1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

WTTA.EXE and the NOTEPAD.EXE that will not die

Discussion in 'Virus & Other Malware Removal' started by GlenWong, Feb 15, 2005.

Thread Status:
Not open for further replies.
  1. GlenWong

    GlenWong Thread Starter

    Feb 15, 2005
    Running XP on home PC. Have been getting pop under ads for a week or so. Lavasoft SE and Spybot found stuff and killed them off but ads keep coming. Task Manager shows Notepad.exe loading everytime I run AOL or MS IE. Terminating that task seems to stop the ads for that session. The file date for Notepad.exe is from 29 Aug 2002 and the size is 65 kb. Seems big and when it pops into Task Manager, it is a resource hog for a second or two. It I/O reads a few MB and writes a few MB and then idles.

    Spybot tool listing Startup tasks listed WTTA.EXE. I deleted it using Spybot. That didn't stop the Notepad.exe from starting with MS IE.

    I tried renaming Notepad.exe to something else, deleting it, even editing it directly to make it unfunctional. Watching the file list in MS Explorer, I could see the file size decrease as I saved the edited corrupted file and then saw the file 'grow' back. Something is ensuring that that file never gets deleted or changed by constantly monitoring and rewriting a whole new copy if needed. Creepy.

    Went into the registry looking for "StartIE" key that names Notepad. No "StartIE" text was found.

    Thanks for any help.
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/331153

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice