16

A few years ago I saw somebody play a prank on somebody by associating the .exe file extension with Internet Explorer. This made Internet Explorer open up every time the person wanted to start a program.

Unfortunately, I forgot how this was done. I tried to use the Default Programs > Set Associations Control Panel tool, but it didn't list .exe.

How could one set this file association, and, perhaps more importantly, how could one unset it?

Improve this question
1
  • it's on a batch virus google search
    – RobotHumans
    Nov 7, 2011 at 14:08

2 Answers 2

Reset to default
20

When doing "pranks" like that, it is not enough to just follow a step-by-step tutorial or a batch script; it's best to know something about how the actual data is stored – it becomes easier to recover later.

All file associations are kept in Registry, which can be edited using regedit or reg. The shell looks for them under HKEY_CLASSES_ROOT, which is a merged view of HKEY_LOCAL_MACHINE\Software\Classes (system-wide) and HKEY_CURRENT_USER\Software\Classes (user-local).

  • [ HKEY_CLASS_ROOT ]
    • [ .txt ]
      • (default) = " txtfile " – pointer to another key under HKCR
    • [ txtfile ]
      • (default) = " Text Document " – textual description as displayed in Explorer
      • [ shell ] – the actions to use for double-click and context-menu
        • (default) = (not set) – the action to use on double-click; defaults to "open"
        • [ open ]
          • (default) = (not set) – label displayed in context menu; defaults to "Open"
          • [ command ]
            • (default) = " %SystemRoot%\system32\NOTEPAD.EXE %1 "

For most extensions, the HKCR\.extn\(Default) value points to a file type key under the same HKCR; for example, .exe points to HKCR\exefile.

(In rare cases, though, all information is under the extension's key directly, with HKCR\.extn\(Default) containing the description. These seem to be very rare, though – maybe a leftover of Windows 9x or 3.x...)

Make backups. reg save HKLM\Software\Classes hklm-classes.hiv Also, remember that the Command Prompt does not care about extensions; if you try to run an executable program, it will always run no matter how it is named, or what its extension is associated with.

Improve this answer
5
  • 1
    Obviously export the registry before doing any changes like this! :)
    – HaydnWVN
    Nov 7, 2011 at 14:34
  • @HaydnWVN: reg save takes care of that (and also includes metadata, which reg export would skip).
    – user1686
    Nov 7, 2011 at 14:35
  • Ah sorry, replied before your Make backups edit was posted! ;)
    – HaydnWVN
    Nov 7, 2011 at 14:36
  • 1
    Don't forget that viewing the raw registry is somewhat the hard way of doing things here. Microsoft's bundled command interpreter has FTYPE and ASSOC commands, and the file type list is also accessible via dialogue boxes in Windows Explorer directly.
    – JdeBP
    Nov 7, 2011 at 14:38
  • @JdeBP: AFAIK, Windows Vista got rid of the editor in Explorer - now it just selects the default action. (I haven't dug deeper, though; still using XP here.) Also, the graphical regedit gives a nice overview.
    – user1686
    Nov 7, 2011 at 14:41
2

Try this:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.