Hi Frank,
Notepad.exe is normally the Windows text editor, maybe you use it. I use it
all of the time.
Notepad.exe can also be a trojan, like here for example...
http://www.pchell.com/virus/qaz.shtml
Notepad.exe normally exists in these folders:
C:\WINDOWS The Notepad.exe here is included for backwards compatibility for
old Windows 95 programs.
C:\WINDOWS\system32 The Notepad.exe located here is the one that normally
gets used. I.e. Start\Programs\Accessories\Notepad. Though either one is
legitimate and it doesn't really matter which one is used.
And a copy of Notepad.exe here...
C:\WINDOWS\system32\dllcache
or here...
C:\WINDOWS\ServicePackFiles\i386
used for backup purposes for Windows File Protection. In case one of the
others gets messed up some how. Usually you have one folder or the other.
If you type: notepad into Start | Run and click OK an Untitled - Notepad
should open. In fact, I am typing this message in an Untitled - Notepad
right this minute. I will copy this text and paste it into an Outlook
Express message later. ;-)
Normally notepad.exe should *not* be running when you shut down your machine
unless you started it on purpose.
If a legitimate notepad.exe is running (there can be more than one copy
running), you can see Untitled - Notepad listed in the Task Manager under
the Applications tab. To open Task Manager hit Ctrl + Shift + Esc, click on
the Applications tab. Locate Untitled - Notepad, right click it and select
Go To Process. Task Manager should open at the Processes tab with
notepad.exe highlighted.
If a legitimate copy of notepad.exe is running that was started from a *.txt
file, the title in Task Manager under the Applications tab will be listed by
the Name_of_the_file.txt and will be listed as notepad.exe under the
Processes tab.
Notepad.exe can also be running as Name_of_the_file.txt or .log or .ini or
any other of a number of legitimate file extensions.
Doing a Google search for "failed to initialize because Windows is shutting
down" and reading through *many* posts indicates some kind of malware.
Before you shutdown you need to use Task Manager to determine if any copies
of notepad.exe are running. If any are, did you start them? You can use
Task Manager to End Process or End Task.
Open Task Manager....
1. Ctrl + Shift + Esc or Ctrl + Alt + Del.
2. Click the Processes tab.
3. Right click notepad.exe and select End Process.
4. This message will popup:
WARNING: Terminating a process can cause undesired
results including loss of data and system instability. The
process will not be given the chance to save its state or
data before it is terminated. Are you sure you want to
terminate the process?
5. Click on YES and close the Task Manager.
Open Task Manager....
1. Ctrl + Shift + Esc or Ctrl + Alt + Del.
2. Click the Applications tab.
3. Right click Untitled - Notepad and select End Task.
4. This message may popup:
The text in the Untitled file has changed.
Do you want to save the changes?
5. Do whatever and then close the Task Manager.
There may be a legitimate reason that notepad.exe is running that you did
not start on purpose. Here is one example of that. But I would think that
you would notice this when you started your machine.
http://support.microsoft.com/kb/330132
Or if you have this problem...
Clicking the "Open With" or "Choose Program..." option always opens the file
with Notepad
http://windowsxp.mvps.org/openas.htm
I did not include those last two items for confusion, just to show that
there are other legitimate reasons for notepad to open, even if they open
notepad.exe because of some other problem.
You're going to have to play Sherlock Holmes and investigate:
* Why Notepad.exe is open when you shutdown?
* Is it a legitimate Notepad.exe?
* If not legitimate, what is it really?
* If it is legitimate, why is it running in the first place?
Hopefully the information here will help with that. ;-)
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
