📎 AI Summary:
The thread discusses an issue where Notepad appears to be consuming RAM in Task Manager, prompting concerns about it possibly being a virus. The second post suggests verifying Notepad's legitimacy using Process Explorer and VirusTotal, and notes that Notepad's memory usage is normal when a document is open. The third post demonstrates how closing parent processes like PowerShell can leave Notepad running in the background, leading to the belief that the behavior might be due to orphaned Notepad processes initiated by other applications. Overall, the discussion leans toward the issue being related to process management rather than malware.

harshguy2002

New Member
Member details
Joined
Dec 14, 2018
Messages
1
Thread Author #1
I'm not sure when this occurred but whenever I open Task Manager, I see notepad taking up my device's ram. I have never seen notepad running in background and I don't think it needs to do so. Is it a virus? If so how can I remove it permanently?
37181
 

Solution
Some things of note. Typically there will be an expander arrow since notepad always opens a document. Also the memory usage is pretty high unless a document is open. You could use Process Explorer to verify it's the real notepad in the correct location and do a Virus Total submission from process explorer as well as see if it has any open handles to files.

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
Some things of note. Typically there will be an expander arrow since notepad always opens a document. Also the memory usage is pretty high unless a document is open. You could use Process Explorer to verify it's the real notepad in the correct location and do a Virus Total submission from process explorer as well as see if it has any open handles to files.
 

Solution

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
I was able to replicate this behavior as follows
  • Open a PowerShell console
  • Run the following Start-Process -FilePath C:\Windows\Notepad.exe -WindowStyle Hidden (This creates a child notepad process to the powershell process)
  • Close the PowerShell console (Killing the parent process leaves the orphaned notepad process)

My theory is that something opened a document with notepad and then the application that opened notepad was closed.