Windows 8.1 .cpl files won’t open

Topic

New Reply

BACKGROUND

Back in October last year I installed an anti-ransomware application called CryptoPrevent on the recommendation of a security blog called KrebsOnSecurity.com. At the time a malicious file called CryptoLocker was doing the rounds and Krebs recommended CryptoPrevent to prevent the ransomware from doing its dirty work.

At the time I was also using the free version of Malwarebytes which didn’t include anti-exploit protection against ransomware and therefore CryptoPrevent seemed to be the ideal solution.

Some time after that CryptoPrevent was revised to include antivirus as well for the premium version which I decided to purchase. A few weeks later Malwarebytes introduced its latest version to include AV and anti-exploit/anti-ransomware together with a lifetime license for about $25 if my memory serves me correctly. Considering the Malwarebytes deal was better than the CryptoPrevent package which had to be renewed annually I uninstalled the latter.

CURRENT PROBLEM

I frequent Martin Brinkman’s ghacks.net site a lot and this morning he published an article concerning HP installing telemetry on users system. In the article Martin advised running appwiz.cpl to open Programs and Features to check whether the HP application had been installed. It’s at this particular juncture that all my troubles have started. The OS displays an error message that appwiz.cpl can’t be found even though it’s present in c:\windows\system32. Trying to run any .cpl file in the System32 directory results in the OS requesting which program the user wants to use to open it. Here’s an image of the choices and the clue is the one at the top needless to say: https://imgbox.com/IQde3dHY

I’ve been through the registry already and I think the culprit is this one: https://imgbox.com/9aWBchx7 But deleting the CryptoPrevent registry key shown in the top of the image only serves to cause the OS to display a message that it can’t find a file or a program to perform the task of running appwiz.cpl (I ran System Restore after that). I thought about using the value shown in the bottom of the image, but I’m not sure if that would be the correct value or not.

Although I regularly create system images I don’t have one anymore which dates from 2016 unfortunately i.e. before installing CryptoPrevent.

Neither sfc /scannow or DISM.exe/Online /Cleanup-image /Scanhealth results in a fix and both commands return a “no corruption found” result.

The registry hives shown in the image came from these two locations: HKEY_CLASSES_ROOT\cplfile\shell\cplopen\command

HKEY_CLASSES_ROOT\cplfile\shell\open\command

I ran “wmic product get > C:\InstalledPrograms.txt” hoping to get a CLSID GUID, but to no avail since the culprit isn’t present anymore: it’s just its d**n registry keys which have been left behind which are screwing with my system.

So any suggestions on how to rectify this anomaly guys?

Reply | Quote

Replies

Obvious question: Have you tried accessing the Control Panel through the GUI instead of trying to run the .cpl file?

Not so obvious question: Have you tried running a third party removal application?
CCleaner has a Registry cleaning tool. I don’t recommend running it blindly, but running each section separately and only removing items associated with CryptoPrevent. It can backup the Registry at each step.
Revo Uninstaller is quite a bit more aggressive and and you need to be very careful you don’t mess things up. But it delves a bit deeper finding the fragments. I advise caution if you use this.
Both of the above are free.

1 user thanked author for this post.

walker

Reply | Quote

PKCano wrote:

Obvious question: Have you tried accessing the Control Panel through the GUI instead of trying to run the .cpl file? Not so obvious question: Have you tried running a third party removal application? CCleaner has a Registry cleaning tool. I don’t recommend running it blindly, but running each section separately and only removing items associated with CryptoPrevent. It can backup the Registry at each step. Revo Uninstaller is quite a bit more aggressive and and you need to be very careful you don’t mess things up. But it delves a bit deeper finding the fragments. I advise caution if you use this. Both of the above are free.

Sure I can open Control Panel, but that’s not the point. I want my system to be working correctly and at the moment it isn’t.

I’m loathe to run CCleaner: it’s not an application I would recommend to anyone.

Reply | Quote

“I thought about using the value shown in the bottom of the image, but I’m not sure if that would be the correct value or not.”

Did you try the bottom value? It’s what my computer has for that value.

Reply | Quote

MrBrian wrote:

“I thought about using the value shown in the bottom of the image, but I’m not sure if that would be the correct value or not.” Did you try the bottom value? It’s what my computer has for that value.

Do you have both keys the same as I do i.e. cplfile —> shell —> cplopen —> command with a value of %SystemRoot%System32control.exe “%1”,%* ?

Do you also have a secondary key called open —-> command ? I’ve attached an image of the them here since it might be easier to work with.

Reply | Quote

I exported my Windows 7 computer’s HKEY_CLASSES_ROOT\cplfile.

1 user thanked author for this post.

Hitchhiker

Reply | Quote

MrBrian wrote:

I exported my Windows 7 computer’s HKEY_CLASSES_ROOTcplfile.

Didn’t help I’m afraid because the registry data at those locations is exactly the same as your cplfile. I do appreciate the effort you made to try and help though.

The problem here I think is the additional “open” —> “command” key below the default keys which is this one:

[HKEY_CLASSES_ROOTcplfileshellopencommand]
@=””C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.exe” “%1″ %*”

I tried modifying it this morning to be the same as the default value but that only results in the OS displaying the error you see in the screenshot. Another SR and back to square one again.

I thought it might help if I reinstalled Cryptoprevent expecting that it would create a CLSID key which I could subsequently use to uninstall it using Microsoft’s tool, but it didn’t create one.

It helped a bit to look at the advanced menu though and as you can see from the images it takes control of other file types as well. I used the option to “Undo protection” which clears all the boxes and rebooted as requested. The message which subsequently appears though could mean that the task completed successfully or failed.

There were three reg files in the Cryptoprevent directory which I copied before uninstalling it. These were:

[HKEY_LOCAL_MACHINESOFTWAREClasses.CPL]
@=”cplfile”
“Generic”=”system”

[HKEY_LOCAL_MACHINESOFTWAREClasses.CPLPersistentHandler]
@=”{098f2470-bae0-11cd-b579-08002b30bfeb}”

[HKEY_LOCAL_MACHINESOFTWAREClasses.SCR]
@=”scrfile”

[HKEY_LOCAL_MACHINESOFTWAREClasses.PIF]
@=”piffile”

I discovered this morning that I can’t access the menus for the system clock. It opens, but closes again as soon as “Change time and date settings…” is clicked. I can guess which application the culprit is.

 

Reply | Quote

Found something which might do the trick. There’s a Windows tool in Control Panel for changing file associations. In Win 8.1 it’s located in Default Programs —> Associate a file type or protocol with a specific program

I’ve attached an image showing .cpl with “Unknown application” under “Current default”. Can somebody please let me know which default program is listed there please.

Reply | Quote

On my Windows 7 computer, “Windows Control Panel” is listed. Might be control.exe.

1 user thanked author for this post.

Hitchhiker

Reply | Quote

I uses also use CryptoPrevent, currently the free Ver. 8.0.4.3

When I right click on the clock in the system tray and select “Adjust Date and Time”, I get a small pop-up window titled “CryptoPrevent”, and an error saying a restricted program has been blocked: C\Windows\system32\timedate.cpl.

When I go to Default Programs in Control Panel, and select the option “Associate a file type or protocol with a program” and look at the .cpl extension, it says it is defaulted to “CryptoPrevent Program Filter”.

If I then go to a system that does not have CryptoPrevent installed, and go to “Associate a file type or protocol with a program” in Control Panel, it says the default program for opening a .cpl extension is Windows Control Panel.

Back on the system with CryptoPrevent for a .cpl extension, I believe it you then would use the browse to a new program option, then browse to Windows\system32\control.exe, and set that as the default program, that might fix all Control Panel ‘apps’ so they will open from a shortcut, such at Adjust Time and Date.

Let me know if that fixes it, good luck.

 

1 user thanked author for this post.

Hitchhiker

Reply | Quote

If your name shows on your reply, you were logged in.

Reply | Quote

SkipH wrote:

I uses also use CryptoPrevent, currently the free Ver. 8.0.4.3 When I right click on the clock in the system tray and select “Adjust Date and Time”, I get a small pop-up window titled “CryptoPrevent”, and an error saying a restricted program has been blocked: C\Windows\system32\timedate.cpl. When I go to Default Programs in Control Panel, and select the option “Associate a file type or protocol with a program” and look at the .cpl extension, it says it is defaulted to “CryptoPrevent Program Filter”. If I then go to a system that does not have CryptoPrevent installed, and go to “Associate a file type or protocol with a program” in Control Panel, it says the default program for opening a .cpl extension is Windows Control Panel. Back on the system with CryptoPrevent for a .cpl extension, I believe it you then would use the browse to a new program option, then browse to Windows\system32\control.exe, and set that as the default program, that might fix all Control Panel ‘apps’ so they will open from a shortcut, such at Adjust Time and Date. Let me know if that fixes it, good luck.

Yes, setting .cpl to open with control.exe seems to have done the trick!

“appwiz.cpl” will now open directly from the Run command. I notice too that control.exe is also the file to open .pif files as well, so I can breathe a sigh of relief at last!

Reply | Quote

@Hitchhiker:  That’s good that method worked for you.

I had a couple of other ways to try to fix it, but they got more complicated.

There’s some little utility programs floating around to remove file associations, then you have to re-set them like I explained. I found the utility one time when some associations got really messed up and I used it to clear out the bogus ones.

Reply | Quote