Share via

Notepad.exe / In two Windows 10 folders

Anonymous
2021-03-01T14:42:57+00:00

Good day,

For some reason I have two (byte-wise identical) copies of Notepad.exe.

One in C:\Windows and one in C:\Windows\System32. 

If I launch C:\Windows\Notepad.exe, it does not display the 'Notepad icon' but instead the generic program icon, as shown below:

 

For comparison, the *C:\Windows* *System32* Notepad.exe, appears as shown below:

Which Folder is the 'official' one?

I cannot help but suspect that one of the executables (C:\Windows\Notepad.exe) might be something nasty.

Windows' Antivirus is (and always has been) on and it did not complain anything when I scanned these files.

Thank you in advance for any advice.

PS. Below is the Windows version information

Windows for home | Windows 10 | Files, folders, and storage

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. Paulo GM 63,545 Reputation points Independent Advisor
    2021-03-01T15:51:37+00:00

    Hi mmjjkk, I am Paulo, an Independent Advisor, and I'm willing to help.

    I believe that the one with the generic icon was from an older version of Windows and it wasn't a virus. I also have one in C:\Windows with the generic icon same with this thread

    https://answers.microsoft.com/en-us/windows/for...

    You can verify what your Windows is currently using by searching Notepad in Start menu > Open location > Right-click then Properties. See if the path is C:\Windows\System32.

    It is just weird that Microsoft didn't remove it after updates. If you notice in the thread that the versions were different. But If you run the one with the generic icon, the version will change with the current one just like I did.

    I hope this somehow helps.

    9 people found this answer helpful.
    0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-03-01T18:17:02+00:00

    Hi,

    I believe that the one with the generic icon was from an older version of Windows and it wasn't a virus.

    You are probably right. It appears that when I launched Notepad from command prompt, the 'poor C:\Windows\Notepad.exe version' got launched (thanks to order of directories in the %PATH%).

    A minor surprise-twist here was that, even though my Notepad executables are byte-wise identical, when I invoked from command prompt a program which displays file version information, I ended up seeing two different version information:

    File Version : 10.0.19041.746 (WinBuild.160101.0800) - C:\Windows\Notepad.exe

    and

    File Version : 10.0.19038.1 (WinBuild.160101.0800) - C:\Windows\System32\Notepad.exe

    And, when viewed via File Explorer, identical version information (10.0.19041.746) is displayed for both executables.

    Summa summarum: Oh, the madness!

    PS. The "10.0.19038.1" variant seems to actually originate from:

    C:\Program Files\WindowsApps\Microsoft.LanguageExperiencePacken-GB_19038.0.1.0_neutral__8wekyb3d8bbwe\Windows\System32\en-GB\notepad.exe.mui

    It is just weird that Microsoft didn't remove it after updates.

    Yes, perhaps after some major update the extraneous executable will be gone. God forbid there will be a third one!

    Oh well, thank you and cheers

    0 comments
  2. Anonymous
    2021-03-01T17:38:43+00:00

    Hi

    SFC/scannow will fix the issue in system files if it finds an issue and SFC/verifyonly doesn't do nothing. Please try SFC/SCANNOW

    2 or 3 times.

    And let us know about the results

    0 comments
  3. Anonymous
    2021-03-01T17:24:10+00:00

    Hi,

    Out of interest, I ran:

    sfc.exe /verifyonly

    That produced 10 or so warnings, all of them like the following one:

    Warning: Overlap: Directory <directory here> is owned twice or has its security set twice

    Original owner: <Original owner here>, version 10.0.19041.1, arch amd64, culture [l:5]'en-US', nonSxS, pkt {l:8 b:31bf3856ad364e35}

    I like to think that those are practically benign warnings which can be safely forgotten about. I'd hate to eventually find myself trying to, say, re-install the system (should sfc.exe/dism.exe break parts of the system).

    Thank you for answer, though.

    0 comments
  4. Anonymous
    2021-03-01T14:59:58+00:00

    Hi

    Run cmd as administrator then type

    SFC/scannow (Hit enter key , do it 2 or 3 times) then reboot your PC and tell us if that fixed your issue.

    0 comments