Problem opening Notepad

[snowbound]

Hi all :)

Just ran a hijackThis log on a friends comp and while trying to open notepad i encounter this message:


16 bit M-DOS Subsystem

The NTVDM CPU has encountered an illegal instruction:
CS:0544 IP:0120 OP:63 61 6E 20 73

Choose "close" to terminate the application

Also,

A temporary file needed for initialzation could not be created or could not be written to. Make sure that the directory path exists and disk space is available.

These are the 2 messages we get when trying to open notepad.

Any one know what is going on?

Thanks

snowbound

[dangitall]

No, I've never seen anything like that. Does the same thing, or something similar, happen if you try to open WordPad? Is there another text editor available on the affected machine, i.e. Metapad?

[snowbound]

Hi dangitall :)

No, there is no problem with WordPad and he has no other text editor as far as i know.

So far there is only problems trying to open NotePad.

I also have never seen this kind of message before so.....



snowbound

[snapdragin]

Hi snowbound,

Are you sure the NTUDM wasn't spelled like this:
NTVDM CPU has encountered an illegal instruction ?

I've not seen that error before either, but when I searched it I came across a newsgroup at Microsoft and one of the MS-MVP's there posted this link:
http://support.microsoft.com/default.aspx?scid=kb;en-us;314106

Not sure if the information there will help or not. Sorry I can't offer more help with this error message.

snap

[snowbound]

-{ Quote: " quoting: snapdragin link=board=9;threadid=27115;start=0#msg156217 date=1081209032]
Hi snowbound,

Are you sure the NTUDM wasn't spelled like this:
NTVDM CPU has encountered an illegal instruction ?" }-

Well by golly u are right Snap! I checked my notes and i did spell it wrong. :P (better correct my spelling mistake in the post) ;) :D

Will give him the link and see what happens. ;)

Thanks a lot as always.


snowbound

[snapdragin]

Here is another link that was posted at the newgroup where someone else was having similar error messages related to 16-bit progams.

http://www.jsiinc.com/SUBN/tip6700/rh6753.htm

Something there might be helpful, maybe? Lots of reading though! :o

Is your friend's computer an upgrade from a win9x to XP?
You can check to see if the notepad.exe is a 16-bit program by going to the exe file and checking it's properties. (searching in the dark a bit here myself) ;)

[snowbound]

No snap, computer purchased with XP installed.

He told me NotePad was working fine just the other day.

Today i cleaned out a lot of Malware and a Hijacked homepage using Ad-aware and CWShredder. There was a lot of junk found so i hope i didn't delete something that may have caused this. :o

The only thing i worry about is some file CWShredder found and a message popped up asking if it was recognizable and he said no and deleted it. :-\

Not sure if this could cause this error to happen but......

Thanks again snap. ;)



snowbound

[Pretender]

You know that CWShredder blew notepad.exe out of existence at one time recently don't you? Or, at least, at one location as there are two notepad.exe files on system I believe. So Merijn provided the files here:

http://spywareinfoforum.com/~merijn/winfiles.html

[snowbound]

Hi Pretender :)

I sent him the link and he replied back that he installed the file(s) and all is well now. ;D

Yo the man! ;) :D ;D

Thank u, and thanks to everyone else for your suggestions. ;) ;D



snowbound

[Stro]

Pretender, hope you'll read this!

I also could not open Notepad in Windows XP Home Ed.

Norton A-V 2004 identified notepad.exe as being adware on my PC. I had previous seen on Merijn.org where CoolWebSearch had infected notepad.exe. Norton A-V told me where the infected notepad.exe was located, so I went there and deleted it (actually sent it to the Norton Protected Recycle Bin where I believe it still sits today).

Merijn.org listed the two folder locations where notepad.exe is resident in Windows. I went to one location and found notepad.exe with a modification date which predated my purchase of the PC. I figured this file was clean. I went to the other folder location and found a file called "notpad.exe" (missing the "e"). I copied the good notepad.exe from the other folder into this folder (so that notpad.exe and notepad.exe as listed together).

I can not open Notepad. I'm assuming that it functions OK, although I haven't tested it.

Can anyone confirm to me that the two notepad.exe files in the two windows folder locations are the same exact files?

Regards,
Stro

[LowWaterMark]

On XP Home, I have two identical versions of notepad.exe in these two locations: c:\WinNT and c:\WinNT\system32. (Note that my version of XP is installed in \WinNT versus \Windows, but it's otherwise no different.)

Oh, and I have no file named notpad.exe, of course.

[Stro]

Thanks for the reply, LowWaterMark.
I meant to say "I can NOW open Notepad...." I should really check my spelling before hitting the Submit button!

[Pretender]

-{ Quote: "Pretender, hope you'll read this!

I also could not open Notepad in Windows XP Home Ed.

Norton A-V 2004 identified notepad.exe as being adware on my PC. I had previous seen on Merijn.org where CoolWebSearch had infected notepad.exe. Norton A-V told me where the infected notepad.exe was located, so I went there and deleted it (actually sent it to the Norton Protected Recycle Bin where I believe it still sits today).

Merijn.org listed the two folder locations where notepad.exe is resident in Windows. I went to one location and found notepad.exe with a modification date which predated my purchase of the PC. I figured this file was clean. I went to the other folder location and found a file called "notpad.exe" (missing the "e"). I copied the good notepad.exe from the other folder into this folder (so that notpad.exe and notepad.exe as listed together).

I can not open Notepad. I'm assuming that it functions OK, although I haven't tested it.

Can anyone confirm to me that the two notepad.exe files in the two windows folder locations are the same exact files?

Regards,
Stro" }-


I have.........looks like you're doing fine now 8)