My notepad is in german now and what is cdrunxp.exe?

[get1tg00d]

My mom downloaded this file in her email and nothing happened. About 2 hrs later this slideshow of a bunch of guys showed up and I couldn't get rid of it. So I hit the soft reset button on my computer to turn it off. I restarted my computer and my desktop had a wallpaper of a bunch of men. I tried to change it but my Desktop tab in the Display Properties was hidden. So I had to figure out how to unhid it which I did. The other thing that happen was it changed my notepad into German. (look at the attached file) I have two notepad.exe's and one notepad32.exe. One notepad.exe is in C:\WINDOWS (English) the other two files are in C:\WINDOWS\system32 (German). I don't know how to change the system32 notepad.exe to English. If I delete it it comes back still in german. I ran Norton and a trojan scanner neither found anything.

So my question is how can I get my notepad back.

Another question is what is notepad32.exe and cdrunxp.exe? My brothers computer doesn't have notepad32.exe or cdrunxp.exe. If I delete cdrunxp.exe I can't open regedit. It was put on my computer the same day at about the same time as when my mom ran the program that was in her mail.

--edit (remembered something)--
this is what i did first after changing the background to a less homoerotic one.. i went into windows/system 32 and deleted the the gay.mpg and the xtra.bmp, then i deleted the Iexplorer32.exe ...then i scaned my computer with Spybot - Search & Destroy which is avalible at http://beam.to/spybotsd ( the last part might not be nessacry but..you will be suprised what thsi program picks up that ad-awared doesn't.....

if you made it past the the little slide show in the begining after you boot up..well then you are in good shape.....
---

I found the above from a guy. He had the same problem as me and I deleted the gay.mpg and xtra.bmp but I couldn't find Iexplorer32.exe. Could that cdrunxp.exe be the same file just renamed.

 

[SysProg]

Sounds like a virus/mal-ware to me. Did you obtain the latest updates for Norton AntiVirus? My system automatically downloaded new ones yesterday.

FYI - I did a search on the Symantec Virus database and on Google but didn't find a match.

 

[GoNz0]

Notepad32 - Use a Windows Notepad alternative that sports a Preferences dialog box

so i dunno how you picked it up.

try the trend micro virus scan, as that picks up these types of things.

and if your Mum did this, then i would suggest blocking attachments on emails

 

[yoyo]

If you are sure that the notepad.exe in C:\Windows is the original English version, move this to C:\Windows\system32\dllcache overwriting the existing file. Then delete the notepad.exe in C:\Windows\system32. Now the right version should reappear.

 

[get1tg00d]

Originally posted by SysProg
Sounds like a virus/mal-ware to me. Did you obtain the latest updates for Norton AntiVirus? My system automatically downloaded new ones yesterday.

FYI - I did a search on the Symantec Virus database and on Google but didn't find a match.

Yeah I have the lastest updates. I hope it isn't a virus.

Originally posted by GoNz0
Notepad32 - Use a Windows Notepad alternative that sports a Preferences dialog box

so i dunno how you picked it up.

try the trend micro virus scan, as that picks up these types of things.

and if your Mum did this, then i would suggest blocking attachments on emails

I don't know how I got notepad32.exe but I know it looks exactly the same as notepad.exe. I just want to know why they are in German.

I'm definitely not letting my mom look at her email anymore.

 

[get1tg00d]

Originally posted by yoyo
If you are sure that the notepad.exe in C:\Windows is the original English version, move this to C:\Windows\system32\dllcache overwriting the existing file. Then delete the notepad.exe in C:\Windows\system32. Now the right version should reappear.

Didn't work either. As soon as I ran notepad.exe it changed it to the German one then added notepad32.exe.

 

[GoNz0]

i would zip it and send it to nortons to have a look m8, zip em all it can't hurt.