Tom's Guide | Tom's Hardware | Tom's Games | PC Safety Suite
![]() |
![]() |
![]() |
Comment:
I had a friend up grade my computer and there are things that don't seem right but he's avoiding my phone calls.
So I'm really glad to have found this forum.
Here's a "few" of my problems (exact terms would be helpful because I'm not sure of all the abbreviations please)1.there are 2 set of some things in my control panel (2 modems, 2 displays and they are exact) How do I get rid of one of them?
2.When I use my short cut to my dial up I click on it then another dial up screen comes up, if I click cancel on the most recent screen then it shuts down completely. My way around it for now is to just move it to the corner and when the browser pops up it's hidden.
3. I can go into Windows help files, click on troubleshooting but then the screen goes blank. I noticed this when I was having display setting problems with video card (another thread after I fix these!)and I can't find the help files.
I know this is long but there seems to be so many little problems and I want to get this thing fixed - and nobody gives me advice for free here in this little town!!!
Thanks so much gang!!
+1 | ![]() |
Hi Crackerjack,
Go here and download,some of these programs..And run them...
Beansoup Links
Post back if you don't know which ones to download...Peace
beansoup
+1 | ![]() |
Thanks for responding beansoup (gotta like the name!)
Can you tell me which ones to download? I could read through each one but how will they help these problems??
Thanks again
+1 | ![]() |
I think beansoup suspects some sort of malware on your machine. This is not at all uncommon and can cause all sorts of problems.
I would start with Ad-Aware & SpyBot, followed by CWShredder. If you then run "Hijack This" and paste the log on here, someone will be able to tell you if it is clean.
It's not difficult to get shot of the double entries in CP (.cpl files) but perhaps we should wait and see if any of these progs help first.
D
+1 | ![]() |
Hi y'all
Right on Derek:-) You were reading my mind:-)
(what's left of it:-)Hi Crackerjack,
The ones Derek mentioned are the ones I think will do some help..We'll see if they help..
Spywareblaster is sort of a preventive tool..If you enter it in startup, it will stop parasites from coming in..
Regprot, notifies you of new enteries into your registry..Yes or No choice...Those two I have in startup..
In response:
1. Like Derek says, we'll wait on that one..
2. Try configuring IE to dialup when you open IE. That way you stay away from shortcuts...Tools/Internet options/connections..Choose always "Always use mt default connection" Go to Outlook Exp, tools/options/connection..Remove any checks in dialup...
3. Work on that later...Peace
beansoup
+1 | ![]() |
Ok
Have downloaded and run both spybot and ad aware....I "destroyed" what was recommended.
Now Hijack had this informoation:
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.exe
C:\WINDOWS\SYSTEM\MPREXE.exe
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.exe
C:\WINDOWS\SYSTEM\MSTASK.exe
C:\WINDOWS\SYSTEM\DDHELP.exe
C:\MEDIA95\VI_GRM.exe
C:\WINDOWS\TASKMON.exe
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.exe
C:\WINDOWS\LOADQM.exe
C:\WINDOWS\SYSTEM\SYSTRAY.exe
C:\WINDOWS\RUNDLL32.exe
C:\PROGRAM FILES\LEXMARK X74-X75\LXBBBMGR.exe
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WND.exe
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\UNLOAD\HPQCMON.exe
C:\WINDOWS\SYSTEM\STIMON.exe
C:\PROGRAM FILES\LEXMARK X74-X75\LXBBBMON.exe
C:\WINDOWS\SYSTEM\LEXBCES.exe
C:\INTERNET KEYBOARD\MEDIAKEY.exe
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SHARE-TO-WEB\HPGS2WNF.exe
C:\WINDOWS\SYSTEM\RPCSS.exe
C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.exe
C:\INTERNET KEYBOARD\KBOSDCTL.exe
C:\INTERNET KEYBOARD\KCODEMSG.exe
C:\WINDOWS\SYSTEM\WMIEXE.exe
C:\WINDOWS\SYSTEM\LEXPPS.exe
C:\PROGRAM FILES\INCREDIMAIL\BIN\IMAPP.exe
C:\PROGRAM FILES\POP BLOCKER\UPDATEDL.exe
C:\WINDOWS\EXPLORER.exe
C:\WINDOWS\SYSTEM\RNAAPP.exe
C:\WINDOWS\SYSTEM\TAPISRV.exe
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\Program Files\Copernic Agent\Web\SearchBar.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
R3 - URLSearchHook: (no name) - {C12B4EC1-1F65-11D3-91CA-00104B9C4765} - C:\Program Files\Copernic 2000\CopernicFind.dll (file missing)
R3 - URLSearchHook: PerfectNavBHO Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
F1 - win.ini: load=C:\MEDIA95\vi_grm.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NavErrRedir Class - {A045DC85-FC44-45be-8A50-E4F9C62C9A84} - C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: Updated.Toolbar - {9F6A22E6-1682-4F82-9B72-6314794CB253} - C:\PROGRAM FILES\POP BLOCKER\UPDATED.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [MCCInstall] D:\INTRO\AA\MCCINSTALL\ENGLISH\MCCINSTALL.exe -Step=9 -Settings
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.exe
O4 - HKLM\..\Run: [MediaKey] C:\INTERN~1\Mediakey.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.exe /AUTOSTART
O4 - HKLM\..\Run: [$EnterNet] C:\PROGRA~1\EFFICI~1\ENTERN~1\APP\ENTERNET.exe -AutoStart
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Search Using Copernic Agent - C:\Program Files\Copernic Agent\Web\SearchExt.htm
O9 - Extra 'Tools' menuitem: Launch Copernic Agent (HKLM)
O9 - Extra button: Copernic Agent (HKLM)
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/Flash/swflash.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37875.4108796296
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003080601/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CABWhat do I do from here?
I do like Kazaa and Incredimail so if I can help it I don't want anything to happen to them but otherwise there's nothing I can think of.I solved the #2 question - we bought a modem for high speed so now I don't have to worry about dial up!
But #1 and #3 still aren't solved.I really do appreciate this!
+1 | ![]() |
Sorry to say that from what I've read over the years on these pages Kazaa is one of the main sources of malware. I believe Kazaa Lite is OK. I have a feeling the same is true of Incredimail but I'm not absolutely certain.
I'll ask the Security & Virus forum to have a look at your log. They will be far better at it than I.
D
+1 | ![]() |
Thanks D!
Now what do I do with the hijack log? I haven't touched it waiting for a reply. I read through some of the other posts about hijack but they don't seem to apply to my situation so will wait.
I had some problems with Kazaa after doing the spybot and adaware so uninstalled then reinstalled but only lite.
Just need to know now what to do....will wait for more help.
Thanks.
+1 | ![]() |
Right. I rather thought the S&V forum would reply directly on this link but I did get one response on what I posted there (#5), see this:
http://computing.net/security/wwwboard/forum/8622.html
The post got confused by someone else stupidly posting their "Hijack This" log on the same thread. It seems like it is suggesting that your "Hijack This" log was fine so maybe our assumption that this was spyware/malware based is incorrect.Despite this I still feel there is nothing lost in doing what I suggested downloading at least the ones I gave in #3. Even if they don't help this time they are likely to help in the future. The same applies to SpywareBlaster (afterwards) because this is an excellent free preventer. None of these use resources in the background.
Did you try beansoups item 2 in #4?
I think we'll leave the Help file problem for a bit - two things at a time LOL.
As for your doubled control panel entries it goes like this. All of these are files that end with the extension .cpl and are normally located in c:\windows\system. The only exceptions may be the odd one in c:\windows\sysbackup.
Windows will not allow two files of the same name in the same folder so the incorrect ones must either have a wrong name or be located elsewhere.
Sorry if it's a bit long winded but I think the only safe way forward is as follows:
1. Indicate which CP icons are duplicated.
2. List out "all" the icon names in CP.
3. Type *.cpl in the Run box. This will list all of the .cpl files. Let me know what all of them are called and where they are located.
Hopefully I can then suggest which ones you could try saving somewhere (for safety) then deleting. You can double click any .cpl yourself of-course. This will bring up the CP item which may be a help to you.
Moving on, I think it might be worth trying a couple of harmless aspirins (LOL) that are harmless but have been known to fix many general problems:
1. Go to Control Panel/Add-Remove and double click the Microsoft IE & Tools entry. If this gives a repair option go for it.
2. "Shut down" to MS-DOS and type scanreg /fix (followed by Return key). This will rebuild your current registry which might help if it has got a little corrupted. Type exit (Return) to restart Windows.
I think it would be worthwhile doing the latter 1 & 2 so that they are out of the way. Best to save thrashing around if the boring old fixes happen to help.
Derek
+1 | ![]() |
Ok
I went to that thread.
I have performed the scan/reg and it successfully fixed the reg.Onto the CP icons. I have paris of the mouse, display, keyboard, fonts. modems. network and printers.
I went to run but there's a problem - it said it couldn't find the files *.cpl or one of it's components.
So I went to FIND and it found these:
Appwiz.cpl
Desk.cpl
Main.cpl
Desk!!.cpl
Maio !.cpl
Modem !.cpl
Netcpl0!.cpl
Stygpl.cpl
Modem.cpl
Intl.cpl
Joy.cpl
Mmsys.cpl
Netcpl.cpl
Odbccp32.cpl
Passwork.cpl
Powercfg.cpl
Sticpl.cpl
Tweakui.cpl
Qtw16.cpl
QuickTime.cpl
Speech.cpl
Findfast.cpl
s32lucpl.cpl
bdeadmin.cpl
Micfg32.cpl
Slcpappl.cpl
Themes.cpl
Qtw32.cpl
setnote.cpl
prefcpl.cpl
Inetcpl.cpl
Sysdm.cpl
Telephon.cpl
Timedate.cpl
Cmicnfg.cpl
Joy.cpl
Joy.cpl
Cmicnfg.cpl
coreldrw.cplIt's all mumble jumble to me but don't give up on me yet!!!
It also seems like it's snowballing from one thing to another but I'm hopeful it will all get figured out.
Thanks for your patience.
Crackerjack
+1 | ![]() |
Sounds complicated.
Before we monkey around with .cpl files we should set ourselves up with some way to restore things to their current sitation if need be. There is a chance the registry may not approve all our changes.
Make up a folder in C called CPFiles and a sub-folder CWS. Using Find, Copy/Paste all those .cpl files from "C:\Windows\System" into "C:\CPFiles\CWS"
Now make up sub-folders in CPFiles (with meaningful names) for any .cpl files that are NOT in C:\Windows\System
Get the idea?If you don't already know, you can block copy by highlighting a file at the start of a block, hold Shift key then click a file at the end of a block. They will then all highlight for copying over in one go. You can add odd extra files by holding Ctrl key and then clicking on them.
OK, so we are now backed up.
I can translate a few of your duplicates:
main.cpl is the Mouse
desk.cpl is the Display
modem.cpl is obviously the Modem
netcpl.cpl is Network
joy.cpl is Gaming Options (Joystick).Using Find, note which ones above work from the .cpl files when clicked on. Arrange that any of these "clickable" ones are put in c:\windows\system and delete other duplicates unless they happen to be in C:\Windows\Sysbckup (in which case put a "clickable" one in there too). You then need to check that they funcion properly from the Control Panel itself.
I note you have 3 joy.cpl files and also that you have some weird ones with ! after them. The latter will have to be renamed without the ! and replaced with "clickeable" copies if at all possible.
After this we will probably be left with some problems to think about, as follows:
1. Those that should turn out not to be "clickeable" from any file (possibly requiring program re-install).
2. Keyboard, fonts, printers which are NOT .cpl files. Fonts is effectively a shortcut to C:\Windows\Fonts but unfortunately you cannot insert shortcuts into the Control Panel itself, nor delete the icons from there.
To be honest the only sure way of sorting this all out is to reformat (shock horror) but we'll leave that on the back burner for now, unless you feel this might be easier than fiddling around with all this, which still might leave too many problems around.
I'm none too convinced that just re-installing Windows over the top will clear these duplicates though I suppose it might end up worth trying if the only alternative is reformatting anyway.
Let me know how you get on, sorry it's a bit heavy going....
D
+1 | ![]() |
Well I have managed to get rid of every one except mouse (which it says the system is using so can't delete)fonts, keyboard and printers.
I guess it's no big deal just a pain in my butt cause I can't seem to fix it! So I'll let it go.
Now I'm left with not able to make up a start up disk (I go into Add/remove then click on the start up tab) and it won't let me......seems like problem #4.
BTW - I have reinstalled Win 98 already but I still can't get an activity in the help files - problem #3.
Off to a snowy day today....the snowball is getting bigger!LOL
C
+1 | ![]() |
Glad to see there has been "some" progress.
Did you double click Maio!.cpl to see what you got? I'm just wondering if this is a corrupted version of Main.cpl (mouse). The .cpl files with ! in them are not normal - never seen those before. You could always bin Maio!.cpl and see what happens. If it produces a bad result restore it back out of the bin.
As for the "help", I suppose it's just about possible that one of the files in c:\windows\help has got corrupted. These all appear to be involved so it could be worth just replacing the lot.
Windows.chm
Windows.chw
Windows.cnt
Windows.hlp
Winhlp32.cnt
Winhlp32.hlpYou type sfc in the Run box, select file extract and get them off the W98SE CD. Go for the option to save the orginals (they turn up in c:\windows\helpdesk\sfc).
If you see any of the originals with a date that is different to the majority of the files on your CD then this means that they have been updated. Put those back afterwards if at all possible by copying them over to c:\windows\help.
In my case Windows.chw and Windows.cnt had both been updated. I did have problems with a corrupt Windows.cnt way back in my W95 days.
As for the rest of your problems, I'll keep thinking but am fast running out of ideas. It all seems a bit of a muddle. Having got a tad further you could always repost your current problems to see if anyone else comes along with some bright ideas.
I would normally advise you to install Windows in again over the top, but it sounds like you have already done that. Reformatting is the ultimate option but you would need to be absolutely sure you had all the drivers and programs available because everything would go.
D
+1 | ![]() |
We have made progress……I started up the computer this morning to check your message on what to do next and I went into “find” for the cpl files. I double clicked on the ! file and it won’t work so only could drag into the bin……my whole control panel is now back to normal and no doubles and everything worked!! Thank you so very much for solving this dilemma.
I will start a new thread with the windows help file problem and see what comes of it.
![]() |
Debug utility
|
Swen virus
|

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.