Solved

Malware prevents Windows 98 Control Panel Icons from opening programs

Posted on 2004-04-06
21
1,222 Views
Last Modified: 2013-12-29
Had a malware that has been removed.  Now explorer home page can't be reset. Also when clicking on any icon on the control panel, the small window opens for that program and immediatedly closes.  Also with Norton open, when I click on live update, that window opens and immediately closes before you can get to it.  This prevents me of accessing or making any changes to any of the programs represented in the control panel.  I'm running Windows 98, SE.  Sounds like some changes have been made to the regustry.  Can you offer any resourses to help
0
Comment
Question by:metrostang
  • 7
  • 6
  • 4
  • +3
21 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 500 total points
ID: 10766694
Description of the System File Checker Tool (Sfc.exe)
http://support.microsoft.com/?kbid=185836


*****Can be run in one of two ways*****

From command line - USEFULL IF YOU CANT BOOT

sfc {enter}

If you can get the system to boot you can run from the GUI

System File Checker checks for damaged or replaced system files, and then prompts you to replace any files that do not match the original Windows 98 files.

To start System File Checker, follow these steps:
Click Start, point to Programs, point to Accessories, point to System Tools, click System Information, and then click System File Checker on the Tools menu.
Click one of the following options:
Scan For Altered Files
Extract One File From Installation Disk

NOTE: If you click Extract One File From Installation Disk, you can specify the file you want to extract.


Click Settings, choose the configuration you want to use in System File Checker Settings, click OK, and then click Start.


YOU WILL NEED YOUR 98  CD HANDY!!!!!!!!!!!!!!
0
 

Author Comment

by:metrostang
ID: 10766713
The system boots and every else works fine, including all other programs.  Will using file checker and repairing those files require reloading any software currently installed?
0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10766720

Try fixng your registry with this patch:

http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg

And also take a look at Lee Tutor's accepted answer in here:
http://www.experts-exchange.com/Operating_Systems/WinME/Q_20943392.html

Zee

0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10766723
If this does not solve the problem simply reinstall Win 98 over the top of itself this will repair all the system files and replace anything thats missing.



Pete
0
 
LVL 11

Expert Comment

by:Paul S
ID: 10767191
0
 

Author Comment

by:metrostang
ID: 10767447
I ran File Checker and replaced several corupted files.  Still have the same problem.  Main software will open from the desktop but those that are in the control panel will not open.  Tried the network icon on desktop and it temporarily opens, then closes.  Same with internet options from the control panel.  However, internet options will open from Internet Explorer.
Also tried the registry patchs mentioned above. One loaded, the other would not load.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 10767588
For your Control Panel problems, see if this page at my website is of any help:

http://home.earthlink.net/~leetutor/FixWin/ContPanl/control.htm
0
 

Author Comment

by:metrostang
ID: 10768121
Just discovered another symtom.  Shut down and restart do not respond.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10768178
I think you need to seriously think about installing 98 over the top of itself :)
0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10768279

Or even better, if you can backup all important data, go for a clean install with a format C:, before running setup?
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:metrostang
ID: 10768514
I was going to overwrite, but with both the original Windows 98 and SE version, the setup is disabled in one case because I have a newer version installed and in the other because I have an older version.  I'll have to uninstall and reinstall Windows 98 to do the trick.  I was hoping for a less drastic fix.

All programs are operating normally except for those on the control panel, Norton Antivirus and shut down/restart.

Just looked in my start menu and discovered a virus program called Wet_me!.exe.  I removed it with no change.  There isn't much on the web about this virus except that it is a hijack program.  Anyone know anything about or how to undo the damage.
0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10768680

Last shot, try this registry fix:

http://mvps.org/winhelp2002/RepairTabs.reg
1) Restores the missing Tabs in IE (usually spyware related)
2) Unlocks the grayed-out Home Page section
3) Removes the Administrator message in Internet Options

Zee

0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10768688
0
 

Author Comment

by:metrostang
ID: 10770074
Thanks for all of the suggestions.  I can't believe all of the fast responses I had this afternoon.  I've tried all of the programs suggested and so far nothing has worked.  If anyone else has any thoughts, I'm open to trying anything at this point.  

The computer is doing everything I need it to do at this point, but I'll not be able to change any settings, remove any programs or add hardware until this is solved.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 10770106
Did you try all the debugging steps listed at my website?  What were the results?
0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10770150

A selected quote from:

Control Panel Does Not Open
http://support.microsoft.com/default.aspx?scid=kb;en-us;221153

The .cpl files for Windows 98 are located in the C:\Windows\System folder.

1. Create a new folder on your desktop called "temp" (without quotation marks). To do this, right click and empty area on your desktop, point to New, click Folder, and then type temp.

2. Move all of the .cpl files out of the System32 folder and into the Temp folder that you created.

3. Verify that Control Panel opens. Note that Control Panel does not contain icons after you move all of the .cpl files out of the System32 folder.

4. Move the .cpl files back into the System32 folder, one at a time, and then open Control Panel after you move each file to verify that Control Panel opens.

5. If you move a .cpl file back into the System32 folder, and Control Panel does not open, delete the file, or replace the file with a known, good .cpl file.

Additional Information

In Windows 98, all of the base Control Panel .cpl files are on your Windows 98 CD-ROM and are located in the compressed Win98_28.cab file.
 
NOTE: You can also double-click each .cpl file to determine if it runs. When you double-click a .cpl file, the associated Control Panel tool runs.

Did you try this?

Zee
0
 

Author Comment

by:metrostang
ID: 10770860
blue zee - I did go though many of the troubleshooting steps on your site and found that neither the command nor double clicking on the .cpl files would open them.  Also moved one from the 98 CD, again it wouldn't open.

In searching though some of the sites mentioned in this thread, I came accross a mention of someone getting a virus through the Microsoft Updater.  I had updated windows just before all of this started and had been ask to download a new copy of the Updater before getting the updates.  I didn't relate this to my problems because I knew I had gotten at least two trojan viruses and this file came from Microsoft.

I opened in the Safe Mode and was able to open Add/Remove Programs, so I uninstalled the Updater, then did a Scan and Defragment.  When I restarted the computer, everything is back to normal.

I don't think I actually downloaded the Microsoft Updater with a virus, but apparently one of the viruses infected that file and it was the instrument used to control the computer since it was in the start menu and opened every time I booted.  A smart way to do it since a Microsoft file that you knew came from Microsoft would be the last place to look.

Thanks to everyone here for the help.  I've learned more than I ever wanted to know about viruses and the inner workings of windows.  This is a valuable resourse that I will recommend to others.  Thanks again for taking the time to help someone who got into deep trouble for lack of keeping informed about the dangers of the internet.
0
 
LVL 27

Expert Comment

by:Asta Cu
ID: 10771395
This was an interesting information flow, and I'm still baffled that you could have gotten this from Microsoft; but rather a masked item much like those noted here (NOT FOR POINTS, of course):
http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=microsoft+updater+startup+malware

Hopefully you've guarded yourself against new invasions (software, free or fee)  and modified your Browser settings to guard against unwanted downloads/installs and use firewall, etc.  
0
 
LVL 29

Expert Comment

by:blue_zee
ID: 10772384

Glad you made it.

Zee
0
 

Author Comment

by:metrostang
ID: 10774936
I don't think the virus was actually in the Microsoft file I dowmloaded, but rather that the malware used that file to do it's work even after I had deleted the virus.  I ddn't make any manual changes to the registry entries.  One of the patches mentioned earlier may have taken care of that for me.  The only action was to uninstall the Microsoft Updater program and reboot.  After that, everything was back to normal, except thanks to you folks, I now have the tools and knowledge to deal with this should it happen again.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10776157
ThanQ
0

Featured Post

Too many email signature updates to deal with?

Do you feel like you are taking up all of your time constantly visiting users’ desks to make changes to email signatures? Wish you could manage all signatures from one central location, easily design them and deploy them quickly to users? Well, there is an easy way!

Join & Write a Comment

A Bare Metal Image backup allows for the restore of an entire system to a similar or dissimilar hardware. They are highly useful for migrations and disaster recovery. Bare Metal Image backups support Full and Incremental backups. Differential backup…
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now