cannot find /Q file

Everytime I turn on my computer a Window Help box comes up and says, "Cannot
find /Q file. Do yo want to try to find it yourself? Yes No

I check either one,no difference and then it goes away, but it is annoying
and shouldn't happen. How can I get rid of it?

Thanks-
Susan

Please do the following:

Go to StartRun, type in MSINFO32, then press Enter. In the System Information
utility that comes up, click on the + sign by "Software Environment", then click
on "Startup Programs." Click anywhere in the right-hand pane, then press Ctrl-A
to Select All, then press Ctrl-C to Copy. Open a Reply to this message and in
the message pane, press Ctrl-V to Paste in the info. Then send the message.

--
Gary S. Terhune
MS MVP Shell/User

"susan in cali" wrote in message
...
Everytime I turn on my computer a Window Help box comes up and says, "Cannot
find /Q file. Do yo want to try to find it yourself? Yes No

I check either one,no difference and then it goes away, but it is annoying
and shouldn't happen. How can I get rid of it?

Thanks-
Susan

"susan in cali" wrote in message
...
Everytime I turn on my computer a Window Help box comes up and says,
"Cannot
find /Q file. Do yo want to try to find it yourself? Yes No

I check either one,no difference and then it goes away, but it is
annoying
and shouldn't happen. How can I get rid of it?

Thanks-
Susan

That may be somehow related to the /Q switch
which is an install program option
which means be quiet AKA sneaky when doing an install.

Somebody may be trying to sneak something onto your PC
or there may be a perfectly reasonable explanation for it.

Things that I would look for a

Right-click each Desktop shortcut.
See if /Q appears in the Target box of a shortcut.

Check C:\WINDOWS\Start Menu\Programs\StartUp
Anything suspect there?

Run SYSEDIT. Check each file for /Q

Run MSCONFIG. Check each entry for /Q

Run REGEDIT. Click EDIT and select FIND....
Run a search for /Q.
I left that one for last, as it may take a while.

MySoftware InterCom Startup Group "C:\Program Files\Common
Files\MySoftware\intercom.exe"
Office Startup Startup Group "C:\Program Files\Microsoft
Office\Office\OSA.EXE" -b
Forget Me Not Startup Group C:\WINDOWS\WINHLP32.EXE /Q
Microsoft Find Fast Startup Group "C:\Program Files\Microsoft
Office\Office\FINDFAST.EXE"
Verizon Online Support Center Startup Group "C:\Program Files\Verizon
Online\SupportCenter\bin\matcli.exe" -boot
Spyware Begone Registry (Per-User Run) C:\SPYWAREBEGONE\SPYWAREBEGONE.EXE
-FastScan
ScanRegistry Registry (Machine Run) c:\windows\scanregw.exe /autorun
TaskMonitor Registry (Machine Run) c:\windows\taskmon.exe
SystemTray Registry (Machine Run) SysTray.Exe
LoadPowerProfile Registry (Machine Run) Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
IOMON98.EXE Registry (Machine Run) "C:\Program Files\Trend PC-cillin
98\IOMON98.EXE"
RegisterDropHandler Registry (Machine
Run) C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
CHotKey Registry (Machine Run) mk9805.exe
cAg0u Registry (Machine Run) C:\WINDOWS\SYSTEM\7745B180.hta
LoadQM Registry (Machine Run) loadqm.exe
POINTER Registry (Machine Run) point32.exe
Motive SmartBridge Registry (Machine
Run) C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.ex e
IPInSightLAN 01 Registry (Machine Run) "C:\PROGRAM FILES\VERIZON
ONLINE\VISUAL IP INSIGHT\IPClient.exe" -l
IPInSightMonitor 01 Registry (Machine Run) "C:\PROGRAM FILES\VERIZON
ONLINE\VISUAL IP INSIGHT\IPMon32.exe"
Microsoft Works Update Detection Registry (Machine Run) C:\Program
Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
QuickTime Task Registry (Machine Run) "C:\WINDOWS\SYSTEM\QTTASK.EXE"
-atboottime
StillImageMonitor Registry (Machine Run) C:\WINDOWS\SYSTEM\STIMON.EXE
LexStart Registry (Machine Run) lexstart.exe
mdac_runonce Registry (Machine Run) C:\WINDOWS\SYSTEM\runonce.exe
Lexmark X6100 Series Registry (Machine Run) "C:\Program Files\Lexmark X6100
Series\lxbfbmgr.exe"
Welcome Registry (Machine Run) C:\WINDOWS\Welcome.exe /R
LoadPowerProfile Registry (Machine Service) Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
IOMON98.EXE Registry (Machine Service) "C:\Program Files\Trend PC-cillin
98\IOMON98.EXE"
RegisterDropHandler Registry (Machine
Service) C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
SchedulingAgent Registry (Machine Service) mstask.exe
MSNIA Registry (Machine Service) C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE


"Gary S. Terhune" wrote:

Please do the following:

Go to StartRun, type in MSINFO32, then press Enter. In the System Information
utility that comes up, click on the + sign by "Software Environment", then click
on "Startup Programs." Click anywhere in the right-hand pane, then press Ctrl-A
to Select All, then press Ctrl-C to Copy. Open a Reply to this message and in
the message pane, press Ctrl-V to Paste in the info. Then send the message.

--
Gary S. Terhune
MS MVP Shell/User

"susan in cali" wrote in message
...
Everytime I turn on my computer a Window Help box comes up and says, "Cannot
find /Q file. Do yo want to try to find it yourself? Yes No

I check either one,no difference and then it goes away, but it is annoying
and shouldn't happen. How can I get rid of it?

Thanks-
Susan

---
Forget Me Not Startup Group C:\WINDOWS\WINHLP32.EXE /Q
---

The above would appear to be the immediate problem. The first section, =
"Forget Me Not" is the name of a shortcut in your Start\Programs\Startup =
menu (that's what the "Startup Group" notation means.) Do you know what =
"Forget Me Not" is about? WINHLP32.EXE is Windows Help. It isn't the =
Help file itself, it's the application used to read help files. What it =
expects to find instead of "/Q" is the path to a Help file--which "/Q" =
is not.

I don't know how it got there, but there is a known security =
vulnerability in WINHLP32 that has to do with forcing a buffer overflow. =
Whether what you have is evidence of an attempt to force such an =
overflow in order to gain access to your machine--I don't know. I'm not =
a wizard in this area. But what you have is definitely wrong. I would =
delete that shortcut from your Start\Programs\Startup menu. If you know =
what "Forget Me Not" is supposed to be, post back with that information.

You also, I believe, have the KAK worm virus on your machine. Or it's =
been cleaned off but still has startup commands in place. If you aren't =
getting error messages relating to 7745B180.hta, then it is probably =
still alive and kicking.

Meanwhile, I will comment on the rest of your Startup applications, =
below. You might also want to read my "Security!" article at =
http://grystmill.com/articles/security.htm, and it's companion article, =
"Clean Boot--What it is and why you need it". =
http://grystmill.com/articles/cleanboot.htm

--=20
Gary S. Terhune
MS MVP Shell/User
=20
"susan in cali" wrote in message =
...
MySoftware InterCom Startup Group "C:\Program Files\Common =
Files\MySoftware\intercom.exe"

I don't know what this is for. It could be a legitimate program, or it =
could be malicious. I find references to it both as a legit file and as =
a possible trojan-like item. Do *you* know what it is?

Office Startup Startup Group "C:\Program Files\Microsoft =
Office\Office\OSA.EXE" -b

This is a standard Office program. You can delete the shortcut with no =
real adverse effect, but the next time you run the Office installer for =
any reason, it will come back.

Forget Me Not Startup Group C:\WINDOWS\WINHLP32.EXE /Q

We've talked about this one.

Microsoft Find Fast Startup Group "C:\Program Files\Microsoft =
Office\Office\FINDFAST.EXE"

This is another Office program, a file indexer. It is known to cause =
problems, and it is usually best to get rid of it altogether. =
Instructions he
http://support.microsoft.com/default...b;en-us;199787

Verizon Online Support Center Startup Group "C:\Program Files\Verizon =
Online\SupportCenter\bin\matcli.exe" -boot

This one gathers info about your computer in order for Verizon Online =
Support to know who you are.

Spyware Begone Registry (Per-User Run) =
C:\SPYWAREBEGONE\SPYWAREBEGONE.EXE -FastScan

This is a "Rogue Spyware Removal" program. See:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

I recommend that you uninstall it, then read my "Security!" article for =
suggestions for good anti-spyware programs.

ScanRegistry Registry (Machine Run) c:\windows\scanregw.exe /autorun

This is one of the five basic startup items in Windows. Checks your =
Registry's integrity and creates a backup if one has not already been =
created today.

TaskMonitor Registry (Machine Run) c:\windows\taskmon.exe

Standard startup item #2. Keeps track of your usage in order to optimize =
Defrag.

SystemTray Registry (Machine Run) SysTray.Exe

Standard item #3--Provides a place for your clock and volume control.

LoadPowerProfile Registry (Machine Run) Rundll32.exe =
powrprof.dll,LoadCurrentPwrScheme
LoadPowerProfile Registry (Machine Service) Rundll32.exe =
powrprof.dll,LoadCurrentPwrScheme

Standard items #4 and #5. Loads your power management settings. Once =
before loggin on and once afterwards. Leave both in place.

IOMON98.EXE Registry (Machine Run) "C:\Program Files\Trend PC-cillin =
98\IOMON98.EXE"

Part of your antivirus program.

RegisterDropHandler Registry (Machine Run) =
C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE

Provides a place to drop files into TextBridge.

CHotKey Registry (Machine Run) mk9805.exe

Supports your keyboard.

cAg0u Registry (Machine Run) C:\WINDOWS\SYSTEM\7745B180.hta

This is the KAK Worm virus. See:
http://www3.ca.com/securityadvisor/v...aspx?ID=3D9589

LoadQM Registry (Machine Run) loadqm.exe

Comes with Windows Messenger. Not needed.

POINTER Registry (Machine Run) point32.exe

A mouse support program.

Motive SmartBridge Registry (Machine Run) =
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.ex e
IPInSightLAN 01 Registry (Machine Run) "C:\PROGRAM FILES\VERIZON =
ONLINE\VISUAL IP INSIGHT\IPClient.exe" -l
IPInSightMonitor 01 Registry (Machine Run) "C:\PROGRAM FILES\VERIZON =
ONLINE\VISUAL IP INSIGHT\IPMon32.exe"

All three of the above are Part of your Verizon Online programming. I =
dont' know which are really necessary.

Microsoft Works Update Detection Registry (Machine Run) C:\Program =
Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
Lives in the background and occasionally checks for updates for your =
Works program. Not really necessary but if you disable it, you should =
manually check every once in a while.

QuickTime Task Registry (Machine Run) "C:\WINDOWS\SYSTEM\QTTASK.EXE" =
-atboottime
This is installed by QuickTime, a multimedia player. I usually get rid =
of this one.

StillImageMonitor Registry (Machine Run) C:\WINDOWS\SYSTEM\STIMON.EXE

This one monitors for signals from your scanner. If you don't use teh =
buttons on your scanner to initiate scans, you can delete it--or you can =
leave it.

LexStart Registry (Machine Run) lexstart.exe

Similar to the above, it's a program that monitors your Lexmark machine =
(you perhaps have a multi-function printer/fax/scanner?) Probably should =
leave it.

mdac_runonce Registry (Machine Run) C:\WINDOWS\SYSTEM\runonce.exe

Like the name says, this should have run once and then deleted itself =
(deleted teh command, not the file itself.) I'd get rid of this command, =
but it's no biggy.

Lexmark X6100 Series Registry (Machine Run) "C:\Program Files\Lexmark =
X6100 Series\lxbfbmgr.exe"

More Lexmark stuff.

Welcome Registry (Machine Run) C:\WINDOWS\Welcome.exe /R

May be a trojan, mmay not. Whatever it is, I'd remove this command and =
see if it gets reinstated.

IOMON98.EXE Registry (Machine Service) "C:\Program Files\Trend =
PC-cillin 98\IOMON98.EXE"

Same as the previous one, but like LoadPowerProfile, this one gets =
loaded before you log on--in case you don't log on or use Cancel (log on =
as Default user,) your antivirus will still be running. For what it's =
worth, I don't like PC-Cillan. For much the same reasons I don't like =
Norton or McAfee antivirus (see my article.)

RegisterDropHandler Registry (Machine Service) =
C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE

Again, a version of teh TextBridge desktop drop icon that loads as a =
service incase you don't log on.

SchedulingAgent Registry (Machine Service) mstask.exe

Task Scheduler. You should look to see what Tasks you have in Task =
Scheduler.

MSNIA Registry (Machine Service) C:\PROGRA~1\MSN\MSNIA\MSNIASVC.EXE

Part of MSN. Not really needed, but not harmful.

--=20
Gary S. Terhune
MS MVP Shell/User