Operation Cancelled Due to Restrictions and other problems

jot2003 · #1 11-12-2003, 10:29 AM

Hi,

I run WinXP Home with Norton IS 03, with firewall and antivirus. A week ago I noticed AV was mysteriously shutting down its auto protect ability all by itself. A few days ago, the Norton icons disappeared from the icons in the bottom right. I tried to run NIS, but it said I was not logged on. So I logged on a supervisor, and tried to activate security, but nothing happened.

This is extremely frustrating since it is hard to find advice on what to do when the buttons do nothing.

I also cannot enable auto-protect.

You may think this is more of a NIS issue, but something else strange has happened. I cant run msconfig.exe, I get the message "Operation cancelled due to restrictions in effect on this computer. PLease contact admin."

But I AM the admin. I am the only user, and I have the only account. I've checked and it has admin privileges.

NIS says there are 3 user accounts in operation, mine, a guest ("not logged in") account with restricted abilites, and one that says ASPNET. I've no idea what this is.

I've checked task manager and services for suspicious looking processes/ services. Restarted, NIS and auto-protect, rebooted PC plenty of times, done windows update. Ran virus scan and killed 18 w32.kwbots, ran ad-adware and spybot. I'm at a loss.

I even installed ZoneAlarm free firewall, but it has disabled itself. I get the same message about restrictions on the computer. So it's now been uninstalled!

I can't get to msconfig in anyway, which is bizarre. I can't believe someone can block me on my own PC.

I am on a university network, but I don't think they would do something like this (why would they want to?).

I simply don't know what to do!

jot2003 · #2 11-12-2003, 10:40 AM

Here's another interesting problem. I can't see the windows folder. I can get to it by typing c:\windows but it doesn't appear when I go to C.
I haven't changed to folder options, and anything I do to them makes no difference.
This sounds minor, but it's just all very wierd.

chance · #3 11-12-2003, 10:48 AM

http://vil.nai.com/vil/stinger/
download the stinger program and scan your system, sounds like you have worms i had a computer come to me last week with the same trouble. it had severaand i removed them all with the stinger reinstalled the programs that did not work correctly.

ESALADUANE · #4 11-12-2003, 10:49 AM

W32.Kwbot.Worm is a Kazaa virus. For W32.Kwbot.Worm to spread, it requires that the KaZaA software be installed on the computer.

Here's Symantec's page on it.

http://securityresponse.symantec.com...wbot.worm.html

jot2003 · #5 11-12-2003, 11:02 AM

OK, thanks, I'm running stinger now, hopefully it will help. I have KazaaLite, but I haven't used it for a few days. Norton AV fixed or deleted 18files with the kwbot worm.

jot2003 · #6 11-12-2003, 11:14 AM

McAfee AVERT Stinger Version 1.9.1 built on Nov 11 2003

Copyright (C) 2002-2003 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Nov 11 2003.

Ready to scan for 33 viruses, trojans and variants.

Scan initiated on Wed Nov 12 15:55:48 2003

Number of clean files: 154763

So I guess it didn't find anything....

ESALADUANE · #7 11-12-2003, 11:26 AM

Stinger is only useful against a virus that's in its virus definitions library. The Stinger site doesn't list W32.Kwbot.Worm. Restart in safe mode, redo your virus scan and follow the removal instructions on the Symantec site.

snowmonkey · #8 11-12-2003, 12:47 PM

ESALADUANE is corrcect,, Stinger (or FixWelch.exe known by NAV) were release ONLY for one virus and that was"Welchia" so don't count on Stinger remove every virus for you.

cheers

jot2003 · #9 11-12-2003, 04:30 PM

Well I booted in safe mode, redid the norton virus scan (yes, it's up to date), took 1hr 22mins and no viruses found.
The registry values I'm meant to delete do not seem to exist.

And my PC crashed in safe mode.

Things aren't looking good!

chance · #10 11-12-2003, 07:36 PM

take your computer completely off the internet, uninstall norton, firewall, anti virus, live reg, live update, and any other norton/symantic product you have, even ghost, after all the rebooting from uninstall is done, get your xp cd, even if it is format and recovery, drop it in the cd drive, close any screens that pop up from it. go to start/run/ type in sfc /scannow
click ok and it will replace any damaged system files. once this is done go to C: drive, or what ever your drive letter is your operating system uses and delete the symantec and norton folders. i suggest you use a reg cleaner, but i dont like to suggest a particular one, just what ever you want to use, reboot and reinstall the norton products you have.