Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I rewrote the Question to add everything that i tried so far.

  • Many of my applications are being opened by Internet Explorer. (not all)
  • For example when I run Firefox.exe (from shortcut) I get IE run instead, with the following URL

    http: // %22d/ Browser/firefox.exe%22 (I added spaces to prevent link creation)

    1. the shortcut target is: "D:\Browser\firefox.exe"

    2. when I attempted to open firefox.exe from it's folder the results were the same as the previous one

    3. I attempted to open it by cmd, so i navigated with cmd to the FF path then wrote: firefox.exe

    4. the was the same except that the URL was:

      http: // Firefox.exe/

    5. when i jsut write firefox the result URL was:

    http: // Firefox/ (is it some kind of parameter or something??)

    1. trying the same with chrome resulted the same results as the previous tests.

    2. I tried creating a new user (adminstartor) but the problem still there.

    3. I tried every registry key with exe on it (not sure if i tried them all) no change

    4. I tried removing IE but came back by itself somehow, meanwhile IE is removed, FF and its fellow apps gave me open with window

    5. I tried reinstalling the applications but it just no use.

Time Line: (as requested from @Daredev)

  1. I don't know when it happened because the computer is for the company i work for and it was like that since i got it. (The IT there gave up on the problem lon time ago!).

  2. applications were installed already are "firefox" and "XPS viewer" .

  3. applications were working after the problem everything except what uses browsing (MS help viewer, XPS viewer, firefox-even I've re installed it-, opera, chrome)

  4. that what I thought but after installing Maxthon , comodoDragon this theory was blown away.

system info:
1- windows xp professional service pack 3
2- system fully patched: Yes
3- anti-virus up to date: Yes
4- same behavior when booting into safe mode: Yes

share|improve this question
1  
It might help if you provided additional information. XP version number and service pack? Do you keep your system fully patched? Do you have up to date anti-virus and have you run anti-virus and malware scans? What are some of the other applications that are opened in IE? Do you get the same behavior when booting into safe mode? –  CHarmon Sep 25 '12 at 12:45
    
Many of your apps (EXEs) are being opened by IE, but not all? –  Karan Sep 26 '12 at 2:14
    
@Karan yes not all –  Star Sep 26 '12 at 7:22
    
You should enter in the cmd : cd "C:\Program Files\Mozilla Firefox\" and then firefox.exe. Let us know what happens. –  harrymc Oct 10 '12 at 13:25
    
When you open Firefox, are you using the shortcut icon on your desktop? What happens if you go directly to C:\Program Files\Mozilla Firefox\ and click on the firefox.exe icon there? –  slafat01 Oct 10 '12 at 13:30

3 Answers 3

up vote 4 down vote accepted
+100

Armed with addtional information you've given me via chat:
Unfortunately it does seem that your PC may get somehow infected with malware. As an example, This thread does look very similar to your problems

Malware or not, root cause of your problems probably lay in this little known registry gem - originally thought to allow easy debbuging: (source)

To setup an application to launch the debugger automatically

Start the Registry Editor (regedit).
In the Registry Editor, open the HKEY_LOCAL_MACHINE folder.
Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\currentversion\image file execution options.
Under the Image File Execution Options folder, locate the name of the application you want to debug (myapp.exe, for example). If you cannot find the application you want to debug:
    Right-click the Image File Execution Options folder and choose New Key from the shortcut menu.
    Right-click the new key and choose Rename from the shortcut menu.
    Edit the key name to the name of your application, for example, myapp.exe.
Right-click the myapp.exe folder and choose New String Value from the shortcut menu.
Right-click the new string value and choose Rename from the shortcut menu.
Change the name to debugger.
Right-click the new string value and choose Modify from the shortcut menu.

The Edit String dialog box appears.
In the Value data box, type devenv /debugexe.
Click OK.
From the Registry menu, choose Exit. 

Problem being you could (and malware does) put any executable as debugger, effectively running program of your choice instead of original target.
I was able to replicate your PC behavior adding Firefox.exe key with a debugger target of Iexplore.exe
To check if that's what affect you, open registry editor, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\currentversion\image file execution options and look for Firefox.exe and similar entries for programs exhibiting this behavior. Rename any suspicious keys to something else (eg. Firefox.exe bad) and re-run the app.

Last but not least - analyze those keys - maybe it will give you a hint of what was the source - and run a thorough scan of your system with a different tool than the one you have installed (if possible - with windows offline)

Edit: Sysinternals Autoruns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx) comes in handy in checking image hijacks (among many other nice features). Download the tool, run it and unselect Hide Windows Entries in Filter options, then select Image Hijacks:

Autoruns screen

You may then either simply delete the entry or analyze it further using several options.
There is also a command line version, autorunsc. autorunsc -h prints image hijacks. Use autorunsc -? to see all options.

share|improve this answer
1  
Wow, i guess this should do it. but unfortunately I won't be able to check it before 36 hours (I'm on a vacation), so I will catch up with you later. –  Star Oct 11 '12 at 19:18
    
@star Nah, luckily you won't be able to! Have a good time! –  wmz Oct 11 '12 at 20:01
1  
That was awsome, I don't how did you figure it out, but really thank you. everything was just as you described. if i could give you another 500 bounty I would. A final Question: I found so many keys there how to know if thy are valid key or not? –  Star Oct 13 '12 at 8:17
1  
@WMZ: A great answer buddy!!! Hats off!!! :) Star: You see... indeed it was a registry gem (or bug... :) which was ailing you. And kudos to me, the chatroom I started was worth it... :P –  Viral Jain Oct 15 '12 at 5:47
2  
@Daredev iexplore.exe is not in the path you need to put full path most likey c:\program files\internet explorer and also add protocol (or just //) so full value would be similar to (path)\iexplore.exe http://. You can also just put notepad.exe or write.exe as I did in the screenshot if you want to try it –  wmz Oct 15 '12 at 9:37

New answer: Try this: http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip

or otherwise:

  1. Open Registry Editor, then navigate to the following key: HKEY_CLASSES_ROOT\exefile\shell\open\command
  2. Double-click the (Default) value in the right pane.
  3. Delete the current value data, and then type: "%1" %* (ie., quote-percent-one-quote-space-percent-asterisk.)
  4. Navigate to: HKEY_CLASSES_ROOT.exe
  5. In the right-pane, set Data of (default) to exefile

Exit the Registry Editor.

Hopefully, this solution helps.

Source: http://windowsxp.mvps.org/exefile.htm

PS: It dangerous to simulate this problem, so please keep trying & don't give up... :)

share|improve this answer
1  
since i didn't find the keys your talking about, i searched for them in "HKEY_LOCAL_MACHIN" and deleted them. and now no exe is opening. :D :D :D :D –  Star Oct 11 '12 at 9:29
    
OK, Now I fixed what I damaged. but now I'm certain that is the problem is not related to user setting neither file association. –  Star Oct 11 '12 at 9:37
    
I've updated the Question –  Star Oct 11 '12 at 10:03
    
@Star: Hey, there has to be a solution, so don't just reinstall windows. & thanks for taking it sportingly because even I didn't find the above keys, but then I thought that it might be the case that they'll exist in your system. Nevertheless, I'm searching another method, just don't stop here... :) –  Viral Jain Oct 11 '12 at 10:16
1  
@Star - If the problem is fixed be sure to accept the answer. –  Ramhound Oct 11 '12 at 10:57

Have you tried resetting your IE settings?

  1. Create another user (admin)
  2. Switch to the newly-created user
  3. Run regedit
  4. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  5. Right-click -> export to a public folder or root dir
  6. Switch back to your original account
  7. Remove the the above key
  8. Run the exported .reg for the Internet Settings key.
share|improve this answer
    
I tried creating another user, but it's the same in the other user too. the same apps are opened in IE. –  Star Oct 10 '12 at 13:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.