Jump to content
IObit Forum
Top Free Driver Updater Tools Best 25 PC Optimization Software Best 22 Antimalware Best 22 Uninstaller Software IObit Coupons & Discount Offers PC Optimizer

Can't open notepad.


blacksea

Recommended Posts

Interesting... and I've never seen that before.

 

Could be the firewall blocking Notepad even though you can't find anything in the options ; there could be corruption (in the firewall) or a block that isn't being reported.

 

Can you check something ? Right-click on that notepad.exe.orig file and choose Properties : check the creation date, maybe that'll ring a bell as to what created it.

 

You may also have other similar files (notepad.exe.orig) in dllcache for instance. Would be good to check...

 

One thing is for sure : something is blocking Notepad and a firewall or any HIPS program would be first on the suspect list.

 

The file you had analysed at VirusTotal is perfectly fine, and thank you for the log ;-)

 

Happy hunting 8-)

Link to comment
Share on other sites

  • Replies 56
  • Created
  • Last Reply

Hi blacksea

Perhaps the problem just is the double extensions.

notepad.exe.orig.

Try renaming it to notepad.exe(original)

Or just delete it.

In window/system32 a fresh copy will be instantly created if you delete the notepad.exe that is located there.

Cheers

solbjerg

It also looked as if you had tried to exchange the windows Notepad with a third party application??

Cheers

solbjerg

P.s. please read the link in my signature!! All of it!!

 

@ So_sad & Solbjerg,

 

I did what you 2 asked and here are the result of both.

Link to comment
Share on other sites

Hello all ;

 

enoskype : I'm seeing December 6 ('09) as creation date in the first screenshot, for notepad.exe.orig

 

Did some searching and can't find the exact program that might have done that.

.orig files are sort of generic and created as backups ; by what, I don't know in this case. Something wanted to remove notepad.exe and made a backup of the file first (on December 6). Both in %WinDir% and in %SysDir%.

No notepad.exe in dllcache directory, so Windows isn't protecting it ; that's not a concern anyway because whatever happened back in early December isn't happening anymore (no files being deleted).

notepad.exe in "System32" (%SysDir%) should run because it is a good file, but it doesn't, so something is blocking it from running, and only blocking it from "System32".

 

blacksea : I honestly think you should uninstall your firewall. If malware did hit back in December, it could have damaged it (the firewall) and now it's blocking things without reporting them.

 

I did a test here, just for fun : I renamed a legitimate notepad.exe to notepad.exe.orig and stuffed it in %SysDir% alongside notepad.exe : this didn't stop Notepad from running normally, from the shortcut.

 

We need to find the blocker...

 

===

Link to comment
Share on other sites

Hi So_sad

I left a comment about it in his other post about MsDOS, sorry I should have placed it here too!!

Take a look if you like

Cheers

solbjerg

p.s. found your "stairway to heaven" comment funny :-)

especially if one interprets "heaven" to be here! :-) :-)

 

 

Hello all ;

 

enoskype : I'm seeing December 6 ('09) as creation date in the first screenshot, for notepad.exe.orig

 

Did some searching and can't find the exact program that might have done that.

.orig files are sort of generic and created as backups ; by what, I don't know in this case. Something wanted to remove notepad.exe and made a backup of the file first (on December 6). Both in %WinDir% and in %SysDir%.

No notepad.exe in dllcache directory, so Windows isn't protecting it ; that's not a concern anyway because whatever happened back in early December isn't happening anymore (no files being deleted).

notepad.exe in "System32" (%SysDir%) should run because it is a good file, but it doesn't, so something is blocking it from running, and only blocking it from "System32".

 

blacksea : I honestly think you should uninstall your firewall. If malware did hit back in December, it could have damaged it (the firewall) and now it's blocking things without reporting them.

 

I did a test here, just for fun : I renamed a legitimate notepad.exe to notepad.exe.orig and stuffed it in %SysDir% alongside notepad.exe : this didn't stop Notepad from running normally, from the shortcut.

 

We need to find the blocker...

 

===

Link to comment
Share on other sites

OK,

 

I think something worth trying came to my mind.

 

blacksea, please install Unlocker 1.8.8 , then you will have the unlocker option in right click menu of all files.

 

Right click on notepad.exe in C:\WINDOWS\SYSTEM32\notepad.exe, and see if a window will be opened explaining if a locking handle is present.

 

If there is a locking handle, please attach the screenshot.

 

Cheers.

Link to comment
Share on other sites

Hi enoskype,

 

I download the Unlocker and I used it on Notepad. It was telling me that noting was interrupting or blocking the file. It was askin me to 'Taken no action' 'Rename the file' 'Remove' or to 'replace' it. I chose for taking no action because the others wouldn't be helping to open it I think.

 

Edit: @So_sad, the program mentioned by enoskype told me that nothing was blocking the file. But do you think a clean install of my firewall will still be needed ?

Blacksea.

Link to comment
Share on other sites

Hi Solbjerg,

 

I deleted notepad.exe.orig as you said. And tried to reopen it and

unfortunately I did not see a result.

 

'It also looked as if you had tried to exchange the windows Notepad with a third party application??'

 

I'm sorry but I don't know what you mean by third party application.

And it's okay, I will read the links in your signatures. But what does the usage of IObit apps. has to do with the problem I get with notepad?

 

Sincerely

Blacksea.

 

 

Hi blacksea

Perhaps the problem just is the double extensions.

notepad.exe.orig.

Try renaming it to notepad.exe(original)

Or just delete it.

In window/system32 a fresh copy will be instantly created if you delete the notepad.exe that is located there.

Cheers

solbjerg

It also looked as if you had tried to exchange the windows Notepad with a third party application??

Cheers

solbjerg

P.s. please read the link in my signature!! All of it!!

Link to comment
Share on other sites

Hi blacksea,

 

I can't see the creation dates.

Why there are only 2 files which are from Prefetch folder?

Where are the other notepad.... files in the search window?

Did you make a search for a date, or what? I can't understand you.

 

Did you try the Unlocker to replace notepad.exe at C:\WINDOWS\SYSTEM32\notepad.exe with the working notepad.exe at C:\WINDOWS\notepad.exe?

 

Cheers.

Link to comment
Share on other sites

Hi enoskype,

 

You asked me to search again for notepad but now with the creation date. That's what I did. But the date was wrong. I made a new search with his original date.

 

And I replaced the notepad at SYSTEM32 with the WINDOWS one. Also nothing changed.

 

But after deleting the notepad at SYSTEM32 and replacing the one at WINDOWS, a new notepad file came up. I tried to open it, and guess what. Now I get the same error like SYSTEM32..

 

Hi blacksea,

 

I can't see the creation dates.

Why there are only 2 files which are from Prefetch folder?

Where are the other notepad.... files in the search window?

Did you make a search for a date, or what? I can't understand you.

 

Did you try the Unlocker to replace notepad.exe at C:\WINDOWS\SYSTEM32\notepad.exe with the working notepad.exe at C:\WINDOWS\notepad.exe?

 

Cheers.

Link to comment
Share on other sites

why not replace notepad with this alternative

 

http://www.majorgeeks.com/Notepad_X_d5798.html

 

Hi Sunny,

 

It's not like I need the notepad very much, but I didn't understand why I got that error when I was trying to open Notepad.

 

I also have wordpad, so I can use that instead of Notepad. So I actually don't need Notepad X. But still thanks.

 

Blacksea.

Link to comment
Share on other sites

Blacksea,

 

Please go to folder options and :

-Choose "Display the contents of system folders"

-Choose "Show hidden files and folders

-Unchek "Hide extentions for known file types"

-Uncheck "Hide protected operating system files (Recommended)"

 

 

After we finish , you can revert back to what you wish.

 

The file you think notepad.exe is notepad.exe.orig file, and it will not work. You shouldn't delete the notepad.exe at C:\Windows.

 

Please follow the suggestions exactly, otherwise we do not see what we want to see and go to the wrong direction..

 

 

NOW:

 

Create the "Date created" column in search and search for all "notepad", make sure that the screenshot includes the creation dates so as we can see all the files with notepad name in them.

 

Cheers.

Link to comment
Share on other sites

Hi enoskype,

 

Im really sorry but I quite don't know what you mean with "Create the "Date created" column in search". Is this right as I do it like shown in the attachment? And I did all the other things you asked me to do.

 

Blacksea.

 

Blacksea,

 

Please go to folder options and :

-Choose "Display the contents of system folders"

-Choose "Show hidden files and folders

-Unchek "Hide extentions for known file types"

-Uncheck "Hide protected operating system files (Recommended)"

 

 

After we finish , you can revert back to what you wish.

 

The file you think notepad.exe is notepad.exe.orig file, and it will not work. You shouldn't delete the notepad.exe at C:\Windows.

 

Please follow the suggestions exactly, otherwise we do not see what we want to see and go to the wrong direction..

 

 

NOW:

 

Create the "Date created" column in search and search for all "notepad", make sure that the screenshot includes the creation dates so as we can see all the files with notepad name in them.

 

Cheers.

Link to comment
Share on other sites

Thank you very much enoskype!

 

I finally understood what you mentioned. :-D

Here are the result of the search.

 

PS: After search I reverted everything back you mentioned because it is not safe to have things unchecked like the one what was recommend to be checked.

 

Sincerely

Blacksea.

Link to comment
Share on other sites

I did a research for my self, as I mentioned before I thought the Notepad problem had something to do with Blocking and infection. If you remember about the infected file what IS360 couldn't scan. Well when I was giving information about the file, it showed a date and the date was very close with the notepad things I searched for you. I think this is possible that those things has something commonly.

 

Blacksea

Link to comment
Share on other sites

It seems that you don't have the notepad.exe at: C:\WINDOWS\notepad.exe

 

Also, it is downloaded by Windows Update, as it is seen at:

C:\WINDOWS\SoftwareDistribution\........

 

Check both notepad.exe files in System32 and SoftwareDistribution, if they are the same.

 

Why it came by Windows Update is unknown to me. The full path can not be seen in the screenshot.

 

I can't see any relevance in the dates of that "pic" nasty and notepad!!!

 

Cheers.

Link to comment
Share on other sites

Hi there enoskype and blacksea ;

 

blacksea : you edited one of your earlier posts, asking me if you should still do a complete uninstall of your firewall ; I didn't see that edit until now because others had posted after you edited so I never bothered to look. No big deal.

 

Before I ask you to uninstall anything, I'd like to know what programs you use for protection : antivirus, firewall, anti-spyware, anti-malware, registry guards (or optimizers). I would also like to know if any of those tools have detected anything lately and if so, what exactly.

 

Thanks.

 

===

Link to comment
Share on other sites

Yes enoskype,

 

I accidentally deleted the notepad from Windows and I will do a system restore to get it back hopefully. Shall I do a system restore back to 01-12-09? Maybe this will help, I'm not sure but I didn't had the error at that time.

 

Blacksea.

 

It seems that you don't have the notepad.exe at: C:\WINDOWS\notepad.exe

 

Also, it is downloaded by Windows Update, as it is seen at:

C:\WINDOWS\SoftwareDistribution\........

 

Check both notepad.exe files in System32 and SoftwareDistribution, if they are the same.

 

Why it came by Windows Update is unknown to me. The full path can not be seen in the screenshot.

 

I can't see any relevance in the dates of that "pic" nasty and notepad!!!

 

Cheers.

Link to comment
Share on other sites

Hi So_sad,

 

I use Avast! 5.0 as my Antivirus. Comodo as my Firewall. A-squared as malware guard which also integrates anti -spy -virus. And I also use IS360 and MAMB as a backup scanner. I use ASC as my registry fixer and optimizer.

 

Blacksea.

 

Hi there enoskype and blacksea ;

 

Before I ask you to uninstall anything, I'd like to know what programs you use for protection : antivirus, firewall, anti-spyware, anti-malware, registry guards (or optimizers). I would also like to know if any of those tools have detected anything lately and if so, what exactly.

 

Thanks.

 

===

Link to comment
Share on other sites

Thank you enoskype. If blacksea wishes to pursue the malware possibility, then I'm willing to go that route and hopefully we'll find the cause of all this.

 

blacksea : I don't suggest a System Restore at this stage because it would go back too far (early December) and I don't wish to cause more problems on your system ; restoring to an earlier date is less of a concern when the date chosen is very recent (a day or two, for example).

 

Ok, a few more questions before we run any new tools :

 

- Have you had any signs/symptoms of malware or infection since December ? Redirects, popups, very slow machine, etc...

- Have you scanned your machine with updated IS360 and MBAM recently ? If so, have they found anything ?

- Has Avast! 5 given you any alerts ?

- Has Comodo firewall blocked anything lately ?

 

Thanks.

 

====

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.


×
×
  • Create New...