Notepad is displayed every StartUp of WIN 98SE

Hi:
I've just recently installed WIN 98SE on my Pentium II, and since then the Notepad is always opening (even in duplicate!) during the WIN StartUp. I have checked every System & WIN '.ini' file to find out if the Notepad is anywhere specified to run/load at StartUp but I could NOT find any - it just driving me crazy! I can't believe that the Microsoft would do such a stupid mistake in designing the Installation CD (by the way, the installation onto my PC went without any problems or interruption).

THANKS for any help...!

 

Hi Thorsak,
I am sure everyone here welcomes you to the Board.

I do not know why the 98SE installer has setup the PC to load Notepad at startup. Does NotePad start with a blank document ?

Have you checked the registry ? If not, Left Click the Start Button and then Left Click Run.

Type regedit
Click Edit and then Click Find
Type Notepad
and keep clicking Find Next
if you find NotePad in any Key Folder named Run
Right Click in the right window pane and click Delete
and confirm the delete.
Exit regedit and reboot.
regards

 

Thanks for the advice!
I checked the Registry but did NOT find the 'Notepad' in the 'Run' Folder: only right at the first use of 'Find' feature I obtain the following:
ab[Default] "C:\Windows\notepad.exe "

I did NOT delete this because I wasn't sure if it would permanently disable the 'Notepad' Pgm.

Other than that I did NOT find any 'Notepad' entry in the Window\Startmenu\Programs\Startup: there is no 'Notepad' Shortcut, not even in either the 'Lunch Bar' or 'System Tray' of the Taskbar...

Any other suggestion/s?

THANKS...!

 

A quickie "could do" since this is easy enough to do and reverse:

Do a file find for notepad.exe.

When found rename it to notepad.exx

Reboot

Hopefully who ever is calling this at startup will give an error detailed enough to lead back to problem.

===Taking the cautious approach=====
I don't think this rename will cause a problem, as I just did this on my own OS without any bootup problem. Easy enough to rename notepad correctly.

but if there was problem, I could get out of it easy enough by doing this renaming at c:\prompt. As I don't know how comfortable or familiar you are with dos commands, you may want to stick notepad.exe on a floppy so you can just copy this back into the c:\windows folder.

 

Execellent suggestion Ann.

Mike

 

Download and run Startuplist

If this doesn't help find the entry that is starting NotePad, copy/paste the contents of the file it creates, back here for review.

 

Could use startuplist but it may be easier [I always try to take the easier way out] to download "Process View" :

http://www.xmlsp.com/pview/prcview.htm

Run it [can do this right from the zip folder without upzipping]

Again run it when the notepad window is up and running,

Find the notepad entry in the list of processes

Right click on it and select "Properties "

This will show the whole path [api] that it is called from.

 

Interested to see what thorsak replies to the excellent posts.
I am beginning to think a virus is at work here ...
thorsak anything show up on a virus scan ?
regards

 

Ann:
Agreed, but by running Startuplist you get to see everything that is starting. Now we can also make recommendations on other things not to run, which may include Spyware/Foistware/viruses/worms/keyloggers/etc etc etc

 

Ohhhh, you are so right WhitPhil. Guess "tunnel vision" pulled me in and I was focusing on the posted quest rather than the big picture. Anyway, Startup/Run check is a far better idea as this may still prove to be viral. Hmmmm, speaking of which, I wonder why the reinstallation of win98x was necessary and if this was "clean" or "on top of self ".

Just wish thorsak would hurry up and check back in. Curiosity is driving me crazy....

 

Response to 'Notepad is displayed every StartUp of WIN 98SE'

Many thanks to all who are trying hard to help me with this ridiculous problem caused by the WIN 98SE Upgrade installer...!

Unfortunately, I still haven't been able to find the module which is continuously loading the Notepad at WIN Startup - here are the specific responses I obtained while following each of your suggestions:

- renaming the Notepad.exe:
WIN responded by message 'WIN can't find Notepad.exe. This Program is needed for opening files of type 'Readme'' ...which we all expected BUT there was no lead/info to that 'guilty' module which is obviously calling for it each StartUp.

- running the 'Process Viewer':
I run it after rebooting, and the only info given by the Process Viewer was Full Path
C:\Windows\Notepad.exe - while right-clicking on the path I found there is no 'Properties'Option by the Process Viewer (my Version of the Viewer is 2.1.0.1 - hope this is the latest Version?!?).

The only to me unknown Files associated with Notepad I found in Windows Folder were the following:

Notepad.lgc, Notepad.lgd & Notepad.lgg - probably
'invented' by the WIN 98SE(?!?).

Anyway, if anyone has still some other suggestion/s - I would greatly appreciated it...!

MANY THANKS to all!

 

Ok, I'll post without using the invisible ink this time.


Download and run Startuplist

Copy/paste the contents of the file that it creates, back here



Note that the "Notepad.lgc, Notepad.lgd & Notepad.lgg " files you found were in \Windows\Applog and are the ones maintained by Taskmon everytime NotePad runs.
Which it seems to, from the C:, D: and G: drives!

 

Ditto: Get startuplist as WhitPhil is/has suggested.
Run it and copy and paste nfo back here for opines.

Process View: You weren't suppose to right click on path. Try click on notepad to highlight and rightclick for "Properites ".

At least it appears to be a README [TXT, 1st, or NFO]

 

Notepad virus perhaps?


http://support.gateway.com/s/NETWORK/shared/Wireless/6002154faq38.shtml

http://virus.daguru.org/qaz/qaz.html

Mike

 

Run the Startup List...

Hi guys!
I've run the Startup List as suggested and here are the results:

StartupList report, 3/7/03, 8:31:21 PM
StartupList version: 1.52
Started from : C:\WINDOWS\TEMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v5.50 SP1 (5.50.4522.1800)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\Tools_95\Register\REMIND.EXE
C:\WINDOWS\CTPNPSCN.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\LOGITECH\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\DIAMOND\INCONTROL TOOLS 98\DMHKEY.EXE
C:\PROGRAM FILES\3COM\MODEMMGR\PROGRAM\MDMMGR.EXE
C:\POWERTOY\DESKMENU.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NUTS & BOLTS\ZIPMAN32.EXE
C:\WINDOWS\TEMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
InControl Desktop Manager.lnk = C:\Program Files\Diamond\InControl Tools
98\DMHKEY.EXE
3Com Modem Manager.lnk = C:\Program
Files\3Com\ModemMgr\Program\mdmMgr.exe
PowerReg Scheduler.exe
DeskTop.lnk = C:\PowerToy\DESKMENU.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
EM_EXEC = c:\logitech\mouse\system\em_exec.exe
PowerQuest Startup Utility = C:\Program
Files\PowerQuest\PartitionMagic4\UTILITY\MMOVER32\PQINIT.EXE
TimeSink Ad Client = "C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE "
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
IrXfer = IrXfer.exe /Q
RFX_auto_upgrade = rundll32.exe
C:\PROGRA~1\COMMON~1\RICHFX\NPVPG005.DLL,auto_upg_check
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = C:\WINDOWS\SYSTEM\mstask.exe

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=C:\TOOLS_95\REGISTER\remind.exe
run=C:\WINDOWS\CTPNPSCN.EXE

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 27/2/2003, 11:33:58)

[rename]
NUL=C:\WINDOWS\TEMP\GUU13A4.TMP
NUL=C:\WINDOWS\TEMP\GUU11E5.TMP

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET MIDI=SYNTH:1 MAP:E MODE:0
SET SOUND=C:\PROGRA~1\CREATIVE\CTSND
SET BLASTER=A220 I5 D0 H5 P300 E620 T6
deltree/y c:\windows\temp
md c:\windows\temp

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL -
{EBCDDA60-2A68-11D3-8A43-0060083CFB9C}

--------------------------------------------------

Enumerating Task Scheduler jobs:

1-Step Backup for Zip & Jaz.job
Tune-up Application Start.job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE =
http://windowsupdate.microsoft.com/V31Controls/x86/w95/en/actsetup.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE =
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37673.8187847222

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 4,806 bytes
Report generated in 0.155 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

==============================================
Regarding the possible presence of a Virus - I don't think so because I did the Upgrade from WIN95a to WIN 98SE from a new (never used) CD which I bought a couple of years ago but never installed till know since I did not need it - until now: I was forced to do this upgrade because some of my new Programs REQUIRE use of WIN 98SE (I'm heavily involved in music writing & arranging for my live performances). Also, so far I did NOT detect any other abnormalities or had any unexpected crushes - only this idiotic 'Notepad'-nuissance (I still think it's one of the Microsoft programmers flaws since during about 15 years of using WIN I never experienced such a crazy thing!).
I only remember that at the end of a trouble-free installation process I let myself influenced by the WIN-installer and agreed to review the 'Readme' file before closing the installation Menu (I usually cancel this Option and print the Readme file later): I noted that some Program-installers don't return properly after the reading back to the installation Menu, and because of that the crazy Notepad probably 'somehow' hangs on at the end of the installation process rather than allowing proper 'finish'/exit from the installation Menu. So... perhaps something happened at the end - similarly if one exits the WIN from e.g. Window Explorer WITHOUT closing it first: during next boot the WIN then boots back to Window Explorer... EXCEPT in this case, the Notepad gets really 'locked up'...

PS:
Ann - I'm sorry, by mistake I mentioned that while running the Proces Viewer I highlighted the PATH instead of the 'Notepad' filename: I did actually highlighted the filename and then right-clicked it BUT ...no 'Properties' Option was displayed in the Pop-up Menu!

Any further suggestions?
MANY THANKS...!

 

Then it won't hurt to run the Norton fix tool will it.......

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.qaz.a.fix.html


Mike

 

Even though you do not believe you have a virus it would not hurt to follow Mike's suggestion or run a currently-updated antivirus program set to scan all files!

I noticed in your startup listing under
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
TimeSink Ad Client = "C:\Program Files\TimeSink\AdGateway\TSADBOT.EXE "

Timesink is adware, installed by some program you might have downloaded.

Download and install SpyBot- Search & Destroy then do a check for spybots:
http://patrick.kolla.de/spybotsd.html

Also, if you can recognise any of the programs that might have installed the spyware in Control Panel, Add/Remove Programs, Install/Uninstall tab , that might be the first place to begin.

I also noticed that your C:\AUTOEXEC.BAT listing has a line to delete the temp files, then another line to recreate the temp folder at every boot.

SET MIDI=SYNTH:1 MAP:E MODE:0
SET SOUND=C:\PROGRA~1\CREATIVE\CTSND
SET BLASTER=A220 I5 D0 H5 P300 E620 T6
deltree/y c:\windows\temp
md c:\windows\temp

This is not wise, since some install programs need the files inside your C:\Windows\Temp folder to complete the installation process after a reboot!

You should NOT have a command to delete the windows\Temp folder running from autoexec.bat so these two lines should be removed from the autoexec.bat file. Just run SYSEDIT... then either delete the two lines or, just as a good safety measure any time yyou edit the autoexec.bat file, add REM and a space in front of each of the last two lines so that it appears as follows in the AUTOEXEC.BAT:

SET MIDI=SYNTH:1 MAP:E MODE:0
SET SOUND=C:\PROGRA~1\CREATIVE\CTSND
SET BLASTER=A220 I5 D0 H5 P300 E620 T6
REM deltree/y c:\windows\temp
REM md c:\windows\temp

 

Good points by Alice. They won't help the Notepad issues, but are definitely required.

"renaming the Notepad.exe:
WIN responded by message 'WIN can't find Notepad.exe. This Program is needed for opening files of type 'Readme'' . "

How did you go about doing the rename. I've never seen Windows complain when I renamed a program!! And, README is a pretty long file type!!

"Notepad.lgc, Notepad.lgd & Notepad.lgg "
This may also be providing a clue. I presume that you have a D: and a G: drive???

If so, have you looked on these drives for a file called NOTEPAD?

And lastly, have you tried starting in Safe mode. See if NotePad starts up there.