Notepad is displayed every StartUp of WIN 98SE

Got to say having your temp file deleted by *.bat is/was a bad idea. Many applications use the temp to store nfo needed to do parts of the installation that they are not allowed to do from within windows. If this nfo is gone the installation is incomplete or corrupt.

Win.ini has a run line for the "remind.exe ", that you do not need. A nuisance popup to remind you to register your application. Maybe suspect. Rem it and delete the load line from the registry. Renaming this may not be a bad idea either, if you have no option to disable this from within the program. Or just walk through the registration. Some will allow you to mail or fax it and once done you won't be nagged again by this reminder.

Not needed-mdmmgr-3com Modem Manager is a program that tells you the progress of your connection, the send and receive speeds, and where any problems are occuring. It also creates a animated taskbar icon to access 3com's options menu. Not required in startup. Can be started manually. Maybe something here is trying to call a txt file for some reason.

What is ctpnpscn.exe? I realize it is more than likely something having to do with creative but I can find nothing definitive on a quickie search. Just wondering why exe has to run and what it does.

==========
Don't know why your process view is acting different than mine and as I am on another computer [without it] I can't explore further. How about another goodie that does the same thing but with more "Bells and Whistles ". Although this is shareware, it will serve the purpose of showing the path the Notepad.exe is being called from:
TASKINFO2003
http://www.iarsn.com/download.html

Again download and install, run while the mystery notepad.exe is rearing it's ugly head. Highlight notepad and in the right hand side>lower pane info shall be given including path.

=========
As you can see, the problem with tracking this down now is, it is not going to be so easy as looking for a notepad/txt runline. It may be any startup whose behavior called for a readme before opening and running.

There are a few other areas where runs can be checked for but try taskinfo first and let's see what happens.

=========
As a side what version of Nuts and Bolts are you running?

Running spy removal was also a good suggestion. tsadbot is known adware.

 

Just to clarify (from my notes)
==============copy/paste==========
Newsgroups: microsoft.public.win98.apps
Date: 2002-03-13 07:12:31 PST

REM [Remark] ignore....
Works with Config.sys and Autoexec.bat

; [Semicolon]
Works with Win.ini and System.ini

- [Minus Sign]
Works with the Registry

--
George Aker aka SG [MS MVP-DTS]
==========end c/p===============

So you would add a ; (semicolon) in front of a line in your win.ini file to have windows ignore the line, as follows:

;load=C:\TOOLS_95\REGISTER\remind.exe

You can also use SYSEDIT to get to the Win.ini file (which would be behind the autoexec.bat...just click on the title bar to bring it to the front) .

Here is a page with more information and screenshot on using Sysedit to disable lines in the win.ini file:

http://members.aol.com/donnaskani/startup.html

 

Thorsak

If you ever come back!

Run the dad gum notepad virus fix I posted above!

mike

 

Notepad Starup Problem...

Hi guys:
Thanks for all your suggestions - I have cleared up some risky/useless settings (e.g. temporarily removing .TEMP Directory in Windows, the useless file 'remind.exe' in Win.ini and also the file 'ctpnpscn.exe ' running from Autoexec.bat as a PnP scan-file from Creative Labs. for my SoundBlaster Sound Card AWE32 and this file showed up only AFTER I installed the WIN 98SE ...perhaps an idiotic flaw by the installer program).

I then run the 'Spybot-Search&Destroy' which detected the 'TSADBOT' from the 'TimeSink' and which was a 'left-over' from previously installed 'Gator' which I got rid off quickly once I learned that it was one of a bad spyware/adware. I tried to uninstall the Gator as completely as I could but - as we can see that's how bad the 'uninstall' program sometimes is...Anyway - I got rid off the remaining portions of the 'TimeSink'...!

And now the major step: at the end I run the TASKINFO2003 and here are the results:

General Information : C:\WINDOWS\NOTEPAD.EXE : 4294799691

CMD = C:\WINDOWS\Notepad.exe C:\Program
Curr Dir = C:\
Started by = C:\WINDOWS\EXPLORER.EXE
Data KB = 1,528 in mem = 448 in use = 376
Code KB = 2,532 in mem = 680 in use = 464
Handles Count = 15
Windows = 11

Modules : C:\WINDOWS\NOTEPAD.EXE : 4294799691
Name Base Size InMem LUsage GUsage Version Description Company Full Path
CCMSGHK.DLL 03000000 73,728 53,248 1 5 8.01.538 Control Center Logitech
Inc. C:\LOGITECH\MOUSE\SYSTEM\CCMSGHK.DLL
MSVCRT20.DLL 7FC30000 282,624 110,592 1 6 2.11.000 MicrosoftŽ C
Runtime Library Microsoft Corporation
C:\WINDOWS\SYSTEM\MSVCRT20.DLL
NOTEPAD.EXE 00400000 643,072 368,640 1 1 1.01.000 Programmer's File
Editor for Windows NT Alan Phillips C:\WINDOWS\NOTEPAD.EXE
WINMM.DLL BFDF0000 65,536 53,248 1 4 4.03.1998 System APIs for
Multimedia Microsoft Corporation C:\WINDOWS\SYSTEM\WINMM.DLL
OLE32.DLL 7FF20000 790,528 176,128 1 4 4.71.2900 Microsoft OLE for
Windows and Windows NT Microsoft Corporation
C:\WINDOWS\SYSTEM\OLE32.DLL
COMDLG32.DLL 7FE10000 184,320 36,864 1 4 4.72.3510.2300 Common
Dialogs DLL Microsoft Corporation C:\WINDOWS\SYSTEM\COMDLG32.DLL
SHELL32.DLL 66800000 1,396,736 118,784 2 9 4.72.3812.600 Windows Shell
Common Dll Microsoft Corporation C:\WINDOWS\SYSTEM\SHELL32.DLL
COMCTL32.DLL BFB70000 581,632 385,024 3 9 5.81 Common Controls
Library Microsoft Corporation C:\WINDOWS\SYSTEM\COMCTL32.DLL
SHLWAPI.DLL 70BD0000 311,296 53,248 2 9 5.50.4522.1800 Shell
Light-weight Utility Library Microsoft Corporation
C:\WINDOWS\SYSTEM\SHLWAPI.DLL
USER32.DLL BFF50000 69,632 61,440 9 14 4.10.2222 Win32 USER32 core
component Microsoft Corporation C:\WINDOWS\SYSTEM\USER32.DLL
GDI32.DLL BFF20000 155,648 143,360 7 14 4.10.1998 Win32 GDI core
component Microsoft Corporation C:\WINDOWS\SYSTEM\GDI32.DLL
ADVAPI32.DLL BFE80000 65,536 28,672 9 14 4.80.1675 Win32 ADVAPI32
core component Microsoft Corporation C:\WINDOWS\SYSTEM\ADVAPI32.DLL
KERNEL32.DLL BFF70000 471,040 339,968 13 15 4.10.2222 Win32 Kernel
core component Microsoft Corporation
C:\WINDOWS\SYSTEM\KERNEL32.DLL

So - as we can see the crazy Notepad is being started by the infamous and extremely intrusive 'Internet Explorer': so far, however, I wasn't able to find in & around 'Internet Explorer' settings and folders HOW to stop its 'evil playing' with the Notepad - against the user's desire...! By the way I'm NOT using the Microsoft rotten Notepad, I have replaced it with 'PFE Programmers File Editor' which I've been using for years without any problems (well BEFORE the WIN 98SE installation!) ...but - I don't think this has anything to do with my existing problem of getting the Notepad display at the WIN Startup(?!?).
Should I perhaps re-install the intrusive 'Internet Explorer'?!? - may be then it will finally stop bothering with starting the Notepad...?

Any more suggestions?

THANKS...!

 

General Information : C:\WINDOWS\NOTEPAD.EXE : 4294799691

CMD = C:\WINDOWS\Notepad.exe C:\Program
Curr Dir = C:\
Started by = C:\WINDOWS\EXPLORER.EXE

Notepad is being started by the infamous and extremely intrusive 'Internet Explorer'

No it is not. It is being started by Windows Explorer. Which in not the same.

Internet explorer would be IEXPLORE

Notepad has no business being there. Why it is I have absolutley no idea.

But something it the startup list or the Registry is telling it to be there.

Or even in the System.ini maybe. ?

Try running Sysedit and look for a line ( or lines ) that refer to Notepad. Look in both the System.ini and Win.ini.

BTW folks. I do not believe that Reg cleaners etc. get to the System or Win.ini

Did you run the Notepad fix the mflynn suggested.

BillyBob

 

In the first few lines if the System.ini there is a line that reads'

SHELL=Explorer.exe.

Or that is what it should say.

 

BB (FYI from Startup list)

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

The startuplist also doesn't show any RUNs for the NotePad virus either, but, running the "fix" won't have any negative affects.


thorsak:
Did you try booting up in SafeMode to see if NotePad starts.

The other thing to try, is Rename NOTEPAD.exe to some other name, then reboot and see if "something" complains.

 

Yes BB that is the correct shell for windows.

I think I see the problem here.

Thorsak run the notepad virus fix as it will do no harm, but I now believe this is in fact the real notepad that is trying to be loaded by some program to edit some file, which is now missing.

This line from TaskInfo

CMD = C:\WINDOWS\Notepad.exe C:\Program

if your were going to edit a file in c:\program files named thorsak.doc with Notepad the dos command line for this would be

C:\WINDOWS\Notepad.exe C:\Program\thorsak.doc

So the above indicates that the file meant to edited is missing. But is probably creating a new file just called program.

I believe it is an attempted browser hijack.

Since it does not show up in the starup list it seems to defy the rules. But it may not because of this line from staruplist:

Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\NZDD.DLL -
{EBCDDA60-2A68-11D3-8A43-0060083CFB9C}

The above is unknown and is probably the culprit.

To fix:

Download this and disable this object and reboot and I believe it will be gone.

BHO Demon http://www.definitivesolutions.com/bhodemon.htm

A BHO is like a autostart/startup that only runs when you run the Browser.

This program runs stand alone no install is required post me the items it finds other than the below. Normal entries here would be Acro….. (Acrobat Reader) or Nav…. (Norton Anti virus).

Mike

 

Yeah here it is, Ill bet one of the programs rings a bell!

NetZip Download Demon, Real Download, Netscape Smart Download

Page down several times, about halfway and look for NZDD.DLL.

http://www.spywareinfo.com/yabbse/index.php?board=7;action=display;threadid=1335

Mike

 

OOPS !!! OK I missed something .

Looks like the System.ini is OK then.

UNLESS it is repeated further down . I know that ain't supposed to be but I have seen it.

And that was when I IMPORTED an EXPORTED registry.

thorsak

When Notepad starts what does it say it the Upper left corner.

If something is trying to open a file it should show a name there.

If it says UNTITLED then we is in deep trouble.

WhitPhil has a good suggestion also. Just rename Notepad.exe to Notepad.ex9.

Something should then ( hopefully ) complain .

BillyBob

 

No BB! Smile!

I will bet a dollar to a donut that if he downloads BHODemon and disables the object his problem is solved!

Mike

 

You only list the [command/path] cmd=c:\windows\notepad c:\program for one instance of "modules" notepad. Do I see more than one instance "Notepad.exe running?

I also see the cmd line but isn't there also a path line? Wouldn't you know that while your running the 2003 version I have the 2000. This should still be three paned. highlight each instance of notepad and look at nfo in the lower right pane. first two lines should be the cmd=* and path=*. Could also slide the two smaller panes over to reveal additional nfo on the main left pane. I believe this also should have the path.

Although this may be it. It looks as though you have a broken entry in the registry for the command line. There's probably a txt file shelled to open in notepad using the command line c:\program files\ "what ever the rest of the path is ", but either the rest of the line [after program] is either not there or has an extra space in it which will break up the command. Example:
c:\program files\what ever. Note there is 2 spaces into between program and files instead of one.

Perhaps a walk through the registry, doing a find for c:\program and looking for syntax errors, such as I have pointed out in any that showup.

Remember when doing such a "find" in the registry, hitting the F3 key will continue looking at each instance of keyword of interest.

Do you actually have a folder directory named c:\program?
=============

I believe the plugin nzdd.dll is the plugin helper for the richfx player which is part of Realplayer or real jukebox, that's why I have not mentioned it. May be wrong but I think that's the conclusion I finally came to.

Knit picking here but you don't need the auto_upgrade part of this loading either. Here's how to take care of that:
Program Name: RFX_auto_upgrade
Executable Name: rundll32.exe npvpg005.dll
Required: No
Comments: A browser plugin called the RichFX player.
Here is a link to download RichFX's solution to removing the auto upgrade:
http://download.richfx.com/player/uninstall.exe

==========
Although I don't see it mentioned do you have a wininit.ini file? A dosstart.bat, a winstart.bat? A few others but I'll have to think on it...anyway these are worth a peek into using notepad to open them with or in.

As suggested, Have you tried safemode bootup to see if notepad still opens during this bootup? At least that would confirm if this was being called by one of those areas or somewhere else.

 

From Spywareinfo.com

L {EAE191BA-FB87-40CA-80D2-D639A2595150}: Iemdl.dll - IE Middle Clicker
X {EB9BDD24-CCF1-4A87-98C0-579DBA9BDA83} : (random filename).dll - Lop.com
X {EBBFE27C-BDF0-11D2-BBE5-00609419F467}: AMCIS.DLL Aureate/Radiate
O {EBCDDA60-2A68-11D3-8A43-0060083CFB9C}: NZDD.DLL/RDXPH.DLL/SDPH20.DLL NetZip Download Demon, Real Download, Netscape Smart Download
X {ED8DB0FD-D8F4-4b2c-BB5B-9EF040FE104D}: UCMIE.DLL - UCmore toolbar
X {EE392A64-F30B-47C8-A363-CDA1CEC7DC1B}: Bar.dll - NewtonKnows search bar


The command line

c:\windows\notepad c:\program will create a file named "program "

There may be a file named program but not nessesarilly a folder named that!

Mike

 

WowWee.....

mflynn,
Aren't you the clever one? By George, I think you got it!!! Guess I should have spent more time on the nzdd.dll file rather than the richfx player lead. Good...No better then good, Great job!

Wouldn't spybot have caught this???

Can't wait to see the results! thorsak where are you.....

===========
Shoot, On reread I see that the mention of "notepad opening c:\program...etc" was in reference to my post and not part of the resource into nzdd.dll [netzip] behavior. Still a good find though. Not having realplayer I didn't realize this was bloat and an nfo gatherer to boot. Apparently installed with or without your permission. Wonder if disabling this has any lasting impact on the real player.

 

But??

Since it is a Browser Help Object, won't it stay dormant until the browser is executed???

The indications are that Notepad is appearing at boot time, and the TaskInfo data seems to indicate that it is coming from one of the Startup areas(started by \Windows\Explorer.exe).

Ann:
The Startuplist will suppress things like Wininit.ini if they are not present.

But, at the same time, I would like thorsak to download and run StartUpLog from here. I was involved in the development of this and StartupList certainly "appears" to list all of the nooks and crannies, but let's have a look at what the other one finds. It creates a Startup.log file that opens on the desktop. Copy/paste it's contents back here.

 

Mysteries of Notepad...

Great work, guys! ...Although we did not find the bad culprit yet I think sooner or later we should be able to 'hit it'...

OK, I'm reviewing all suggestions and will try to check them out:
- first I'll try to run the BHO Demon at http://www.definitivesolutions.com/bhodemon.htm[/url] because the NZDD.DLL-file could be causing the problem

- then I'll rerun the 'StartUp List' to obtain a fresh 'Startup.log'-file from it which I'll try to send it to you

- I did rename the Notepad already and reported to you the outcome (see back to Pg. 1 or 2): WIN just displayed a message that it could NOT find the Notepad which is needed for opening files of type 'Readme' (which we all know)- and that in spite of having NO files in the TEMP Directory (as someone before suggested to check and empty it)

- I'll also recheck again the .ini-files to see if there is any clue about 'who' calls for starting the Notepad and - I'll also try to reboot at 'Safe Mode'

- re the strange C:\program folder: I noted it only now - after running the 'TaskInfo2003' (and probably also the 'Startup List') utilities - have no clue where it came from but will check for more info about it

- PS to 'BillyBob': you're right it's the Window Explorer NOT the Internet Explorer which is starting the Notepad (according to TaskInfo2003)as I wrongly mentioned in my last message...

Anyway - I'll be with you shortly guys (still today that is Tuesday)... as soon as I can test/run your suggestions and send you another 'Summary' of it...!
THANKS!

 

Yes normally a BHO is only run when IE is loaded but it is still only a DLL and therefore can be executed anyway by other means.

While it is loaded as a BHO I don't believe it will be able to be deleted.

The next step after disabling is to search for and delete this NZDD.DLL file.

Thorsak it is time to rename the notepad back to normal. Also you said you found the program "folder ", are you sure it is a folder. I think it is a file created by note pad.

I ask again did you run the notepad virus fix. If you do not have the virus then it will be harmless. But now do this only after you have renamed notepad back to normal.

Mike

 

Mysteries of Notepad ...

Hi Mike:
...I'm quickly responding to you:

- I already brought the Notepad 'back to normal' sometime ago, right after the test with renaming it which unfortunately did NOT reveal any useful info re the Module which starts the Notepad at WIN Startup

- I did NOT find the C:\program folder or better a file yet: I've just mentioned I'm going to look for it to see if I could get more info about it because I have no clue what it is (only noted it AFTER running the 'TaskInfo2003' Utility)...

THANKS!

 

For what it's worth, you posted:
===========copy/paste===========
NOTEPAD.EXE 00400000 643,072 368,640 1 1 1.01.000 Programmer's File
Editor for Windows NT Alan Phillips C:\WINDOWS\NOTEPAD.EXE
==============================
And you also said that you know that you are using a 3rd party notepad program in place of your original notepad.exe

This would be "PFE 32 (version 1.01)
Copyright(C)1999 by Alan Phillips ", correct?

This is from http://members.aol.com/axcel216/html.htm

You might want to restore your original notepad.exe from the backup you may have saved, temporarily, just to eliminate that variable.
EDIT:
Try restoring the WIN98 version of notepad.exe (not your original Win95 version)... with System File Checker maybe?

(Back up the 3rd-party notepad version first by renaming it to PFE32.exe)

From a groups.google search:
=========copy/paste==========
From: Alan Edwards (edwards@southcom.com.au)
Subject: Re: cannot reinstall notepad.exe ?
Newsgroups: microsoft.public.win98.apps
Date: 2001-01-22 22:03:11 PST

SFC will find Notepad.exe if you give it the correct path to the CD
folder or wherever you have the installation cab files.

I would use Start-RUN-SFC, check "Extract one file... ", enter
"notepad.exe ". In the Restore From box, if you press the arrow as the
right of the box it should give you the location of the install. If you have changed it, then enter the correct folder where the cab files
are kept.
Save it in C:\Windows
============end c/p===========
some advice on the use of SFC:
http://users.westelcom.com/rogersr/sfc.htm

 

When you renamed NotePad, you got an error about it being required for file type README.

This means, (I think) that in the registry under HKEY_Classes_Root, there is an extension (.{something}) with a default of README and that farther down is a README key, that has a shell open command for NotePad (probably with the C:\Programs as a parameter).

I have no idea how this extension would be auto started at boot time though!

So, run REGEDIT

Select the HKEY_Classes_Root key and do a FIND for README

If my "theory" is right, you should find 2 of them, one as a default value for an extension, and then another that is an actual key.

Post back the actual key AND the contents of each. One of the keys should be the one you found before with the "ab[Default] "C:\Windows\notepad.exe" " entry

OR

Export each key to the desktop. Rename the REG file to TXT files, open them in Notepad and copy/paste back here)