How to stop Paint from opening automatically and from getting the message "C:\WINDOWS\SYSTEM32\-check.bmp was not found

Posted on 2005-03-09
Medium Priority
Last Modified: 2010-04-12
A co-worker in my office used has a Dell notebook computer that had Windows 98 installed on it at the factory.  He used a Windows 2000 Reinstall disk to try to upgrade the computer to Windows 2000.  I believe that the Reinstall disk is not a reformatting disk but I might be wrong about that. Anyway, the computer runs but whenever it is turned on, a untitled paint file opens up and then a msgbox pops up with the message: "C:\WINDOWS\SYSTEM32\-check.bmp was not found".  I believe this has something to do with Windows 98 having a FAT file system and Windows 2000 having an NTFS.  Any idea how to stop Paint from opening up automatically and from getting that message?  I tried just deleting any Paint files completely but they seem to regenerate whenever I turn the computer on.  My co-worker does not have a reformat disk.  All he has is the Windows 2000 Reinstall disk I mentioned above which he has from a different computer.      
Question by:dbfromnewjersey
  • 2
  • 2
LVL 23

Accepted Solution

Danny Child earned 250 total points
ID: 13497888
sounds like there's a reference to a file check.bmp somewhere in your startup settings, hence launching paint with a blank window, and producing the error.

Check the Start.. Programs.. Startup folder

also this Q (where I posted some similar stuff about 2 mins ago, spookily enough...)
LVL 23

Expert Comment

by:Danny Child
ID: 13497922
of course, you're getting the error because that file doesn't exist, so searching for it is pointless too.  Just for fun, you could create one, and then watch it get opened on startup...

one more idea - check the desktop settings - rclick a blank bit, Properties.. Background tab.. and set the Background to (None)
could be your wallpaper!
LVL 35

Assisted Solution

by:Nirmal Sharma
Nirmal Sharma earned 250 total points
ID: 13504249
Execuse me guys...let me say something :-)

Once you log on to your system...any program listed or their refrences will be executed only and only from these locations. Check all the locations..if you find the path or program related to the above simply remove it.

Look in the following locations for startup programs that may be suspect:
START-UP FOLDER Windows opens every item in the Start Menu's Start Up folder.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Default User\Start Menu\Programs\Startup
C:\Documents and Settings\YourUserName\Start Menu\Programs\Startup

Windows executes all instructions in the "Run", "RunServices", "RunOnce", and "RunServicesOnce" sections of the Windows Registry.

Windows executes instructions in the shell and classes sections of the Registry. Any command imbedded here will open when any exe file is executed. Look for anything other than "\"%1\" %*", if they are changed to something like "\"badboy.exe %1\" %*", then they are automatically invoking the specified file.
[HKEY_CLASSES_ROOT\exefile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] ="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] ="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] ="\"%1\" %*"

Look in the System location of the registry to locate all suspect services running including Type 1 services that do not normally appear in the GUI display.
Explorer registry entries:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\explorer\User Shell Folders]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]

Other miscellaneous possible registry locations include:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
[HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] ="Scrap object" "NeverShowExt"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Currentversion\Windows\AppInit_Dlls]

BATCH FILES Windows executes instructions in the winstart.bat and autoexec.bat batch files.

Win.ini Look for a "run=" or "load=" line with a suspect program.

System.ini Look for a "shell=" line with a suspect program.

TASK SCHEDULER Windows executes autorun instructions in the Windows Task Scheduler (or any other third party scheduler that supplements or replaces the Task Scheduler). Look in the c:\windows\tasks folder for suspect programs.

EXPLORER.EXE Windows loads explorer.exe as a shell the first time it is executed during the boot process which is typically located in the c:\windows directory. However, if c:\explorer.exe exists, it will be executed instead of the c:\windows\explorer.exe. If c:\explorer.exe is corrupt or a Trojan, bad things can happen. Just delete the file to fix the problem.

run the following download on the PC, and all should be restored
sounds like some of the spyware may have intruded on your tcp\ip stack, running this will restore it to its original condition. (I have seen Newdotnet do this to many computers.)

LVL 35

Expert Comment

by:Nirmal Sharma
ID: 13504256
Sorry by mistake posted it..

run the following download on the PC, and all should be restored
sounds like some of the spyware may have intruded on your tcp\ip stack, running this will restore it to its original condition. (I have seen Newdotnet do this to many computers.)

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Whether you have a site with just static html pages or a dynamic database-driven one, this step-by-step migration guide will help you get started with your new DV server. This guide is by no means comprehensive but it should cover the basics to get …
Integration Management Part 2
How can you see what you are working on when you want to see it while you to save a copy? Add a "Save As" icon to the Quick Access Toolbar, or QAT. That way, when you save a copy of a query, form, report, or other object you are modifying, you…
Suggested Courses

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question