disable the restriction please... (W98)

[sindiket]

hello guys,
i want make my toolbar auto-hide..so i must click the "properties" on my toolbar
i've got error on it
Windows said "This Operation Has Been Cancelled Due To Restrictions In Effect On This Computer.Please Contact Your System Adminstrator"
This my computer..im the admin..
plss plss

-newbies™-

[DeQuincey]

(There is no 'admin' in win98 ;p )

Open up the registry (click on 'Start' button, select 'Run,' type 'regedit' in the box, hit the enter key)

Look for this path:

"HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer"

In that key you'll find this value:

"NoSetTaskbar"

It should be of type "REG_DWORD," set it equal to zero.

Reboot.



If you see a whole lot of "No..." in that key, post back...you may have been hit w/ a trojan.

Check here:

http://www.europe.f-secure.com/v-descs/offens.shtml

e.g. if you see a bunch the are in the list, post back so we can work on finding out just which one and how to get rid of it.

<P ID="edit"><FONT class="small">Edited by DeQuincey on 05/23/02 15:10.</FONT></P>

[sindiket]

thanks so much
thx thx
yeah i found to many NO there
"NoClose"
"NoDrives"
"NoDriveTypeAutoRun"
"NoFileMenu"
"NoNetHood"
"NoRecentDocsMenu"
"NoRun"
"NoSaveSettings"
"NoSetFolders"
"NoSetTaskBar"

is that what u meant ?

-newbies™-

[MWoodage]

It looks like you may have been hit by something disabling much of your access. You should delete all these except the "NoDriveTypeAutoRun" entry, because all these are restrictions, it seems one is hiding your shut down menu. Once you have deleted these restart and run regedit again check the same key and see if the entries have reappeared or if they have stayed deleted (bad english!) Cheers


<font color=green> MWoodage </font color=green>

[DeQuincey]

Yup.

Some of those values may be desirable. e.g. I have:
NoRecentDocsMenu
NoFavoritesMenu

'cause I hardly ever use these menus off the start menu and I don't want them taking up space.

So, check your registry against the keys/values listed at the link I provided earlier. This way we'll know if you've been hit by tojan described on that page.

[sindiket]

should i set the value to 0 ??

-newbies™-

[Mocha]

Just delete those keys, and the ones you want to keep, set value to 1.

Carol

[sindiket]

which keys

-newbies™-

[Mocha]

As MWoodage stated....You should delete all these except the "NoDriveTypeAutoRun" entry, because all these are restrictions.

Delete these:
"NoClose"
"NoDrives"
"NoFileMenu"
"NoNetHood"
"NoRecentDocsMenu"
"NoRun"
"NoSaveSettings"
"NoSetFolders"
"NoSetTaskBar"

[Hally]

Hi Ive noticed I have all these are in my gegistry under that key no no no, but the thing that confuses me is I have VM version 3805 & it says in the link you provided that I'm supposedly safe. Also I have IE6.0 fully updated Win98se also updated. . .but it has to be said how could this be in my registry? I'm a bit worried has anyone got some news or views on this. . . Thanks in Advance
---Hally---

[MWoodage]

Post in this thread <font color=red>all</font color=red> the values you found beginning with No. We will tell you which ones to delete. If you are already aware of which ones are setting restrictions delete them and restart, now rerun the registry and check if the values are still there or not - post back with the results.

<font color=green> MWoodage </font color=green>

[Hally]

Thank you so much MWoodage this is what was exported to desktop from registry, its a worry!
I wonder if there is any other stuff thats happened from this Thanks again ---Hally---

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=hex:b5,00,00,00
"NoStartBanner"=hex:01,00,00,00
"NoRecentDocsHistory"=hex:01,00,00,00
"NoLogoff"=hex:01,00,00,00
"NoRecentDocsMenu"=hex:01,00,00,00
"NoFavoritesMenu"=hex:00,00,00,00
@=hex:01,00,00,00
"NoDrives"=dword:00000000
"NoNetHood"=dword:00000001
"NoInternetIcon"=hex:01,00,00,00
"NoTrayContextMenu"=dword:00000000
"NoViewContextMenu"=dword:00000000
"NoSetFolders"=dword:00000000
"NoWindowsUpdate"=dword:00000000
"NoChangeStartMenu"=dword:00000000
"ClearRecentDocsOnExit"=dword:00000000
"NoFileMenu"=dword:00000000
"NoExpandedNewMenu"=dword:00000000
"NoToolBarCustomize"=dword:00000000
"NoBandCustomize"=dword:00000000
"NoActiveDesktopChanges"=hex:01,00,00,00
"NoActiveDesktop"=hex:01,00,00,00
"CDRAutoRun"=hex:00,00,00,00
"ClassicShell"=hex:00,00,00,00

[MWoodage]

It appears the majority of the values are set to 0 meaning they aren't taking any affect so they are most likely to have been put there by your manufacturor. The restrictions that are taking affect are:- NoRecentDocsHistory, NoStartBanner, NoLogOff, NoInternetIcon, NoRecentDocsMenu, @, NoNetHood, NoActiveDesktop and NoActiveDesktopChanges - that's all of them. You can delete these but there's no need to worry as they are pretty harmless restrictions and it is very likely this isn't a trojan. To be on the safe side though once you have deleted the values restart and check your registry again to make sure they have stayed deleted. <font color=blue>Good luck!</font color=blue>

<font color=green> MWoodage </font color=green>

[Hally]

I Thank you very much for your help I feel allot better knowing that, Excellent work guys
---Hally---

[Hally]

Hi there here is a page on the Trojan that DeQuincy
was telling you about

http://securityresponse.symantec.com/avcenter/venc/data/trojan.js.offensive.html

Just copy\paste into address bar & hit go or enter
Have a Good Read of it Bye ---Hally---

[tnguy]

Hally, you can place [Xurl] before, and [x/url] (remove the X) after a web address to make it clickable.

TNguy
Network Administrator
(I am looking for an employment change, see my BIO)

[Hally]

I really appreciate your help tnguy I'm just starting to learn HTML & this is a big help thanks!
<font color=blue>yippee I've mastered it. . . good one!</font color=blue>
<a target="_blank" href=http://securityresponse.symantec.com/avcenter/venc/data/trojan.js.offensive.html>http://securityresponse.symantec.com/avcenter/venc/data/trojan.js.offensive.html</a>

<font color=purple>---Hally--- </font color=purple>