Laptops

Question

Locked

Unable to show EXE file extension

By thong_cheekang ·
Dear all,

My laptop is installed with win xp and I have a strange problem: I wanted to rename an executable (.EXE) file into another file extension, but I can't get it done!

I understand the usual thing to do is to first go to Windows Explorer, click on menu entry "Folder Option". Then, under "View", we are to unclick "Hide extension for known filetypes", so as to reveal the extension for renaming.

However, for my case, some other types of file extensions appeared but not .EXE!

I understand the next step is to go to the tab "File types" and try to modify the file type behaviour from there. However, the file type ".EXE" is not even there for modification!

Does anyone has any idea why my laptop is behaving like this and any solution?

Thanks and Best Regards
TCK

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

OK, Wasn't sure.

by seanferd In reply to cmd prompt test

Some folks have had the issue that when they uncheck "Hide Known...", it doesn't stay unchecked.

What I'm still not understanding, though, is why can you not rename the file anyway, regardless as to whether or not it is showing an extension. What happens when you try to add .exe to a known executable file?

Would you care to post some relevant reg entries? Just export the entry, then paste the text from the file for
HKEY_CLASSES_ROOT\.exe
HKEY_CLASSES_ROOT\exefile

You could also navigate to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and ensure that
HideFileExt is set to 0

Reaching a bit:
In the above key, create a new DWORD value, name it ShowSuperHidden, and set the value to 1. Log off and back on or reboot, and see if the EXE extension shows up.

Collapse -

Something strange at HKEY_CURRENT_USER

by thong_cheekang In reply to OK, Wasn't sure.

Hi seanferd,

Please find below my registry export from
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

--------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ServerAdminUI"=dword:00000000
"Hidden"=dword:00000001
"ShowCompColor"=dword:00000001
"HideFileExt"=dword:00000001
"DontPrettyPath"=dword:00000000
"ShowInfoTip"=dword:00000001
"HideIcons"=dword:00000000
"MapNetDrvBtn"=dword:00000000
"WebView"=dword:00000001
"Filter"=dword:00000000
"SuperHidden"=dword:00000000
"SeparateProcess"=dword:00000000
"ListviewAlphaSelect"=dword:00000001
"ListviewShadow"=dword:00000001
"ListviewWatermark"=dword:00000001
"TaskbarAnimations"=dword:00000001
"StartMenuInit"=dword:00000002
"StartButtonBalloonTip"=dword:00000002
"TaskbarSizeMove"=dword:00000000
"NoNetCrawling"=dword:00000000
"FolderContentsInfoTip"=dword:00000001
"FriendlyTree"=dword:00000001
"WebViewBarricade"=dword:00000001
"DisableThumbnailCache"=dword:00000000
"HideFileExt "=dword:00000000
"ShowSuperHidden "=dword:00000001
"ClassicViewState"=dword:00000001
"PersistBrowsers"=dword:00000000
"Start_LargeMFUIcons"=dword:00000001
"Start_MinMFU"=dword:00000006
"Start_ShowRecentDocs"=dword:00000002
"Start_AutoCascade"=dword:00000001
"Start_NotifyNewApps"=dword:00000001
"TaskbarGlomming"=dword:00000001
"60582121"="60582121"
"Start_ShowNetPlaces_ShouldShow"=dword:00000041
"Start_ShowNetConn_ShouldShow"=dword:00000042

------------------------------------------
There seemed to be 2 rows of "HideFileExt"

"HideFileExt"=dword:00000001
"HideFileExt"=dword:00000000

Is this the source of my problem? So I just delete the row with value 00000001?

Also your requests, please find HKEY_CLASSES_ROOT\.exe

-------------------------------------
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

-------------------------------------


HKEY_CLASSES_ROOT\exefile
-------------------------------------
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies]

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\command]
@="C:\\PROGRA~1\\MICROS~3\\COMMON\\Tools\\DEPENDS.EXE /dde"

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\ddeexec]
@="[open(\"%1\")]"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}]
@=""

-------------------------------------

Thanks and Best Regards
Thong CK

Collapse -

Oh, yes. Delete "HideFileExt"=dword:00000001

by seanferd In reply to Something strange at HKEY ...

Hopefully, that will do it.
You can run a search from the registry root (My Computer) for HideFileExt and make sure there aren't any duplicates in other keys, and that they are all set to 0.

Why it is only hiding EXE extensions, I cannot say.

Everything else looks OK to me.

Oh, and have you tried manually adding the EXE extension to a to a file by renaming in Explorer? I was curious to know if there was actually anything stopping you from doing it. (Although, if you looked at it in a cmd window, it might have a double exe extension, according to what you've seen previously.)

Collapse -

Ignore

by Jacky Howe In reply to Oh, yes. Delete "HideFile ...

not enough wheeties.

the "HideFileExt"=dword:00000000 turns it on and you will see the extension.
"HideFileExt"=dword:00000001 turns it off and you won't see the extension.

Collapse -

It worked!

by thong_cheekang In reply to Oh, yes. Delete "HideFile ...

Hi seanferd,

After I delete the extra entry, the problem still remained. So I did a search in registry for all "HideFileExt" and I found following key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt]
"Type"="checkbox"
"Text"="@shell32.dll,-30503"
"HKeyRoot"=dword:80000001
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"ValueName"="HideFileExt "
"CheckedValue"=dword:00000001
"UncheckedValue"=dword:00000000
"DefaultValue"=dword:00000001
"HelpID"="shell.hlp#51101"

Only after I set the entry "DefaultValue" from 1 to 0, then the problem go away.

Regarding your query, NO the PC did not stop me from adding extra .exe, but the file becomes "filename.exe.exe", and it will still hide the 2nd .exe extension, so it displays "filename.exe".

However, exposing a .exe this way is not helpful, because if I want to change the file type, renaming the file "filename.eee.exe" still will not change the file type.

Last but not least, I want to say a BIG thank you to you and Jacky Howe and all the others that have chipped in and help. Your kindness and patience are most admirable!

Thanks and Best Regards
Thong CK

Collapse -

Fantastic!

by seanferd In reply to It worked!

I'm glad we all were able to narrow it down.

"filename.exe.exe" is what I expected it to do, I was just wondering isf something was actively preventing you from renaming. Glad that was not the case.

Also - Windows takes for the extension the characters <i>after</i> the last dot. Malware can make use of this to hide the real extension, as well as using the CLSID instead of an extension.

You are quite welcome to our help any time.

Kind regards,

Sean

Collapse -

Glad to see that you

by Jacky Howe In reply to It worked!

have sorted it out. Sean hit the nail on the head with HideFileExt. Check your USB drives as it may be related to W32/SillyFDC-CG. It is a worm for the Windows platform that spreads via removable drives and does almost the same thing.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
CheckedValue
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
DefaultValue
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Text
Lo dugem terus

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Type
(null)

<i>Keep us informed as to your progress if you require further assistance.</i>
<HR>
<i>If you think that any of the posts that have been made by all TechRepublic Members, have solved or contributed to solving the problem, please Mark them as <b>Helpful</b> so that others may benefit from the outcome. </i> :-bd

Collapse -

That's an evil worm

by seanferd In reply to It worked!
Collapse -

A couple of checks

by Jacky Howe In reply to Unable to show EXE file e ...

Open up a Command Prompt
navigate to C> by pressing cd\ and pressing Enter.

Do a dir and check for an autorun.inf or any strange .bat .cmd files. If you do find them try this for us by substituting the actual names matching the file extension.

Type this in, including the TYPE command.

type C:\autorun.inf > C:\check.txt

type C:\batchname.bat >> C:\check.txt

type C:\cmdname.cmd >> C:\check.txt


Copy and paste this into the run box and press Enter.

cmd /k reg query hkcr\exefile\shell /s > C:\exe.txt

It should resemble this structure below.

! REG.EXE VERSION 3.0

HKEY_CLASSES_ROOT\exefile\shell

HKEY_CLASSES_ROOT\exefile\shell\open
EditFlags REG_BINARY 00000000

HKEY_CLASSES_ROOT\exefile\shell\open\command
<NO NAME> REG_SZ "%1" %*

HKEY_CLASSES_ROOT\exefile\shell\runas

HKEY_CLASSES_ROOT\exefile\shell\runas\command
<NO NAME> REG_SZ "%1" %*


Post the contents of both files for us please.

Also run this Rootkit Revealer GMer
<a href="http://www.gmer.net/index.php" target="_blank"><u>Gmer</u></a>
FAQ
<a href="http://www.gmer.net/faq.php" target="_blank"><u>FAQ</u></a>

Collapse -

Almost forgot

by Jacky Howe In reply to A couple of checks

You could also try logging in with another User Account to see if it is a profile problem.

Related Discussions

Related Forums