Notepad Opens at Windows Startup

Question

After I turn on my computer, After Windows starts, Notepad opens a file for editing.

This behavior only recently started; I'm sure I did something to cause it but I don't know what. The file that is opened is in the root on the c: drive, and I don't recognize the contents. The name is RI.txt (I know this isn't very useful).

I've checked the "Startup" folder and there is nothing in it.

I've checked the Registry as best I could, using advice from online and the application "Startup Control Panel" but could find nothing that starts Notepad.

I am hoping to be pointed to a log that will clearly identify where the command is that is telling Notepad to start.

Thanks.

Answer 1

Thanks LemP for the response regarding this old OS.

The RI file actually has readable text:

CreateObject("Wscript.Shell).Run

although I don't recognize it.

I forgot to mention in the original post that I had looked at the Task Manager also, but didn't recognize anything that might have caused the problem.

Thanks to you suggestion about using AutoRun, which showed a "Hybrid" task in the Task Manager that pointed to the problem file, which I didn't see previously. I looked again at Task Manager. And by the way, I didn't see any other posts that mention Task Manager for this kind of problem.

Sure enough, the "Hybrid" task is triggered "At log on of any user", and the Action is "Start a Program" and the Details show a path to the problem file.

I disabled the task, rebooted the computer, and the problem is gone.

I guess the Task Manager was trying to start the "executable" file, didn't know how since is wasn't executable, and so just opened it with Notepad.

Thanks for your response and help; your suggestion about AutoRun was the crux in solving this problem, and I'm glad that I'm now aware of this great application.

Answer 2

Are the contents of C:\RI.txt actually text or are they gibberish?

The best tool for investigating startup issues is Autoruns: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

My guess is that there is an item that wants to startup something that begins with RI but there is a space or some other invalid character between those two characters and the rest of the file name.

Answer 3

I think you're actually referring to "Task Scheduler" rather than "Task Manager," but in either case, it's good that you've stopped this.

Any effort by an unknown source to start a script sounds to me very much like malware. Assuming that you have a reasonably good antimalware utility installed, my guess is that your antimalware utility removed the "guts" of the malware but did not remove the mechanism used to initiate the malware.

I suggest that you download the free trial of Malwarebytes and do a complete scan of your system. After the 14-day free trial period, the program reverts to an on-demand only scanner (i.e., no real-time protection); or you can just uninstall it after you do the initial scan.

https://www.malwarebytes.com/premium