Notepad Exe Gone Crazy, Need Help Urgently

starkers...in theory there should only be one.

It'll be in windows/system32/notepad.exe [Win7] ....should be much the same in 10.  [I'll check]

Yep....same place in 10.

Ctrl/Shift/Esc ....task manager....look at processes and kill any instances of it running....see what happens.

That's what I thought... that there can.... er, should only be one.  Hmmm, go carried away with the famous Highlander line... after watching it again just recently.

I've done that umpteen times and it keeps coming back.... over and over again.  Theres only one instance of it running at any given time, but it can have up to 150 handles at a time, hence the high CPU usage.  I even tried killing it in a CMD line as administrator, but no go, and I can't change the priveleges so I have full control. 

Nothing I have tried has worked, not even unistalling/deleting the one in Windows, which I now believe is likely to be some kind of malware.  I even restarted in Safe Mode to try getting rid of it, but Windows still says it's a System File. I don't believe it is now, but I still have the problem of getting rid of it.

How I got it I don't know.  I've not opened any emails with attachments in yonks, nor downloaded or installed any new programs, either.  

Maybe a 'drive-by'?

Possibly.

Next step is to try an online scanner - they are 'safe' from whatever infection you may already have - your local AV may be compromised...hence the 'infection' [maybe]

Also.... google 'runaway notepad process" ...I'm betting you are not alone.

Update....there can/will be 2 instances of notepad.exe ....other one in the win root dir.

....whether 7 or 10.

http://www.tomshardware.com/answers/id-1991394/uninstall-notepad.html 

Give that link a read ....suggests the sfc /scannow command, etc.

If it behaves as an infection, then presume it's an infection. Windows doesn't do tricks like that by itself since Win98. Dunno about Win10 tho.

Malware has got very sophisticated nowadays, it's not like in the good old times, where you could simply end task the suspicious process.

Thanks to global economic crisis, which causes lack of food, which again causes regular fasting, and which finally causes increase of IQ level (lol), viruses nowadays know 100s of new ways to nest in your device.

About getting rid of infection I suggest 3 things:

1. Get and run Malwarebytes:

https://www.malwarebytes.com/

2. Get and run ComboFix (not designed for above Win8):

https://www.bleepingcomputer.com/download/combofix/

Both are free and super effective.

3. If they fail, then you need to Secure Erase your SSD and reinstall Windows.

Don't forget to backup your important stuff first.

After you've rid of it, learn to properly firewall your OS; learn what is important and what is trash.

This is most likely something in your registry youll have to google what your registry looks like, and get rid of what you dont need. Regedit i didnt learn how to do this. Next time make a folder to keep a antivirus installation file, so you can run it without updating. Viruses dont attack instalation files that arent in your downloads. Check your downloads for a free antivirus installer. If there is one there then install it in safemode do not update it, for viruses will most likely go after your web browser. Then run it without updating it first. This worked when i tried it against a virus. 

Do an offline scan with windows defender.   Switch into airplane mode and see if the problem stops.  You have some type of malware likely a js script that is causing the problem.

Open windows defender.  Choose Virus and threat protection and then Run a new advanced scan and choose the offline scan.   If it does not auto-start post here and I'll walk you through force starting it.

I would also reset your firewall to default if i was going to do that i noticed that viruses, also like to play with your firewall.

Well that did it!  Running Malwarebytes did the trick and quarantined several instances of Google crap identified as malware.... updaters and the like.... stuff that Win Defender and IOBit failed to find.  Thing is, I don't have any Google software on this machine, so where the fech did this crap come from?   Bastards!!!!!

Anyway, it wasn't such a painful experience to get rid of after all.  I was expecting having to use brute force methods to sort this issue out, but Malwarebytes quite easily removed the cause.... fechin' Google crap.

As for future protection against such threats, I have restored my Firewall to default settings and will purchase Malwarebytes Premium tomorrow.  I do have a 14 day trial but may just as well purchase the full thing while I have the cash on hand.

Anyhow, thanks to all who offered assistance, I appreciate it muchly.      

I would also suggest having a free antivirus like Bitdefender uninstalled in a different directory just for a rainy day later. Even an uninstalled malwarebytes. Viruses don't target uninstalled software.

Good to hear it's sorted...;)

I never even use Notepad....I've always used Texturizer...and made it the default txt association...;)

Yeah, I'll look into that idea.  I do like Malwarebytes Premium, though, and will keep it on my system.  It found issues that others didn't or couldn't, and being that it has a real-time scanner, firewall and auto database updater, I have greater respect for it than other anti-malware programs I've tried, several of which rely on user input for updates and scans.

I still can't get over Google installing it's crap on my machine, and without consent, no less.  I mean, why would I want or need 3 instances of Google Updater on my machine if I have no Google software installed?  I know that I'll be far more vigilant when clicking on links to Youtube and other sites owned by Google, to check for crap I neither need or asked for.

Quoting Jafo, reply 12

Good to hear it's sorted...

I never even use Notepad....I've always used Texturizer...and made it the default txt association...

Thanks, mate, it was starting to worry me.

I never use Notepad, either, but it comes with the OS and, as I now know, it can be exploited by nefarious software.  I generally use Wordpad for text creation, but after this unpleasant experience I now may look into an alternative that's non-Windows based, maybe even Texturizer.

you never installed chrome or other google stuff ever? chances are it was installed with the other stuff but not uninstalled.

---

what the heck is uninstalled malwarebytes, etc? just the installer file?

Google Chrome installed itself yonks ago with CCleaner as I recall, and I dumped it as soon as I realised it was an unwanted part of the download.  Anyhow, whatever caused the crap to be there it's now gone and Google can go fech itself.

Google Chrome installed itself yonks ago with CCleaner as I recall, and I dumped it as soon as I realised it was an unwanted part of the download.  Anyhow, whatever caused the crap to be there it's now gone and Google can go fech itself.

Weird. I posted another alternative for the cap'n. Notepad++ It was right after reply #14, the Cap'n's post. Don't know what happened to it. 

Notepad++ is awesome.  You can open up e.g. 20 files and one time and do a search or replace on all of them at once.  It has more commands than I'll ever use.

Thanks, Uvah... and Dave.  I'll have a look at Notepad + +, as well as the one Jafo mentioned.  However, it's not urgent.  The notepad that comes with Windows has behaved itself since I got rid of that Google crap, and that'll give me time to investigate the alternatives. 

I was still getting high CPU usage, though, and tracked it down to Windows Defender, which I've disabled as I now have Malwarebytes installed to replace it.  Another one in Task Manager showing high CPU usage is Firefox.  I shall have to investigate that now.

Oh woe is me... the PC problems never end.  

Well Starkers it will take awhile to iron out a new custom computer. I am curious which text editor is better if you can post when you figure that out.