Unable to Launch Notepad from Run or View HTML Source

Today I experienced something weird.

Normally I run a lot of files just from ‘Run’ (Win+R), but today I did ‘Run’, ’notepad’, and nothing happened…

This was weird… I could still open .txt files with Notepad.

I could not run Notepad from ‘Run’! I was amazed, I mean… what could break Notepad? :)

First I checked if the file was still there (of course, how could I still view files otherwise…), and if my PATH variable still included Windows. Everything seemed OK.

But then I found it, it only seemed as if I could not run Notepad.

What happened was the following: There was a notepad.com file in the system32 dir all of a sudden (spyware, virus, don’t know). And Windows decided to run that one instead of notepad.exe.

So it seems Windows prefers .com over .exe when trying to run a file without an extension.

Why does this happen?

There’s another environment variable, called PATHEXT, with the following data:

PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

Now you can clearly see the order of the files. I tried the same thing with a .bat and an .exe file, and by changing the environment variable, and it worked.

I’m not sure whether .COM has to be first in line for normal system operation.

One side-effect of this was that when I wanted to view the source of an HTML page, it would also launch notepad.com, which did nothing, so no source was shown! I remember a lot of people complaining about not being able to view the source of their pages, this could be what’s causing it!

Hopefully I’m telling you something new and useful here ;) I never knew that order of extensions.

Update: this was a known malware trick: drop a .com next to a common .exe so it runs first.