"Windows 2000 Help" appears at StartUp

Posted on 2007-08-10
Last Modified: 2010-05-18
Hi all.
Got a problem with a workstation in my classroom.
Every time when Windows starts, I get the Windows 2000 Help file on my Desktop,
and I can't get it closed, it appears again and again.
Print Screen:

I looked in regedit:



and here

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Default User\Start Menu\Programs\Startup
C:\Documents and Settings\User\Start Menu\Programs\Startup

But found nothink.
Tried to search regedit with the word "help" "windows 2000"...but no result.

Logged in under Administrator (root) and it appears again.
Can't close the process, cose it's explorer.exe

I've recorded the situation with a program, take a look.
Sorry for the quality.
or :

Waiting for reply, 10x in advance.
Question by:EugenX
    LVL 29

    Expert Comment

    Hi EugenX

    Try the following:
    Click Start
    Click Run
    Type: Regedit
    Click OK
    Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    Create a Value: NoWelcomeScreen
    Data Type: REG_DWORD
    Value Data: (0 = default, 1 = hide)


    Using Group Policy
    Navigate to User Configuration\Administrative Templates\System\
    Enable "Don't display the Getting Started welcome screen at logon"

    Hope that helps.

    LVL 63

    Expert Comment

    malware or a corrupted registry.

    I would start with Hijackthis.

    malware - Leetutor list
    Have you tried running virus scans and spyware scans  This could be a problem with viruses/trojans/spyware or other malware. Some free online virus scanners:

    Also try these free programs to rid your system of spyware, trojans, and other malware:
    Spybot - Search & Destroy
    LavaSoft Ad-aware  

    I use BOTH of the above programs on my 3 Windows systems; what one program misses, the other catches.  Also make sure to download the most up-to-date data before you run the programs.

    Another very good freeware program for ridding yourself of spyware is this:

    You might also try this free program (HijackThis) -- install it in its own folder, don't download to your Desktop:

    HijackThis is a tool that is for advanced users, because it lists all the installed browser add-on and startup items, allowing you to inspect them and then optionally remove any ones you select.  You must be careful in choosing what to remove, although the program can create a backup of your original settings.  But put a check mark to fix any home page or search page setting that HijackThis detects which you have not entered yourself.  The program has an option to download online updates of the hijack data.

    You should first post the log at this site:

    and it will be automatically analyzed for you (after you click on the button labeled "Analyze" near the bottom of the page), telling you which entries (called "Nasty") should be fixed.  You will also be told if you have any items that are "Possibly Nasty", or "Unnecessary", or "Unknown". If you don't know what to do about these, you might find something on the module name by doing a Google search of the internet.

    If you have any questions about what it is asking you to fix that you would like the E-E experts to comment on, then do this:  right above the Analyze button you will see this message: "The following analyses has been stored temporarily", and there will be a link where the analysis file will be saved (for a period of three days). Click on it and then copy the link of that page from the address bar of your browser and paste it here, and experts can check it for you.  (Please DON'T post the entire log itself in your question.)

    In case you would like to learn more yourself how to use HijackThis, here are a couple of urls:
    HijackThis Quick Start

    I hope this helps !
    LVL 2

    Author Comment

    2 matrixnz:

    noop that didn't help.
    In first place I don't have: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    ...don't have Explorer key.

    2'nd:  Enabled "Don't display..." with gpedit.msc but still no changes.
    It's still appearing.

    2 SysExpert:

    I've scaned with Symantec Corporate Ed. and with LavaSoft AdAware - updated.
    Found nothing...
    I will use now HijackThis...

    Waiting for other comments...
    LVL 2

    Author Comment

    Logfile of HijackThis v1.99.1
    Scan saved at 3:44:43 PM, on 8/13/2007
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Webserver\bin\stable\apache\apache.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\MPICH\mpd\bin\mpd.exe
    C:\Program Files\Symantec AntiVirus\SavRoam.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\Webserver\bin\stable\apache\apache.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O16 - DPF: {0D182C3A-FFC1-444A-AACB-328452CDB3B0} (Controller Class) -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BBBA7AED-260F-4BAF-AF91-B7142544A0F5}: NameServer =
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F74A7F67-DCB7-4002-8796-4755A3A8EDAE}: NameServer =
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\oracle\TOADFO~1\RNetPin.dll
    O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
    O23 - Service: Apache - Unknown owner - C:\Program Files\Webserver\bin\stable\apache\apache.exe" -k runservice (file missing)
    O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: DameWare NT Utilities 2.6 (DNTUS26) - DameWare Development LLC - C:\WINNT\SYSTEM32\DNTUS26.EXE
    O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\system32\DWRCS.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB7\webserver\bin\win32\matlabserver.exe
    O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINNT\System32\mnmsrvc.exe
    O23 - Service: MPICH2 Process Manager, Argonne National Lab (mpich2_smpd) - Argonne National Lab - C:\Program Files\MPICH2\bin\smpd.exe
    O23 - Service: MPICH Daemon (C) 2001 Argonne National Lab (mpich_mpd) - Unknown owner - C:\Program Files\MPICH\mpd\bin\mpd.exe
    O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINNT\System32\msdtc.exe
    O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINNT\system32\msiexec.exe
    O23 - Service: MySQL - Unknown owner - C:\Program Files\Webserver\bin\stable\mysql\bin\mysqld.exe" MySQL (file missing)
    O23 - Service: NuTCRACKERService - DataFocus, Inc. - C:\WINNT\system32\nutsrv4.exe
    O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
    O23 - Service: OracleOracleFormsClientCache80 - Unknown owner - C:\OracleForms\BIN\ONRSD80.EXE
    O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
    O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDAgent.exe
    O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDEngine.exe
    O23 - Service: PDExchange - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDExchange.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

    All procesess were found as: safe or very safe (or good one).

    mdah...will I ever solve my problem ?!
    LVL 2

    Author Comment

    There is an Option "Jump to URL" with some information maybe useful, I don't it is:

    "Current URL: mk:@MSITStore:C:\WINNT\Help\windows.chm::/MS-ITS:NTDef.chm::/default.htm
     Jump to URL:"

    I'm thinking what will be if I'll delete the windows.chm file (C:\WINNT\Help\windows.chm),
    what will happen ?!
    LVL 63

    Accepted Solution

    I would rename it to windows2.chm, and remember where it is, since otherwise you may not be able to access the windows help.

    LVL 2

    Author Comment

    I don't needed, I'm not a newbie...
    I'll delete/rename it tommorow & c if somethin' happens !
    LVL 2

    Author Comment

    Problem solved by deleting/renaming windows.chm !
    LVL 63

    Expert Comment

    Great !  Please close and assign points.

    LVL 2

    Author Comment

    I don't see no "Close topic" tab or something like that, how to close this thread ?
    Assign points to who ? I solved my problem myself, I can't assign the pointst to me !
    With all my respect SysExpert: ...I can't accept your solution cose you don't got one.
    LVL 63

    Expert Comment

    Actually on
     Date:08.13.2007 at 09:45AM EST Your Comment      

    Rank: Wizard
    I would rename it to windows2.chm, and remember where it is, since otherwise you may not be able to access the windows help.

    So My comment was what you used.

    To close  see
    LVL 2

    Author Comment

    Look here:

    08.13.2007 at 04:04PM EEST, ID: 19683555

    I'm thinking what will be if I'll delete the windows.chm file (C:\WINNT\Help\windows.chm),
    what will happen ?!

    I've used my solution you  just suggested to rename it, nothing more.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Occasionally Windows/Microsoft Updates will fail to update. We have found a code that will delete all temporary files and re-register all dll's related to Windows/Microsoft Updates! This works 99% of the time to get the updates working again! The…
    In a recent article here at Experts Exchange (, I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now