Blank app name in "open with ..." list

On Mon, 21 Nov 2011 08:53:00 -0800 (PST), Lee
wrote:


The comfile mod that I "found" does open Windows Explorer in single
pane web view as you describe, perhaps take off your glasses and look
closer at that single entry? Real close.

Actually put ON glasses to use the pooter, but in fixed-width font in
Notepad (where I copied/pasted the entries of "interest") spaces are
far easier to spot than in the more normal proprtional fonts, and all
three - exe, com, bat - were identical:

shell\open\command]
@="\"%1\" %*"

the only space being before the second %.

BTW, the regedit entry among that group was @="regedit.exe \"%1\""

It almost has to be an extra leading space in an un-named executable
entry.

If it is, I'm having trouble finding it!

Dan Rather said if it walks like a duck and quacks like a duck then it
probably is a duck, but then he also said about his career ending Bush
snafu "it could be true so it probably is". There has to be a point
in there somewhere? maybe not

I think the duck test has been determined as requiring a third
condition to be met, just two being inconclusive.

Whether it is a space or not, something is causing that aberrant
entry.

who where wrote in
:

Actually put ON glasses to use the pooter, but in fixed-width font in
Notepad (where I copied/pasted the entries of "interest") spaces are
far easier to spot than in the more normal proprtional fonts, and all
three - exe, com, bat - were identical:

shell\open\command]
@="\"%1\" %*"

the only space being before the second %.

BTW, the regedit entry among that group was @="regedit.exe \"%1\""


Commands take a form like lists of arguments, so when you get the %1 in the
first instance it means run itself, rather than a file passed TO it. And the
%* may mean run itself, and any file passed to it. (I say 'may' because I'm
too tired to test this one before posting, but it seems right enough).

SCR files are another case where you'll likely see a %1 in FIRST place like
an EXE or COM, which is why SCR's have been used to carry malicious payloads.
""%1" /S" is shat I get to run it, without the /S switch it calls up their
inbuilt configs. WHich may also be a limited protection against things
pretending to be SCR's but I remember that many screensavers can be renamed
as *.EXE and will run like one! I don't know if this is a risk or not these
days.. But it's one of the things that registry fishing teaches us about.....

Dan Rather said if it walks like a duck and quacks like a duck then it
probably is a duck, but then he also said about his career ending Bush
snafu "it could be true so it probably is". There has to be a point
in there somewhere? maybe not

I think the duck test has been determined as requiring a third
condition to be met, just two being inconclusive.


Got to duck the issue this time...

who where wrote in
:

The Rundll commands run a DLL like an EXE, getting some internal
function. The Open With entries will rarely if ever take that form.

There were definitely a few like:

[HKEY_LOCAL_MACHINE\Software\CLASSES\InternetShortc ut\shell\open]
"CLSID"="{FBF23B40-E3F0-101B-8488-00AA003E56F8}"

[HKEY_LOCAL_MACHINE\Software\CLASSES\InternetShortc ut\shell\open\command]
@="rundll32.exe shdocvw.dll,OpenURL %l"


CLSID (Class ID's) are beyond me, all I know is they're usually allocated to
avoid conflict for more complex functions. There are tools that can make them
at will. Plugins, shell extensions, and some inbuilt stuff like the main
Explorer window that appears when double-clicking the top left standard
desktop icon, and the control panel, use them. They always obscure more than
they show so I never pretend to understand them. Even Rundll entries are
awkward but it is possible to examine function lists exported from DLL's so
it's a bit less mystifying than the CLSID thing, at least to me.

You didn't think anything odd/coincidental that the one opening
Explorer/root happened to mimic the action of the subject entry?


Nope. That window on root is a standard fallback, so many things might
invoke it. Just double clicking the top left desktop icon too quickly and
often right after booting can be enough to trigger one.

Lee's post mentions that a preceding space can cause what you saw in the
'Open With' dialog. Sometimes it can be hard to spot these things,
harder still to prevent them, but as you're ok with this kind of effort,
take a look at a couple of posts I made last night, for a template for
file associations.

Which posts? Where should I be looking?


905848 and 905850, timed 21st Nov at 01:10 and 01:28 (but times might not
mean much).

Lostgallifreyan wrote in
:

shat

'what'.
Shat is what my brain did, as it does at this time of night.

On Mon, 21 Nov 2011 22:38:42 -0600, Lostgallifreyan
wrote:

who where wrote in
:

Which posts? Where should I be looking?


905848 and 905850, timed 21st Nov at 01:10 and 01:28 (but times might not
mean much).

Suspecting those are giganews numbers and you are referring to posts
in this ng(?), they must be in a thread I have marked as
do-not-follow.

N/g and thread title?

On Nov 21, 10:12*pm, who where wrote:
On Mon, 21 Nov 2011 22:38:42 -0600, Lostgallifreyan

wrote:
who where wrote in
:
Which posts? *Where should I be looking?

905848 and 905850, timed 21st Nov at 01:10 and 01:28 (but times might not
mean much).

Suspecting those are giganews numbers and you are referring to posts
in this ng(?), they must be in a thread I have marked as
do-not-follow.

N/g and thread title?

http://groups.google.com/group/micro...0f25f68ceddcd6

I think mainly just that one as you've been conversing within my other
posts so you can see at least the ones where I reply to you - in that
first one I replied to Lostgallifreyan so maybe you didn't even see it?

Lee wrote in
:

On Nov 21, 10:12*pm, who where wrote:
On Mon, 21 Nov 2011 22:38:42 -0600, Lostgallifreyan

wrote:
who where wrote in
:
Which posts? *Where should I be looking?

905848 and 905850, timed 21st Nov at 01:10 and 01:28 (but times might
no
t
mean much).

Suspecting those are giganews numbers and you are referring to posts
in this ng(?), they must be in a thread I have marked as
do-not-follow.

N/g and thread title?

http://groups.google.com/group/micro...iscussion/msg/
f30f25f68ceddcd6

I think mainly just that one as you've been conversing within my other
posts so you can see at least the ones where I reply to you - in that
first one I replied to Lostgallifreyan so maybe you didn't even see it?

Different thread. (And same group as this one).
1. how to get rid of "suspend" 2. a GREAT utility (no, not for IE)

Last two posts of mine there... (The times I gave may help too).
The numbers I gave were Easynews based maybe, but I assumed that they'd be
unique based on other details and be the same on other servers, but I guess
not.

On 11/21/2011 23:24, Lostgallifreyan wrote:
who wrote in
:

Actually put ON glasses to use the pooter, but in fixed-width font in
Notepad (where I copied/pasted the entries of "interest") spaces are
far easier to spot than in the more normal proprtional fonts, and all
three - exe, com, bat - were identical:

shell\open\command]
@="\"%1\" %*"

the only space being before the second %.

BTW, the regedit entry among that group was @="regedit.exe \"%1\""


Commands take a form like lists of arguments, so when you get the %1 in the
first instance it means run itself, rather than a file passed TO it. And the
%* may mean run itself, and any file passed to it. (I say 'may' because I'm
too tired to test this one before posting, but it seems right enough).

I know what you're saying, but technically the %1 *is* the passed
filename. It's just that in this case the passed filename is the
executable being passed from the explorer shell to the process that
loads the executable.

For example, if you click on notepad.exe, then the string "notepad.exe"
is passed where
%1 = notepad.exe

If you click on foo.txt where the registry reads "notepad.exe %1" (for
class of .txt) then
%1 = foo.txt

%1 is the filename/object passed.
%* is additional arguments (which could be filenames)

Bill Blanton wrote in
g.com:

Commands take a form like lists of arguments, so when you get the %1 in
the first instance it means run itself, rather than a file passed TO
it. And the %* may mean run itself, and any file passed to it. (I say
'may' because I'm too tired to test this one before posting, but it
seems right enough).

I know what you're saying, but technically the %1 *is* the passed
filename. It's just that in this case the passed filename is the
executable being passed from the explorer shell to the process that
loads the executable.

For example, if you click on notepad.exe, then the string "notepad.exe"
is passed where
%1 = notepad.exe

If you click on foo.txt where the registry reads "notepad.exe %1" (for
class of .txt) then
%1 = foo.txt

%1 is the filename/object passed.
%* is additional arguments (which could be filenames)


True. A file can't literally run itself... I ended up with the relative
concept instead of the absolute one because I found it easier when handling
Lua where the script is a data file seen by Lua or wxLua, but an executable
as seen from the perspective of files passed to the script. It's not fully
correct but it can be easier to relate it to the level I'm working on
directly.