How to stop Paint from opening automatically and from getting the message "C:\WINDOWS\SYSTEM32\-check.bmp was not found

Posted on 2005-03-09
Medium Priority
Last Modified: 2010-04-12
A co-worker in my office used has a Dell notebook computer that had Windows 98 installed on it at the factory.  He used a Windows 2000 Reinstall disk to try to upgrade the computer to Windows 2000.  I believe that the Reinstall disk is not a reformatting disk but I might be wrong about that. Anyway, the computer runs but whenever it is turned on, a untitled paint file opens up and then a msgbox pops up with the message: "C:\WINDOWS\SYSTEM32\-check.bmp was not found".  I believe this has something to do with Windows 98 having a FAT file system and Windows 2000 having an NTFS.  Any idea how to stop Paint from opening up automatically and from getting that message?  I tried just deleting any Paint files completely but they seem to regenerate whenever I turn the computer on.  My co-worker does not have a reformat disk.  All he has is the Windows 2000 Reinstall disk I mentioned above which he has from a different computer.      
Question by:dbfromnewjersey
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
LVL 23

Accepted Solution

Danny Child earned 250 total points
ID: 13497888
sounds like there's a reference to a file check.bmp somewhere in your startup settings, hence launching paint with a blank window, and producing the error.

Check the Start.. Programs.. Startup folder

also this Q (where I posted some similar stuff about 2 mins ago, spookily enough...)
LVL 23

Expert Comment

by:Danny Child
ID: 13497922
of course, you're getting the error because that file doesn't exist, so searching for it is pointless too.  Just for fun, you could create one, and then watch it get opened on startup...

one more idea - check the desktop settings - rclick a blank bit, Properties.. Background tab.. and set the Background to (None)
could be your wallpaper!
LVL 35

Assisted Solution

by:Nirmal Sharma
Nirmal Sharma earned 250 total points
ID: 13504249
Execuse me guys...let me say something :-)

Once you log on to your system...any program listed or their refrences will be executed only and only from these locations. Check all the locations..if you find the path or program related to the above simply remove it.

Look in the following locations for startup programs that may be suspect:
START-UP FOLDER Windows opens every item in the Start Menu's Start Up folder.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Default User\Start Menu\Programs\Startup
C:\Documents and Settings\YourUserName\Start Menu\Programs\Startup

Windows executes all instructions in the "Run", "RunServices", "RunOnce", and "RunServicesOnce" sections of the Windows Registry.

Windows executes instructions in the shell and classes sections of the Registry. Any command imbedded here will open when any exe file is executed. Look for anything other than "\"%1\" %*", if they are changed to something like "\"badboy.exe %1\" %*", then they are automatically invoking the specified file.
[HKEY_CLASSES_ROOT\exefile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] ="\"%1\" %*"

Look in the System location of the registry to locate all suspect services running including Type 1 services that do not normally appear in the GUI display.
Explorer registry entries:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\explorer\User Shell Folders]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]

Other miscellaneous possible registry locations include:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
[HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] ="Scrap object" "NeverShowExt"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Currentversion\Windows\AppInit_Dlls]

BATCH FILES Windows executes instructions in the winstart.bat and autoexec.bat batch files.

Win.ini Look for a "run=" or "load=" line with a suspect program.

System.ini Look for a "shell=" line with a suspect program.

TASK SCHEDULER Windows executes autorun instructions in the Windows Task Scheduler (or any other third party scheduler that supplements or replaces the Task Scheduler). Look in the c:\windows\tasks folder for suspect programs.

EXPLORER.EXE Windows loads explorer.exe as a shell the first time it is executed during the boot process which is typically located in the c:\windows directory. However, if c:\explorer.exe exists, it will be executed instead of the c:\windows\explorer.exe. If c:\explorer.exe is corrupt or a Trojan, bad things can happen. Just delete the file to fix the problem.

run the following download on the PC, and all should be restored
sounds like some of the spyware may have intruded on your tcp\ip stack, running this will restore it to its original condition. (I have seen Newdotnet do this to many computers.)

LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13504256
Sorry by mistake posted it..

run the following download on the PC, and all should be restored
sounds like some of the spyware may have intruded on your tcp\ip stack, running this will restore it to its original condition. (I have seen Newdotnet do this to many computers.)

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Hey fellow admins! This time, I have a little fairy tale for you. As many tales do, it starts boring and then gets pretty gory. I hope you like it. TL;DR: It is about an important security matter, you should read it if you run or administer Windows …
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Suggested Courses
Course of the Month11 days, left to enroll

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question