notepad.exe, poof, gone!

co worker of mine had gotten a nastie on his machine while searching the better porn sites, so he says...
..he tried to "fix" the problem using some on line !@#$ that just compounded the problem..
..got his system back up and running, got rid of bad stuff, installed and taught him how to use SpyBot, AdAware, SpyWare Blaster, HiJackthis, Zone Alarm and his AV (Symantec) programs...
while he tried to fix computer, he erased/deleted notepad.exe..don't know how he did it or where it went....

Machine is:HP/ Win xp...can get more info if needed.

There is a virus that messes with notepad.exe...changing it to notepad.com and installing itself as notepad.exe.

Search the harddrive for notepad.com, rename it to notepad.exe and see if that works.

If not, you should be able to to extract a new notepad.exe from the I386 folder.

1. Go to Start>Run, type in "msconfig" (without the quotes), click OK
2. On the General Tab, click the Expand File button
3. In "File to restore," type notepad.exe
4. In "Restore From," type C:\I386 (where C is the drive on which Windows is installed)
5. In "Restore To," type C:\Windows\System32
6. Click the Expand button

thanks miz, i'll give that a try and post back.
where did u get your avatar?

Also, you should find a spare copy of Notepad in C:\Windows\System32\dllcache

Hi,

To add to what Miz said, the following are also corrupted by the Trojan

control.exe
rundll32.exe
wmplayer.exe
msconfig.exe
SDHepler.exe

Better check if any of these is corrupted too.
If so get help here
http://www.spywareinfo.com/~merijn/winfiles.html

Elaine:)