Need removal instruction for Notepad.exe

[Texas]

Hi,
Last night my system was working extremely slow. I press Ctrl + Alt + Del and found that notepad.exe service is using a high amount of system resource. But the strange thing here is that I had not open notepad. Is this a Windows file. If yes then what can be the reason behind eating up so much memory. I believe that it is a virus. If it is then how to remove it completely from the system. Because as I restart the application starts automatically in the background. Thanks.

[Macarenas]

It can be a virus. As you said that you had not opened up notepad. Try this out. Boot you computer in safe mode. This can be done by pressing F8 continuously at the time when computer starts. A menu will appear on the screen. Choose Safe mode. Run a full system virus scan. If your antivirus is not updated then it will be difficult for your security software to remove the threats. So better keep them always update for new threats.

[ThoMas321]

It is a trojan virus. The virus is located in the C drive which is the default Windows directory. You can also run a search process for the file. Click on End process when you see the file. After that look in C:\Windows\System32. If you found a file more than 500 kb then delete it. You can also download notepad from the official windows site in case if you delete the application.

[ZeDaX]

The file normally lies in Windows directory. It is dangerous threat. The file size is around 69,120 bytes. The program is visible and can be seen in the task manager once it is running. It also lies sometimes in the program file folder. The virus files creates a auto launch key in the registry of Windows. Due to this the file runs in the background. Use a registry repair tool to fix the altered registry issue.

[techfolkcmr]

Hope this will help you.

What is QAZ Trojan Program?

This backdoor Trojan allows hackers to access and control an infected system. TROJ_QAZ was initially distributed as "Notepad.exe" but might also appear with different filenames. Once an infected file is executed, TROJ_QAZ modifies the Windows registry so that it becomes active every time Windows is started. TROJ_QAZ also renames the original "notepad.exe" file to "note.com" and then copies itself as "notepad.exe" to the Windows folder. This way, the Trojan is also launched every time a user runs Notepad. TROJ_QAZ also attempts to spread itself to other shared drives on local networks. This Trojan does not mass email itself out to lists in the users address book however.

How to Clean/Delete the QAZ trojan?

The registry needs to edited to delete this Trojan

Click START, RUN
Type REGEDIT and hit ENTER key
In the left panel, click the "+" to the left of the following:
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Run
In the right panel, search for any of the registry key that contains the data value of startIE=XXXX\Notepad.exe.
In the right window, highlight the registry key that loads the file and press the DELETE key. Answer YES to delete the entry.
Exit the registry.
Click START,SHUTDOWN. Choose "Restart" and click OK.
Use the Find Tool under the Start Menu to find and rename Note.com to Notepad.exe.

********************

[Texas]

Thanks for the help, will try it out as soon as i reach home.. A nice simple and understandable method... Thanks Mate!!