Windows Forum

Ask something
Discussion Locked

Apparent Virus In Notepad

0 helpful
5 replies

by casemaker

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
I had a customer open notepad for the first time and the file that opened was C:\winnt\system32\notepad. when it opeened it is all giberish, a mixture of characters and text. The file was 212 pages total with many page breaks and column breaks.The computer is on a wan with the main plant in NY. The system runs W2000 Pro. I ran innoculate and no file viruses were found. Is this a file virus or is it normal. The file did not open on the other 6 computers but it was on them. when I open it it appears to be a little different.
Thanks

5 replies

by gary_w

Your customer opened an executable file. The 'gibberish' is the ascii representation of the control characters inside the file. Not a problem.

by mphoffar

I remember the QAZ worm did something like this. What it did was rename the notepad.exe to something like note.com and replaced it with another version.

You could check this by looking at the file zie of notepad. Normally, notepad is only 52 or 53K where the worms version of notepad was over 120K

To manually remove it, all you should have to do is delete the notepad file and remove the reg entry to starts it. Of coarse you'd have to extract or copy over the original notepad.exe when you're done.

If you want more info on this, go to www.avertlabs.com and checkout their virus liubrary, it should tell you all you need to know about it.

Mark

This discussion is closed to new replies.