"Windows 2000 Help" appears at StartUp

Hi all.
Got a problem with a workstation in my classroom.
Every time when Windows starts, I get the Windows 2000 Help file on my Desktop,
and I can't get it closed, it appears again and again.
Print Screen:

I looked in regedit:



and here

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Default User\Start Menu\Programs\Startup
C:\Documents and Settings\User\Start Menu\Programs\Startup

But found nothink.
Tried to search regedit with the word "help" "windows 2000"...but no result.

Logged in under Administrator (root) and it appears again.
Can't close the process, cose it's explorer.exe

I've recorded the situation with a program, take a look.
Sorry for the quality.
Link: http://www.savefile.com/files/959775
or : http://www.yourfilelink.com/get.php?fid=369916

Waiting for reply, 10x in advance.
Who is Participating?
SysExpertConnect With a Mentor Commented:
I would rename it to windows2.chm, and remember where it is, since otherwise you may not be able to access the windows help.

Hi EugenX

Try the following:
Click Start
Click Run
Type: Regedit
Click OK
Navigate to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
Create a Value: NoWelcomeScreen
Data Type: REG_DWORD
Value Data: (0 = default, 1 = hide)


Using Group Policy
Navigate to User Configuration\Administrative Templates\System\
Enable "Don't display the Getting Started welcome screen at logon"

Hope that helps.

malware or a corrupted registry.

I would start with Hijackthis.

malware - Leetutor list
Have you tried running virus scans and spyware scans  This could be a problem with viruses/trojans/spyware or other malware. Some free online virus scanners:




Also try these free programs to rid your system of spyware, trojans, and other malware:

Spybot - Search & Destroy

LavaSoft Ad-aware  

I use BOTH of the above programs on my 3 Windows systems; what one program misses, the other catches.  Also make sure to download the most up-to-date data before you run the programs.

Another very good freeware program for ridding yourself of spyware is this:


You might also try this free program (HijackThis) -- install it in its own folder, don't download to your Desktop:


HijackThis is a tool that is for advanced users, because it lists all the installed browser add-on and startup items, allowing you to inspect them and then optionally remove any ones you select.  You must be careful in choosing what to remove, although the program can create a backup of your original settings.  But put a check mark to fix any home page or search page setting that HijackThis detects which you have not entered yourself.  The program has an option to download online updates of the hijack data.

You should first post the log at this site:  


and it will be automatically analyzed for you (after you click on the button labeled "Analyze" near the bottom of the page), telling you which entries (called "Nasty") should be fixed.  You will also be told if you have any items that are "Possibly Nasty", or "Unnecessary", or "Unknown". If you don't know what to do about these, you might find something on the module name by doing a Google search of the internet.

If you have any questions about what it is asking you to fix that you would like the E-E experts to comment on, then do this:  right above the Analyze button you will see this message: "The following analyses has been stored temporarily", and there will be a link where the analysis file will be saved (for a period of three days). Click on it and then copy the link of that page from the address bar of your browser and paste it here, and experts can check it for you.  (Please DON'T post the entire log itself in your question.)

In case you would like to learn more yourself how to use HijackThis, here are a couple of urls:

HijackThis Quick Start

I hope this helps !
Cloud Class® Course: CompTIA Healthcare IT Tech

This course will help prep you to earn the CompTIA Healthcare IT Technician certification showing that you have the knowledge and skills needed to succeed in installing, managing, and troubleshooting IT systems in medical and clinical settings.

EugenXAuthor Commented:
2 matrixnz:

noop that didn't help.
In first place I don't have: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
...don't have Explorer key.

2'nd:  Enabled "Don't display..." with gpedit.msc but still no changes.
It's still appearing.

2 SysExpert:

I've scaned with Symantec Corporate Ed. and with LavaSoft AdAware - updated.
Found nothing...
I will use now HijackThis...

Waiting for other comments...
EugenXAuthor Commented:
Logfile of HijackThis v1.99.1
Scan saved at 3:44:43 PM, on 8/13/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Webserver\bin\stable\apache\apache.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\MPICH\mpd\bin\mpd.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Webserver\bin\stable\apache\apache.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0D182C3A-FFC1-444A-AACB-328452CDB3B0} (Controller Class) - https://stncenter.ets.org/adm/dcpProxy.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{BBBA7AED-260F-4BAF-AF91-B7142544A0F5}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{F74A7F67-DCB7-4002-8796-4755A3A8EDAE}: NameServer =
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - C:\oracle\TOADFO~1\RNetPin.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apache - Unknown owner - C:\Program Files\Webserver\bin\stable\apache\apache.exe" -k runservice (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare NT Utilities 2.6 (DNTUS26) - DameWare Development LLC - C:\WINNT\SYSTEM32\DNTUS26.EXE
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINNT\system32\DWRCS.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINNT\System32\mnmsrvc.exe
O23 - Service: MPICH2 Process Manager, Argonne National Lab (mpich2_smpd) - Argonne National Lab - C:\Program Files\MPICH2\bin\smpd.exe
O23 - Service: MPICH Daemon (C) 2001 Argonne National Lab (mpich_mpd) - Unknown owner - C:\Program Files\MPICH\mpd\bin\mpd.exe
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINNT\System32\msdtc.exe
O23 - Service: Windows Installer (MSIServer) - Unknown owner - C:\WINNT\system32\msiexec.exe
O23 - Service: MySQL - Unknown owner - C:\Program Files\Webserver\bin\stable\mysql\bin\mysqld.exe" MySQL (file missing)
O23 - Service: NuTCRACKERService - DataFocus, Inc. - C:\WINNT\system32\nutsrv4.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOracleFormsClientCache80 - Unknown owner - C:\OracleForms\BIN\ONRSD80.EXE
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDEngine.exe
O23 - Service: PDExchange - Raxco Software, Inc. - C:\Program Files\Tools\PerfectDisk\PDExchange.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

All procesess were found as: safe or very safe (or good one).

mdah...will I ever solve my problem ?!
EugenXAuthor Commented:
There is an Option "Jump to URL" with some information maybe useful, I don't know...here it is:

"Current URL: mk:@MSITStore:C:\WINNT\Help\windows.chm::/MS-ITS:NTDef.chm::/default.htm
 Jump to URL:"

I'm thinking what will be if I'll delete the windows.chm file (C:\WINNT\Help\windows.chm),
what will happen ?!
EugenXAuthor Commented:
I don't needed, I'm not a newbie...
I'll delete/rename it tommorow & c if somethin' happens !
EugenXAuthor Commented:
Problem solved by deleting/renaming windows.chm !
Great !  Please close and assign points.

EugenXAuthor Commented:
I don't see no "Close topic" tab or something like that, how to close this thread ?
Assign points to who ? I solved my problem myself, I can't assign the pointst to me !
With all my respect SysExpert: ...I can't accept your solution cose you don't got one.
Actually on
 Date:08.13.2007 at 09:45AM EST Your Comment      

Rank: Wizard
I would rename it to windows2.chm, and remember where it is, since otherwise you may not be able to access the windows help.

So My comment was what you used.

To close  see

EugenXAuthor Commented:
Look here:

08.13.2007 at 04:04PM EEST, ID: 19683555

I'm thinking what will be if I'll delete the windows.chm file (C:\WINNT\Help\windows.chm),
what will happen ?!

I've used my solution you  just suggested to rename it, nothing more.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.