Guest PCR Posted October 14, 2008 Posted October 14, 2008 Re: Tweakui setting question MEB wrote: | "Franc Zabkar" <fzabkar@iinternode.on.net> wrote in message | news:h2f5f49mimr6d19m5610btq46v3tfvjfgu@4ax.com... || On Sun, 12 Oct 2008 18:35:32 -0400, "PCR" <pcrrcp@netzero.net> put || finger to keyboard and composed: || || >---- Original Message ---- || >From: "Franc Zabkar" <fzabkar@iinternode.on.net> || >Newsgroups: microsoft.public.win98.gen_discussion || >Sent: Saturday, October 11, 2008 09:41 PM || >Subject: Re: Tweakui setting question || || >| There are several other file types which remain hidden even though || >| "hide file types" is turned off: || >| http://seclists.org/bugtraq/2000/May/0184.html || > || >I had a quick look. The 10 items Rollyson posted look like the same || >10 I've got. I'll have to examine it more closely later. Did you || >undo all 10 "NeverShowExt" & with not a single regret or just the || >various shortcuts? But it doesn't appear to be necessary anymore! || || I went through the registry on my own many years ago and "unhid" all || the file types I could find. So far no problems. In fact an issue || with hidden ShellScrap file types was well publicized quite a few || years ago. That's what prompted me to look for others. Yes, I see what MEB has posted, & I've seen it before. I always did mean to investigate it more fully. More below. But are you sure can un-hide .shs? I've tried by checking "Always show extension" for Scrap Object in Folder Options-- & that failed. It did add...!... HKEY_CLASSES_ROOT\ShellScrap AlwaysShowExt "" ....but, it left... NeverShowExt "" ....there too. Even manually renaming the latter to "X-NeverShowExt" didn't do it, either! The extension won't show up in Explorer! || - Franc Zabkar || -- || Please remove one 'i' from my address when replying by email. | | Yeah, but that shell scrap issue was easily and permanently remedied | by a simple file rename like: | C:\WINDOWS\SYSTEM\SHSCRAP.DLL.org | which is something I've done on every 98 computer I ever worked on | and never had a complaint of something not working. Heck I even | forget that I do it... I haven't fully decided to do that. I HATE killing off capabilities-- even those I rarely if ever use! | I think I found some of the best info *back then* {2000-which still | seems available}: | http://www.pc-help.org/security/scrap.htm Well, when I click the two demos he put in there (under the Browser section), they both open up as text in IExplore, instead of execuring. I guess that means I'm safe enough at sites. Also, when I insert a scrap as an attachment into a post (or read one I've sent to myself), the extension is added to the filename in an Attach box. And, if I try to open it, it says "Opening Text.txt.shs"-- & I get a warning it could be a dangerous file. So, looks like I am good as is. It might have been a problem pre-IE6 SP1, maybe-- but it doesn't seem to be one now! | Microsoft supposedly provided a fix for OutLook email hacks: | http://support.microsoft.com/kb/235309 which caused a number of | problems, and required {as usual} another update, which also didn't | really work. | | OE users were given this: | http://support.microsoft.com/kb/267580/EN-US/ {**take note of the JAVA | caution at the bottom and the general file attachment caution**} | | OE 6 gave the Security Option to disallow saving and opening | attachments [as if]. | | So yeah, I would agree, IF the user is capable of understanding what | they are seeing and what it means (and only then), then unhide ALL | extensions.... just be sure they do know AND don't forget.... | | -- | MEB | http://peoplescounsel.org | a Peoples' counsel | _ _ | ~~ -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, Should things get worse after this, PCR pcrrcp@netzero.net
Guest Franc Zabkar Posted October 15, 2008 Posted October 15, 2008 Re: Tweakui setting question On Tue, 14 Oct 2008 18:20:00 -0400, "PCR" <pcrrcp@netzero.net> put finger to keyboard and composed: >But are you sure can un-hide .shs? I've tried by checking "Always show >extension" for Scrap Object in Folder Options-- & that failed. It did >add...!... > >HKEY_CLASSES_ROOT\ShellScrap >AlwaysShowExt "" > >...but, it left... > >NeverShowExt "" > >...there too. Even manually renaming the latter to "X-NeverShowExt" >didn't do it, either! The extension won't show up in Explorer! I only have AlwaysShowExt, not NeverShowExt. When I create a zero-byte file with an SHS extension, Explorer displays the extension and identifies the file type as "Scrap object". - Franc Zabkar -- Please remove one 'i' from my address when replying by email.
Guest PCR Posted October 15, 2008 Posted October 15, 2008 Re: Tweakui setting question Franc Zabkar wrote: | On Tue, 14 Oct 2008 18:20:00 -0400, "PCR" <pcrrcp@netzero.net> put | finger to keyboard and composed: | |>But are you sure can un-hide .shs? I've tried by checking "Always show |>extension" for Scrap Object in Folder Options-- & that failed. It did |>add...!... |> |>HKEY_CLASSES_ROOT\ShellScrap |>AlwaysShowExt "" |> |>...but, it left... |> |>NeverShowExt "" |> |>...there too. Even manually renaming the latter to "X-NeverShowExt" |>didn't do it, either! The extension won't show up in Explorer! | | I only have AlwaysShowExt, not NeverShowExt. | | When I create a zero-byte file with an SHS extension, Explorer | displays the extension and identifies the file type as "Scrap object". Huh. That doesn't work for me. Anyhow, I doubt I really need it for the reasons I've already said. OK, thanks. | - Franc Zabkar | -- | Please remove one 'i' from my address when replying by email. -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, Should things get worse after this, PCR pcrrcp@netzero.net
Guest ms Posted October 16, 2008 Posted October 16, 2008 Re: Tweakui setting question "MEB" <meb@not here@hotmail.com> wrote in news:u1qmlYNLJHA.4796 @TK2MSFTNGP05.phx.gbl: Thanks for the data. > REGEDIT4 > > [HKEY_CLASSES_ROOT\lnkfile] > @="Shortcut" > "EditFlags"=dword:00000001 > "IsShortcut"="" > "NeverShowExt"="" > > REGEDIT4 > > [HKEY_CLASSES_ROOT\piffile] > @="Shortcut to MS-DOS Program" > "EditFlags"=hex:01,00,00,00 > "IsShortcut"="" > "NeverShowExt"="" > Using RegEdit, here is what I have: HKEY_CLASSES_ROOT\.lnk under it, ShellEx, under it one folder B62E612....... ShellNew, under it Default value not set Command RunDLL32 AppWiz.Cpl,NewLinkHere %2 But nothing that looks like your message. ms > Depending upon the program and its settings, CASE does matter.... > > The change is at: > IsShortcut > > to > > IsNotShortcut >
Guest MEB Posted October 16, 2008 Posted October 16, 2008 Re: Tweakui setting question Is that 98FE/GOLD or SE? IF SE: Are you running a registry protection program perhaps? -- MEB http://peoplescounsel.org a Peoples' counsel _ _ ~~ "ms" <ms@invalid.com> wrote in message news:6lnehlFd76u8U1@mid.individual.net... | "MEB" <meb@not here@hotmail.com> wrote in news:u1qmlYNLJHA.4796 | @TK2MSFTNGP05.phx.gbl: | | Thanks for the data. | | | > REGEDIT4 | > | > [HKEY_CLASSES_ROOT\lnkfile] | > @="Shortcut" | > "EditFlags"=dword:00000001 | > "IsShortcut"="" | > "NeverShowExt"="" | > | > REGEDIT4 | > | > [HKEY_CLASSES_ROOT\piffile] | > @="Shortcut to MS-DOS Program" | > "EditFlags"=hex:01,00,00,00 | > "IsShortcut"="" | > "NeverShowExt"="" | > | | Using RegEdit, here is what I have: | | HKEY_CLASSES_ROOT\.lnk | | under it, | ShellEx, under it one folder B62E612....... | | ShellNew, under it | Default value not set | | Command RunDLL32 AppWiz.Cpl,NewLinkHere %2 | | But nothing that looks like your message. | | ms | | > Depending upon the program and its settings, CASE does matter.... | > | > The change is at: | > IsShortcut | > | > to | > | > IsNotShortcut | > |
Guest ms Posted October 16, 2008 Posted October 16, 2008 Re: Tweakui setting question "MEB" <meb@not here@hotmail.com> wrote in news:eDbHaVzLJHA.5060 @TK2MSFTNGP02.phx.gbl: > Is that 98FE/GOLD or SE? > > IF SE: Are you running a registry protection program perhaps? > SE, no registry protection programs BTW, what MS patch effected the shortcut settings? If I knew it, I could search about it, maybe uninstall it and Tweakui would work normally. ms
Guest Franc Zabkar Posted October 16, 2008 Posted October 16, 2008 Re: Tweakui setting question On Tue, 14 Oct 2008 15:56:26 -0400, "MEB" <meb@not here@hotmail.com> put finger to keyboard and composed: >Yeah, as usual, its a toss-up. Its whatever serves your usage style that >matters. > > Franc, you being who you are, might want to try the resource hack....lots >of information on and some nice tools for image and other resource hacking >on the Net... don't forget to backup what your working on [and the registry] >BEFORE you start playing around... I'd already looked into it but decided it was too much effort, and possibly beyond me. The icon editing/extraction software I had found didn't seem to be able to patch icons into existing executables. Anyway, I finally patched shell32.dll (version 4.72.3812.600) by hand. The arrows can be eliminated by replacing the 128 byte block of data at offset 0xFB5E0 with a block of 0xFF bytes. I came to this conclusion by extracting the arrow icon from shell32.dll and comparing it with the blank icon from tweakui.cpl. This Wikipedia article also helped: http://en.wikipedia.org/wiki/.ico This is the hacked file: http://www.users.on.net/~fzabkar/shell32.zip (488KB) I'll remove it in a few days. - Franc Zabkar -- Please remove one 'i' from my address when replying by email.
Guest PCR Posted October 16, 2008 Posted October 16, 2008 Re: Tweakui setting question Franc Zabkar wrote: | On Tue, 14 Oct 2008 15:56:26 -0400, "MEB" <meb@not here@hotmail.com> | put finger to keyboard and composed: | |>Yeah, as usual, its a toss-up. Its whatever serves your usage style |>that matters. |> |> Franc, you being who you are, might want to try the resource |>hack....lots of information on and some nice tools for image and |>other resource hacking on the Net... don't forget to backup what your |>working on [and the registry] BEFORE you start playing around... | | I'd already looked into it but decided it was too much effort, and | possibly beyond me. The icon editing/extraction software I had found | didn't seem to be able to patch icons into existing executables. | | Anyway, I finally patched shell32.dll (version 4.72.3812.600) by hand. | The arrows can be eliminated by replacing the 128 byte block of data | at offset 0xFB5E0 with a block of 0xFF bytes. | | I came to this conclusion by extracting the arrow icon from | shell32.dll and comparing it with the blank icon from tweakui.cpl. | | This Wikipedia article also helped: | http://en.wikipedia.org/wiki/.ico | | This is the hacked file: | http://www.users.on.net/~fzabkar/shell32.zip (488KB) | | I'll remove it in a few days. Remove it now! No one should kill his shortcut arrows! | - Franc Zabkar | -- | Please remove one 'i' from my address when replying by email. -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, Should things get worse after this, PCR pcrrcp@netzero.net
Guest Lee Posted October 17, 2008 Posted October 17, 2008 Re: Tweakui setting question On Oct 12, 3:29 pm, ms <m...@invalid.com> wrote: > "MEB" <meb@not h...@hotmail.com> wrote in news:uobcye#KJHA.4772 > @TK2MSFTNGP03.phx.gbl: > > > Uhm, perhaps I should also supply a safer way noted here: > >http://www.mdgx.com/newtip11.htm > > DITCH THOSE ARROWS! > > From that link: > --- > 2. SAFER : > "To safely hack the Registry to permanently remove those funky little > shortcut arrows, without adversely affecting your program shortcuts in > any way, start Regedit and go to: > HKEY_CLASSES_ROOT\Lnkfile > and to: HKEY_CLASSES_ROOT\Piffile > > In each of these folders the right hand pane has the "IsShortcut" String > Value. > Right-click on it, select Rename, and change it to read "IsNotShortcut" > (no quotes). > Close Regedit and reboot. > The arrows are gone now, but Windows still sees all the affected icons as > shortcuts and treats them accordingly. :)" > --- > > That sounded useful, used RegEditPlus, then RegSeek, finally RegSeeker to > search for HKEY_CLASSES_ROOT\Lnkfile > > That key does not exist in my registry- ???? > > Then I noted some MS patches had been installed, the help data refers to > Q313829, I can't relate the app note number to the number of any of the > patches, planned to uninstall the patch if necessary. > > I searched for Q313829. I don't find a MS appnote with that number, lots > of hits in Google, but can only say that "some" patch back in 2002 did > affect shell.dll, supposed to cure a exploit. I never patched for that in > other W98 machines, never had a problem. > > Advice? > > ms Look again under HKEY_CLASSES_ROOT\lnkfile instead. It should be there. http://download.windowsupdate.com/msdownload/update/v3/static/rtf/en/5285.htm Q313829 is the culprit right enough. But it's more popularly known as "Security Update, March 7, 2002". Used to be one could do: http://support.microsoft.com/?kbid=313829 and get the right information but that now leads one on a wild goose chase to the wrong OS and the wrong update to boot. Even http://www.microsoft.com/technet/security/bulletin/ms02-014.mspx goes to the wrong update but with the right OS at least. Best stick with the Windows Update Catalog in these latter days of any support for 9x boxes and take note that this is really the only update that is known more for it's alternate title than it's Q (or KB) number - thank goodness. http://v4.windowsupdate.microsoft.com/catalog/en/default.asp But this patch doesn't have a go back method to it so unless you do it manually, it can't be done. Shell32.dll is the only file added to the system in this update so it's certainly simple if done in DOS mode, but Windows will object as it's always in use. A third method to hide shortcut arrows does exist and works well and that is to hide the process dll from Windows so that it can't display the arrow. Normally the Class CLSID\{63B51F81- C868-11D0-999C-00C04FD655E1} has an InProcServer32 pointing to the shell32.dll file. But if one removes that text from the registry, the arrows do not get shown - simple. No side effects in the past 5 years that I've been running this one either. [HKEY_CLASSES_ROOT\CLSID\{63B51F81- C868-11D0-999C-00C04FD655E1}\InProcServer32] @="C:\\WINDOWS\\SYSTEM\\SHELL32.DLL" "ThreadingModel"="Both" Just remove the "C:\\WINDOWS\\SYSTEM\\SHELL32.DLL" text and you'll have no arrows. Put it back and you do. dunno why no one wants to remember this one...
Guest ms Posted October 17, 2008 Posted October 17, 2008 Re: Tweakui setting question Lee <melee5@my-deja.com> wrote in news:e0bc16b1-4211-467c-bcb4-3227009b4c82@64g2000hsu.googlegroups.com: > On Oct 12, 3:29 pm, ms <m...@invalid.com> wrote: >> "MEB" <meb@not h...@hotmail.com> wrote in news:uobcye#KJHA.4772 >> @TK2MSFTNGP03.phx.gbl: >> >> > Uhm, perhaps I should also supply a safer way noted here: >> >http://www.mdgx.com/newtip11.htm >> > DITCH THOSE ARROWS! >> >> From that link: >> --- >> 2. SAFER : >> "To safely hack the Registry to permanently remove those funky little >> shortcut arrows, without adversely affecting your program shortcuts >> in any way, start Regedit and go to: >> HKEY_CLASSES_ROOT\Lnkfile >> and to: HKEY_CLASSES_ROOT\Piffile >> >> In each of these folders the right hand pane has the "IsShortcut" >> String Value. >> Right-click on it, select Rename, and change it to read >> "IsNotShortcut" (no quotes). >> Close Regedit and reboot. >> The arrows are gone now, but Windows still sees all the affected >> icons as shortcuts and treats them accordingly. :)" >> --- >> >> That sounded useful, used RegEditPlus, then RegSeek, finally >> RegSeeker to search for HKEY_CLASSES_ROOT\Lnkfile >> >> That key does not exist in my registry- ???? >> >> Then I noted some MS patches had been installed, the help data refers >> to Q313829, I can't relate the app note number to the number of any >> of the patches, planned to uninstall the patch if necessary. >> >> I searched for Q313829. I don't find a MS appnote with that number, >> lots of hits in Google, but can only say that "some" patch back in >> 2002 did affect shell.dll, supposed to cure a exploit. I never >> patched for that in other W98 machines, never had a problem. >> >> Advice? >> >> ms > > Look again under HKEY_CLASSES_ROOT\lnkfile instead. It should be > there. > > http://download.windowsupdate.com/msdownload/update/v3/static/rtf/en/52 > 85.htm Q313829 is the culprit right enough. But it's more popularly > known as "Security Update, March 7, 2002". Used to be one could do: > http://support.microsoft.com/?kbid=313829 > and get the right information but that now leads one on a wild goose > chase to the wrong OS and the wrong update to boot. > > Even > http://www.microsoft.com/technet/security/bulletin/ms02-014.mspx > goes to the wrong update but with the right OS at least. > > Best stick with the Windows Update Catalog in these latter days of any > support for 9x boxes and take note that this is really the only update > that is known more for it's alternate title than it's Q (or KB) number > - thank goodness. > http://v4.windowsupdate.microsoft.com/catalog/en/default.asp > > But this patch doesn't have a go back method to it so unless you do it > manually, it can't be done. Shell32.dll is the only file added to the > system in this update so it's certainly simple if done in DOS mode, > but Windows will object as it's always in use. > > A third method to hide shortcut arrows does exist and works well and > that is to hide the process dll from Windows so that it can't display > the arrow. Normally the Class CLSID\{63B51F81- > C868-11D0-999C-00C04FD655E1} has an InProcServer32 pointing to the > shell32.dll file. But if one removes that text from the registry, the > arrows do not get shown - simple. No side effects in the past 5 years > that I've been running this one either. > > [HKEY_CLASSES_ROOT\CLSID\{63B51F81- > C868-11D0-999C-00C04FD655E1}\InProcServer32] > @="C:\\WINDOWS\\SYSTEM\\SHELL32.DLL" > "ThreadingModel"="Both" > > Just remove the > "C:\\WINDOWS\\SYSTEM\\SHELL32.DLL" > text and you'll have no arrows. Put it back and you do. > > dunno why no one wants to remember this one... > Thanks, Lee This is a backup computer for me, so I will save your data for later. ms
Guest Franc Zabkar Posted October 21, 2008 Posted October 21, 2008 Re: Tweakui setting question On Thu, 16 Oct 2008 19:51:35 -0400, "PCR" <pcrrcp@netzero.net> put finger to keyboard and composed: >Franc Zabkar wrote: >| This is the hacked file: >| http://www.users.on.net/~fzabkar/shell32.zip (488KB) >| >| I'll remove it in a few days. > >Remove it now! No one should kill his shortcut arrows! I've just hacked my GPS. I've got it to boot into the 320x240 WinCE desktop, but now I'm seeing those pesky shortcut arrows ... on a 3.5" screen! Is nothing sacred? - Franc Zabkar -- Please remove one 'i' from my address when replying by email.
Guest PCR Posted October 21, 2008 Posted October 21, 2008 Re: Tweakui setting question Franc Zabkar wrote: | On Thu, 16 Oct 2008 19:51:35 -0400, "PCR" <pcrrcp@netzero.net> put | finger to keyboard and composed: | |>Franc Zabkar wrote: | |>| This is the hacked file: |>| http://www.users.on.net/~fzabkar/shell32.zip (488KB) |>| |>| I'll remove it in a few days. |> |>Remove it now! No one should kill his shortcut arrows! | | I've just hacked my GPS. I've got it to boot into the 320x240 WinCE | desktop, but now I'm seeing those pesky shortcut arrows ... on a 3.5" | screen! Is nothing sacred? You are haunted now for the evil work you have done! Good! | - Franc Zabkar | -- | Please remove one 'i' from my address when replying by email. -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, Should things get worse after this, PCR pcrrcp@netzero.net
Recommended Posts