"Tim Jackson" <tim@tim-jackson.co.uk> wrote in message
news:WsWdnSpgiuNeYpfXnZ2dnUVZ8oydnZ2d@brightview.co.uk...
> ~BD~ wrote:
>> Tim Jackson wrote:
>>> ~BD~ wrote:
>>>> Tim Jackson wrote:
>>>>
>>>>> That's NOT MS notepad you were running. I admit my knowledge of
>>>>> Windows is a bit out of date, but I just checked it out on a Vista
>>>>> machine and notepad still displays in a single font and does not
>>>>> recognise URLs as anything special. Was this on your Mac? Or, if
>>>>> Windoze, what are the chances notepad itself had been compromised?
>>>>
>>>> What I have referred to happened a number of years ago, so I cannot be
>>>> categoric. It was on a PC using Windows XP Home.
>>>>
>>>
>>> Then it wasn't notepad you were running, I can be categoric about that.

>>
>>
>> Now you have me *really* confused! Notepad is a part and parcel of
>> Windows XP - at least it is here on my machines!
>>
>>

>
> Notepad is an accessory program supplied with all versions of Windows.
> Parcel yes, but not part. It does not have the capability AFAIK to display
> clickable URLs, or hyperlinks, it's a simple ASCII text editor.
>
> If you opened a file with Notepad and it displayed hyperlinks, then I
> would say your copy of Notepad had been replaced by something else. It
> does seem feasible to me that some malware might hook notepad with
> something that displays a few of its own hyperlinks, then reverts to
> business as usual. But it's pretty dumb malware because a lot of users
> would know this was abnormal behaviour for this program, and that they had
> been had. So it probably brushed snow over its tracks once you had run it
> (and followed a link), that's why it reverted to normal.
>
> I am convinced the problem lay in Notepad, not the displayed file. It
> also explains why other 'helpers' were confused.
>
>
> Tim


You are, in all probability, correct, Tim.

I found this item: http://www.swishtalk.com/showthread.php?t=37681

This seems to relate to Notepad being replaced
http://mc-computing.com/Parasites/notepad_virus.html

> One of your attempts showed "Exif " Which should be the seventh byte
> onwards of a jpg file, usually followed by some readable identification of
> the system that created it. Anything more than six bytes it shows before
> that isn't part of the file.


I did notice that - but had no idea what it meant!

Thanks for your patience.

--
Dave