Virus attack.

[sparkyminer]

My AV just informed me that it had detected a virus and spyware and neutralized them, the file being C:\WINDOWS\system32\NOTEPAD.EXE
Immediately after that a window pops up saying that files that allow windows to run properly have been altered and are not recognisable. Insert XP home edition service pack CD2 now. I haven't got one, I downloaded it. Do I download again?
Any advice would be welcome. :)

[Sandman]

Hmm. Well I reckon your AV will have stored the file in Quarantine, and you COULD restore the file that way. That is if it isn't really a virus.
Do you have Heuristics scanning enabled? If so, it is possible to get false virus warnings.
What AV do you use?
alternatively you could just get a copy of NOTEPAD.EXE from someone else who uses XP@Home.

[sparkyminer]

I use Panda platinum. I'll have to check the settings.

[Sandman]

Just found some more info about what this virus could potentially be. Hope it is ok to post this link(?):

http://www.cpcug.org/user/clemenzi/technical/notepad_virus.html

Best not restore the file if you ave any of these symptoms. Did your AV say which virus it was?

[sparkyminer]

Yes, the Heuristic scanning is enabled.

[Sandman]

Will this stop you getting your teamsheet in on time!?!?!?
Pity you are not playing me this week!!

[sparkyminer]

Depends what it stops me doing the PC seems to be working OK. That link is useful but, way over my head.

[jollyjayne]

:doh
That link is useful but, way over my head.

But sparkyminer, EVERYTHING is over your head, ( well when at work anyway ) :doh

[sparkyminer]

This is my AV report.
Sorry in advance if it's too big. I tried to reduce it.

[sparkyminer]

:doh

But sparkyminer, EVERYTHING is over your head, ( well when at work anyway ) :doh
:laugh :laugh :laugh
Thanks for the constructive input JJ. :wink :)

[silax]

take 2 asprins and a glass of milk works everytime

[sparkyminer]

alternatively you could just get a copy of NOTEPAD.EXE from someone else who uses XP@Home.
I just looked for it on my laptop and there doesn't appear to be one on there. :doh

[sparkyminer]

Is it possible for someone to post the file on here?

[sparkyminer]

Please. :)

[bigcumba]

coming right up - watch this space!

[bigcumba]

here you go - had to rar it to upload to the forum

[sparkyminer]

Cheers BC. That lets me open notepad from winrar. When I try to save it in the system32 file it classifies it as an application file. I cannot open notepad from the desktop????????????????

[bigcumba]

could you save it to the desktop, rename it to notepad.old, then save it into the Windows directory and rename it back to the exe file - just an idea?

[bigcumba]

I've emailed both the exe and rar versions to your tiscali address - hope that helps!

[sparkyminer]

I've put it on the desktop and I can open it from there which will get me by. I dragged and dropped the .exe file and it's saved on the desktop as an application as well. But at least I have it working. It'll keep Vegy off mi back. :yikes:

[sparkyminer]

I've emailed both the exe and rar versions to your tiscali address - hope that helps!
I've just PM'd you. :)

[GlosRFC]

If you can't get Notepad to work, you can always use Wordpad - same thing, just its bigger brother. You should be able to find it in your Accessories folder or just type Wordpad into Start, Run.

You might also find that the virus has renamed the original Notepad.exe as Note.Com so it's probably still lurking in your Windows\System32 directory. Just rename it back again and you'll have a functioning Notepad once more.

[sparkyminer]

I did a system restore to before the virus attack. Everything appears OK.