Notepad.exe replaced by actmovie.exe

F

Fito

When I click on any .txt file i am prompted that windows cant find
notepad.exe. I am quite sure I have a virus but AVG, Trendmicro and a few
others cant find it. Notepad's proprerties tells me that the target has been
changed to C:\WINDOWS\system32\actmovie.exe.

When I try to change the name from actmovie to notepad.exe I get prompted
that the name isnt valid.

Can anyone help please?

Andre
 
S

steve

Fito said:
When I click on any .txt file i am prompted that windows cant find
notepad.exe. I am quite sure I have a virus but AVG, Trendmicro and a few
others cant find it. Notepad’s proprerties tells me that the target has been
changed to C:\WINDOWS\system32\actmovie.exe.

When I try to change the name from actmovie to notepad.exe I get prompted
that the name isnt valid.

Can anyone help please?

Andre
I searched on google, and actmovie.exe seems to be a well known virus
side-effect. I saw notes about the exact symptoms that you are
experiencing. Suggest you search on google for "actmovie.exe" and go
from there.
 
V

*Vanguard*

Fito said in news:[email protected]:
When I click on any .txt file i am prompted that windows cant find
notepad.exe. I am quite sure I have a virus but AVG, Trendmicro and a
few others cant find it. Notepad's proprerties tells me that the
target has been changed to C:\WINDOWS\system32\actmovie.exe.

When I try to change the name from actmovie to notepad.exe I get
prompted that the name isnt valid.

Can anyone help please?

Andre

The file association for .txt files has nothing to do with the
properties defined for the shortcut used to load notepad.exe.

Open Explorer. Go to its Tools -> Folder Options -> File Type tab and
check what program is associated with .txt files (sort by extensions).
When you click on the .txt extension filetype, does "Notepad" show up in
the Details section? Click on the Advanced button to see what program
is specified for the Open action; select "open", click Edit, and see
what is in the "Application used to perform action:" field, which should
have:

C:\WINDOWS\system32\NOTEPAD.EXE %1

What happens when you use Start -> Run (or Winkey+R) and enter "notepad"
(to supposedly load Notepad)? The shortcut in your Start menu should
list the same above path to notepad.exe (but without the %1 parameter).

Note that anti-virus programs look for viruses (and some trojans). They
do not search for spyware or other malware. Have you downloaded,
updated, and ran Ad-Aware, Spybot, and CWShredder?
 
F

Fito

*Vanguard* said:
Fito said in news:[email protected]:

The file association for .txt files has nothing to do with the
properties defined for the shortcut used to load notepad.exe.

Open Explorer. Go to its Tools -> Folder Options -> File Type tab and
check what program is associated with .txt files (sort by extensions).

It says Text Document.

When you click on the .txt extension filetype, does "Notepad" show up in
the Details section?

No. "Opens with: " Nothing is there.

Click on the Advanced button to see what program
is specified for the Open action; select "open", click Edit, and see
what is in the "Application used to perform action:" field, which should
have:

C:\WINDOWS\system32\NOTEPAD.EXE %1

That is there.
What happens when you use Start -> Run (or Winkey+R) and enter "notepad"
(to supposedly load Notepad)?

A notepad opens.

The shortcut in your Start menu should
list the same above path to notepad.exe (but without the %1 parameter).

It doesnt. Its target is the following: C:\WINDOWS\system32\actmovie.exe
Note that anti-virus programs look for viruses (and some trojans). They
do not search for spyware or other malware. Have you downloaded,
updated, and ran Ad-Aware, Spybot, and CWShredder?

CWShredder said my system was clean. I have Ad-Aware and have to learn howe
to use it.

Thanks for taking the time.

Andre
 
F

Fito

I searched on google, and actmovie.exe seems to be a well known virus
side-effect. I saw notes about the exact symptoms that you are
experiencing. Suggest you search on google for "actmovie.exe" and go
from there.

I also did the same. Nothing seems to offer a fix or lead in that direction.

Thanks.
 
V

*Vanguard*

Fito said in news:[email protected]:
It says Text Document.


No. "Opens with: " Nothing is there.

You might try clicking on Change and selecting the Notepad application.
That is there.

That is just for the 'open' action. There were probably other actions
defined. Presumably you have checked that notepad.exe is actually under
C:\Windows\system32 (i.e., you have checked the path is valid). Also,
to ensure the above is exactly as described, copy it (from the recorded
filetype entry for the 'open' action, not from this post) and paste into
a DOS prompt to ensure Notepad does startup okay (you'll get a prompt
after Notepad file asking if you want to create the %1 file; just say
No). There must be no spaces within the path to the executable file
(else, if there are spaces, the full path, including filename, must be
enclosed in double quotes, as in "C:\Program Files\subdir
name\filename.exe").

It doesnt. Its target is the following:
C:\WINDOWS\system32\actmovie.exe

Then just change it to point at notepad. Then see if it gets changed
back to actmovie.exe (which then points to something currently running
on your system to revert it to actmovie.exe).


The settings for the filetype association are found by looking in the
registry at:

HKEY_CLASSES_ROOT\.txt

should have a default value of "txtfile". A subkey:

HKEY_CLASSES_ROOT\txtfile

defines the actions (open, edit, print, or whatever) under the 'shell'
subkey. You did not mention what other actions are defined. Could be
one of those other actions are getting used.

Have you yet tried using msconfig.exe to disable all startup programs,
reboot, and checked if the .txt links will work then?
 
F

Fito

*Vanguard* said:
Fito said in news:[email protected]:

You might try clicking on Change and selecting the Notepad application.

There is no option for Notepad. Maybe I should create one? How?

That is just for the 'open' action. There were probably other actions
defined. Presumably you have checked that notepad.exe is actually under
C:\Windows\system32 (i.e., you have checked the path is valid).

When I try to replace actmovie.exe with notepad.exe it says that the target
isnt valid.

Also,
to ensure the above is exactly as described, copy it (from the recorded
filetype entry for the 'open' action, not from this post) and paste into
a DOS prompt to ensure Notepad does startup okay

I did this and got this:
'C:\WINDOWS\system32\NOTEPAD.EXE' is not recognized as an internal or
external c
ommand,
operable program or batch file.

you'll get a prompt
after Notepad file asking if you want to create the %1 file; just say
No). There must be no spaces within the path to the executable file
(else, if there are spaces, the full path, including filename, must be
enclosed in double quotes, as in "C:\Program Files\subdir
name\filename.exe").



Then just change it to point at notepad. Then see if it gets changed
back to actmovie.exe (which then points to something currently running
on your system to revert it to actmovie.exe).

It just wont let me change it.
The settings for the filetype association are found by looking in the
registry at:

HKEY_CLASSES_ROOT\.txt

should have a default value of "txtfile". A subkey:

HKEY_CLASSES_ROOT\txtfile

defines the actions (open, edit, print, or whatever) under the 'shell'
subkey. You did not mention what other actions are defined. Could be
one of those other actions are getting used.

Have you yet tried using msconfig.exe to disable all startup programs,
reboot, and checked if the .txt links will work then?

huh?
 
V

*Vanguard*

Fito said in news:[email protected]:
There is no option for Notepad. Maybe I should create one? How?

There isn't a button called "Change" to let you choose what program to
associated for that filetype? Or do you mean you click Change but
Notepad isn't listed as a program you can select to associate with that
filetype?
When I try to replace actmovie.exe with notepad.exe it says that the
target isnt valid.

Because of an error message? Or because the values don't stick? When
changing the properties of the shortcut and getting a message about an
invalid path (but you know the file exists in that path because you can
see it) then maybe the "Start in" field is wrong. You need a valid path
(to an existing file) in the Target field. In this case, you can leave
blank the "Start in" field (or put in something like C:\ if that is
where you want to default Notepad to search from when using its File ->
Open menu).

Is the Target field pointing to the actual file? Or are you trying to
point a shortcut at another shortcut? Although you mention that
C:\Windows\System32\notepad.exe will not run (so I have to wonder what
notepad.exe does get ran when you enter it in Start->Run), the Target
field doesn't even have to point at an executable file. I can create a
test.txt file with some simple comment, rename it to test.exe, and
create a shortcut to test.exe which obviously is not an executable file.
The Target field only checks that the file exists, not that it is
executable. If it is the Target field (and not the Start In field)
where you get the error "does not exist" then you are specifying an
incorrect path or filename.
Also,

I did this and got this:
'C:\WINDOWS\system32\NOTEPAD.EXE' is not recognized as an internal or
external c
ommand,
operable program or batch file.

Sounds like you, someone, or something overwrote the notepad.exe file by
using an text editor or running a program that replaced the file (so it
is no longer an executable program). When you right-click on the file
in Explorer and look at its Version properties tab, does it say it is
from Microsoft and that it is Notepad?

If you use a hex editor on C:\windows\system32\notepad.exe, do you see
"This program cannot be run in DOS mode" at the beginning (hex bytes 4E
to 73)? (You can get a freebie hex editor from
http://www.hhdsoftware.com/ and lots of other hex editors from download
sites.)

Does the copy of Notepad under C:\WINDOWS\system32\dllcache\notepad.exe
run okay? If so, have you yet ran the System File Checker?

sfc /scannow
you'll get a prompt

It just wont let me change it.

Does that mean you got an error message (which refuses to let you make
the change)? Or do the values you change not "stick" so when you open
the properties of the shortcut again they are back to the bad values?
If the values don't stick then something is running that is changing
them back (and why I suggested using msconfig.exe to disable any startup
programs).

If you have never used msconfig.exe (System Configuration Utility) then
it is time to learn. Either do a search on "System Configuration
Utility" in Start -> Help and Support, or read the following:

How to troubleshoot by using the System Configuration utility in Windows
XP
http://support.microsoft.com/?id=310560

You said that when you entered "notepad.exe" in the Start->Run dialog
that Notepad did open up. That means there is a working notepad.exe
somewhere to be found. Do a search on notepad.exe and see how many you
have and where. Be sure to include searching for hidden files and in
system directories. (Windows XP's Search has some known problems, like
not looking inside files unless it has a file handler specific to that
filetype, so you might want to get the freebie version of Agent Ransack
to do the search.)

The fact that you get an error when trying to run
C:\Windows\System32\notepad.exe means that file is no longer what it was
supposed to be. Maybe someone edited that copy or replace it with a
non-executable file by the same filename.
 
G

Guest

I'm having the same problem. My search results located notepad.exe in C:\Windows, C:\I386 and Notepad.exe-2DAE2DE6.pf in C:\Windows\Prefetch. The notepad.exe in the prefetch file will not open. Error message: Windows cannot open file. Windows needs to know what program created it. Notepad is all caps in the C:\Windows file and lowercase in the C:\I386--both open to untitled notepad. How do I get Notepad back to accessories? And what's Prefetch file?

Thanks for your help.
 
G

Guest

Also, Notepad will open from Start-Run however if you enter text and save then try to reopen the document you get nothing. No error message, no blank page. Nothing happens. Do Fito and I still have a virus that isn't being detected by the antivirus and spyware scans?

haley
 
V

*Vanguard*

haley said in news:[email protected]:
I'm having the same problem. My search results located notepad.exe in
C:\Windows, C:\I386 and Notepad.exe-2DAE2DE6.pf in
C:\Windows\Prefetch. The notepad.exe in the prefetch file will not
open. Error message: Windows cannot open file. Windows needs to know
what program created it. Notepad is all caps in the C:\Windows file
and lowercase in the C:\I386--both open to untitled notepad. How do I
get Notepad back to accessories? And what's Prefetch file?

The Prefetch folder contains a layout.ini file and a [partial] copy of
the programs that you have executed in order to quickly load them. You
can just delete all the files in the Prefetch folder (and have Windows
XP rebuild this list over time).

Don't know where you got the C:\I386 folder. That's not part of the
Windows XP install. Looks like you copied the folder off the install
CD.

Other than the prefetch folder, on my system, notepad.exe is in:

%systemroot%
%systemroot%\system32
%systemroot%\dllcache

For most users, %systemroot% is C:\Windows. You'll need to change
options in Explorer to view the dllcache system folder, or use a DOS
shell (where you might want to run "fc /b notepad.exe
system32/notepad.exe" and "fc /b notepad.exe
system32\dllcache\notepad.exe" while within the C:\Windows folder to
ensure they are the same file.

Have either of you ran the Repair from the install CD to see if
repairing your Windows XP install might fix the problem?

How to perform an in-place upgrade (reinstallation) of Windows XP
http://support.microsoft.com/?id=315341

Or by yanking a copy of notepad.exe off the install CD (it probably
needs to get extracted from a .cab file)?

There are also viruses that will usurp the notepad.exe file. Have you
performed a full scan using a recently updated anti-virus program?

http://www.pchell.com/virus/qaz.shtml

If you visit http://www.viruslist.com/eng/ or
http://securityresponse.symantec.com/avcenter/vinfodb.html and search on
"notepad.exe", you will find many viruses or trojans will infect
notepad.exe.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads


Top