Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A few years ago I saw somebody play a prank on somebody by associating the .exe file extension with Internet Explorer. This made Internet Explorer open up every time the person wanted to start a program.

Unfortunately, I forgot how this was done. I tried to use the Default Programs > Set Associations Control Panel tool, but it didn't list .exe.

How could one set this file association, and, perhaps more importantly, how could one unset it?

share|improve this question
    
it's on a batch virus google search –  hbdgaf Nov 7 '11 at 14:08
add comment

2 Answers

up vote 15 down vote accepted

When doing "pranks" like that, it is not enough to just follow a step-by-step tutorial or a batch script; it's best to know something about how the actual data is stored – it becomes easier to recover later.

All file associations are kept in Registry, which can be edited using regedit or reg. The shell looks for them under HKEY_CLASSES_ROOT, which is a merged view of HKEY_LOCAL_MACHINE\Software\Classes (system-wide) and HKEY_CURRENT_USER\Software\Classes (user-local).

  • [ HKEY_CLASS_ROOT ]
    • [ .txt ]
      • (default) = " txtfile " – pointer to another key under HKCR
    • [ txtfile ]
      • (default) = " Text Document " – textual description as displayed in Explorer
      • [ shell ] – the actions to use for double-click and context-menu
        • (default) = (not set) – the action to use on double-click; defaults to "open"
        • [ open ]
          • (default) = (not set) – label displayed in context menu; defaults to "Open"
          • [ command ]
            • (default) = " %SystemRoot%\system32\NOTEPAD.EXE %1 "

For most extensions, the HKCR\.extn\(Default) value points to a file type key under the same HKCR; for example, .exe points to HKCR\exefile.

(In rare cases, though, all information is under the extension's key directly, with HKCR\.extn\(Default) containing the description. These seem to be very rare, though – maybe a leftover of Windows 9x or 3.x...)

Make backups. reg save HKLM\Software\Classes hklm-classes.hiv Also, remember that the Command Prompt does not care about extensions; if you try to run an executable program, it will always run no matter how it is named, or what its extension is associated with.

share|improve this answer
1  
Obviously export the registry before doing any changes like this! :) –  HaydnWVN Nov 7 '11 at 14:34
    
@HaydnWVN: reg save takes care of that (and also includes metadata, which reg export would skip). –  grawity Nov 7 '11 at 14:35
    
Ah sorry, replied before your Make backups edit was posted! ;) –  HaydnWVN Nov 7 '11 at 14:36
1  
Don't forget that viewing the raw registry is somewhat the hard way of doing things here. Microsoft's bundled command interpreter has FTYPE and ASSOC commands, and the file type list is also accessible via dialogue boxes in Windows Explorer directly. –  JdeBP Nov 7 '11 at 14:38
    
@JdeBP: AFAIK, Windows Vista got rid of the editor in Explorer - now it just selects the default action. (I haven't dug deeper, though; still using XP here.) Also, the graphical regedit gives a nice overview. –  grawity Nov 7 '11 at 14:41
add comment

Try this:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.