• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 500
  • Last Modified:

Notepad Unexpectedly Closes after typing a few characters

My machine was recently besieged by a bunch of  trojans/spyware programs after clicking on a URL from a google search. I have manually edited the registry, used a couple of suggested cleaners, and spybot. Most everything has been fixed except the following:

IE default homepage is still hijacked by "Home Search" page which now make IE unusable and doesn't even close without creating an error.

And NOW when I use notepad and type a few lines it closes, no warning just BAMM its gone.

Does anyone know what's going on with my pc and how to fix it. I'm in the middle of a bunch of projects and completely ditching and reformatting has to be my last resort.

Thanks!
0
brian2k1
Asked:
brian2k1
  • 8
  • 6
  • 5
2 Solutions
 
SheharyaarSaahilCommented:
Hello brian2k1 =)

First use msconfig to untick unwanted progrmas as described here >> http://netsquirrel.com/msconfig/
Then Download these tools and install them:
========================================================
AdAware ==> http://www.spychecker.com/program/adaware.html
SpyBot  ==> http://www.spychecker.com/program/spybot.html
CoolWebShredder ==> http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
About:Buster ==> http://www.softpedia.com/public/cat/10/17/10-17-211.shtml
Home Search Removal Tool ==> http://www.softpedia.com/public/cat/10/17/10-17-210.shtml
Stinger ==> http://vil.nai.com/vil/stinger
========================================================

Turn off ur System Restore before cleaning the system if its WinME\XP >> http://www.pchell.com/virus/systemrestore.shtml
Then Run all of them one by one in safemode and delete everything they detect.
Then delete the temporary internet files and history of IE
and run Disk Cleanup on ur hard drive to delete those temp and junk files.
Restart back in Normal Mode to check for the problems now ?? :)

If still you face problem, then Download HijackThis v1.98.2 from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe

Then Post that log at this site >> http://www.hijackthis.de/index.php?langselect=english
and it will automatically analyse it for u,,, Fix the entries which it labels as Nasty :)
To Fix, check the lines in Hijackthis scan and click on Fix Checked !!

HJT Log Tutoriol >> http://aumha.org/a/hjttutor.php

CAUTION: Before fixing the entries in hijackthis, make sure that they are really Nasty and can be deleted, better u first research for it on Google and then when u will confirm that they shud be deleted, Fix them. And whenever u run Hijackthis, run it from a New folder on ur desktop, so that in case of any problem, u can take advantages of its created backups of fixed items. And in case if u still face problems in dealing with it, just analyse ur log at the above site, and then scroll down where u will see a Save Analyse button, hit it and it will save ur Log Analysation, then copy the link of that page and paste it here, and we will check it for u :)
0
 
sunray_2003Commented:
Hi brian2k1,

Do you see only notepad getting crashed or other applications like Wordpad and office applications etc.
Intensity of your issue would depend on the answer for the above question.

Try to run all the spyware removal tools in safe mode ( if you have not run them ) and see if you can get rid of the homepage hijacker. Make sure to update all the spyware definitions in those softwares and check .

Once if you are successful in removing spywares , check if notepad works fine. If not , you can either get a copy from the windows OS CD you have and put it in c:\windows\system32 folder so that you can replace the problematic notepad.exe file in there or get it from another good working machine and put it there. Though getting from another machine is easier , i wont recommend as you never know that is good or bad.

If your other applications also fail , you may want to reinstall them . May be your spyware had corrupted them or corrupted someother way .

Post us how that goes.

SR
0
 
brian2k1Author Commented:
That is great info and I've already used SpyBot, About:Buster, to no avail.

Do you know anything specifically about this Notepad problem?

Thanks.
0
2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

 
SheharyaarSaahilCommented:
>> Do you know anything specifically about this Notepad problem?
must be a background application is closing it... have you tried to open it in safemode yet ??
0
 
SheharyaarSaahilCommented:
>> That is great info and I've already used SpyBot, About:Buster, to no avail.
Did you disable the system restore before running them?
Did you run them all in safemode ?? just running them is not gonna work.... a proper procedure is needed to clean the system :)
0
 
brian2k1Author Commented:
F8 to Safemode, ran them all, system restore was turned off before attempting any of that. I usually turn off system restore but forgot last month when I did a fresh install!

I'll try the program again and see what happens.
0
 
sunray_2003Commented:
Hope you have a different browser other than IE to download those spyware removal tools as your IE doesnot seem to work.
If you donot have another browser , Try to fix IE using this http://windowsxp.mvps.org/IEFIX.htm
or repair or reinstall if that tool doesnot work
0
 
sunray_2003Commented:
brian2k1,

You can try this http://www.snapfiles.com/get/hsremove.html 
looks specific to ur issue
0
 
SheharyaarSaahilCommented:
>> I'll try the program again and see what happens.

Dont forget to run the Home Search Removal tool.... and try one more thing plzz, goto IE>Tools>Internet Options>Advanced and under Browsing untick Enable Third Party Browser Extensions(requires restart)
Apply and now check if you still get those errors with IE ??
0
 
brian2k1Author Commented:
I use FireFox  as a 2nd browser and have already switched to it permantly. I also sent a complaint to MSFT via the link in IE help. I like MSFT software but these IE spyware problems have to be fixed ASAP.
0
 
SheharyaarSaahilCommented:
>> You can try this http://www.snapfiles.com/get/hsremove.html 
>> looks specific to ur issue

sunray its the same tool as i mentioned in my first suggestion >> Home Search Removal Tool ==> http://www.softpedia.com/public/cat/10/17/10-17-210.shtml

:)
0
 
SheharyaarSaahilCommented:
>> but these IE spyware problems have to be fixed ASAP
no problem..... we will surely solve them :)
0
 
sunray_2003Commented:
SheharyaarSaahil,

Never saw your updated spyware listings.  

Brian,
You can run that hsremove tool to see if that would solve this issue.. that would avoid running so many tools
0
 
brian2k1Author Commented:
Appreciate all the help and quick replies!

After I'm done I'll update this thread.
0
 
SheharyaarSaahilCommented:
sure..... good luck :)
0
 
sunray_2003Commented:
brian2k1,

More than spyware issue you have problems with applications.
Make sure to solve all those aswell.

Fixing IE using IEFIX and reinstalling the applications that doesnot work (if required) needs to be done aswell.

Once you see the hijacker no longer comes make sure to restart the machine and see if they donot come back again.Spywares are notorious for that..

SR
0
 
brian2k1Author Commented:
So far:

Ran all the same utilities then CWShreader and Adaware I think those two actually killed the infection.

IE works but is slow and I disabled 3rd party plugins which killed GoogleBar. So I enabled it then selectively disabled the plugins I thought were a problem, which seems to fix the homepage takeover issue.

Go to Internet Options, Programs, click on Manage Add-ons button
I disabled:
      crmv.dll
      Research
      SearchAssistantOC

Notepad is still closing for now reason, arghh!

Anyone know how just clicking on a URL a website was able to install all this crap without prompting me?
0
 
SheharyaarSaahilCommented:
Use Hijackthis to fix those nasty BHOS, or get BHODemon >> http://www.softpedia.com/public/cat/10/17/10-17-71.shtml
And is notepad closing in safemode also ??
0
 
sunray_2003Commented:
brian2k1,

Did you run IEFIX>. You may want to run that and see if that solves IE issue..

Make sure to restart your machine to be sure spyware has totally gone.

Does other applications also crash ?
0

Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

  • 8
  • 6
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now