Oh .. I actually customized it to NOT load anything (antivirus etc). At one point the computer was rebooting itself for no reason while I was online and because I am often in online meetings I need for that reboot to be as quick as possible. Sorry I didn't mention that earlier.
I also live wayyy in the middle of nowhere so am on dialup - I'm not constantly connected to the net.

I'm attaching the notepad file as it is too long to post:

[texansays]

let me know of any next steps I can do


gosh I'm glad I found this forum!

[dvk01]

this should get control panel etc back
Start WinPFind3U. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Unregister Dlls]
[Registry - All]
< CurrentVersion Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\DisableRegistryTools -> 1
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\DisableTaskMgr -> 1
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WinOldApp\ -> 
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WinOldApp\\NoRealMode -> 1
< CurrentVersion Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoControlPanel -> 1
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> DirectAnimation Java Classes -> - CodeBase =
YN -> Microsoft XML Parser for Java -> - CodeBase =
YN -> Win32 Classes -> - CodeBase =
[Registry - Additional Scans - All]
< Software Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\policies\
YN -> HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Update\\NoAutoUpdate -> 1
YN -> HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Update\\NoWindowsUpdate -> 1
YN -> HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\\AutoUpdate -> 1
[Empty Temp Folders]
[Reboot]

The fix should only take a very short time and then you will be asked if you want to reboot. Choose Yes.

when it reboots


Post the following back here:

the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

then I strongly urge you to install an antivirus & keep it running at all times

[texansays]

Holy cow it worked! You guys are truly amazing ... I can't relay enough gratitude - thank you!

Here is the log file:
----------------------------------
[Registry - All]
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\syste m\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\syste m\\DisableTaskMgr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WinOl dApp\\NoRealMode deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explor er\\NoControlPanel deleted successfully.
Starting removal of ActiveX control DirectAnimation Java Classes
not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\DirectAnimation Java Classes\InprocServer32 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes deleted successfully.
Removal of ActiveX control DirectAnimation Java Classes complete!
Starting removal of ActiveX control Microsoft XML Parser for Java
not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\Microsoft XML Parser for Java\InprocServer32 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java deleted successfully.
Removal of ActiveX control Microsoft XML Parser for Java complete!
Starting removal of ActiveX control Win32 Classes
not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\Win32 Classes\InprocServer32 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Win32 Classes deleted successfully.
Removal of ActiveX control Win32 Classes complete!
[Registry - Additional Scans - All]
Registry value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Update\\NoAutoUpdate deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Update\\NoWindowsUpdate deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\\Aut oUpdate deleted successfully.
[Empty Temp Folders]
C:\DOCUME~1\VICKYK~1\LOCALS~1\Temp\ -> emptied.
C:\Documents and Settings\VICKY KOSUB\Local Settings\Temporary Internet Files\Content.IE5\ -> emptied
RecycleBin -> emptied.
< End of log >
Created on 03/12/2008 09:26:57

--------------------------------------

I encountered no issues while doing as you suggested but would like to ask a couple questions if you don't mind.
1. What lines (in the previous logs that I posted) pointed out the problem?
2. Was it indeed malware that caused this and if so, is there a name to that malware/virus/trojan?
3. I have several virus programs (McAfee, AVG, Avast, Zonealarm) .. which would you recommend I keep running in resident?

Again, thank you for your kind help, it's truly appreciated.

Vicki

[dvk01]

Only have 1 antivirus installed

uninstall all the others

It was probably a virus/trojan in the first place that caused it but as it was so long ago I am unsure whether any of the files will still show in any logs

Zone alarm is a firewall so that is OK to use and I would say that AVG should be OK as an antivirus for you

[dvk01]

Make sure you only install the Zone Alarm FIREWALL
DO NOT install ZA pro or ZA internet security which also contains a an Antivirus as taht will clash with AVG

The ZA antivirus doesn't seem as effective as many stand alone ones