Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Tech Tips and Reviews Tech Tips and Reviews
Search Search
Search for:
Tech Support Guy > > >

Show Super Hidden File Extensions


(!)

Saxon's Avatar
Saxon Saxon is offline
Senior Member with 202 posts.
THREAD STARTER
 
Join Date: Jul 2005
Experience: Advanced
25-Jul-2005, 02:25 PM #1
Show Super Hidden File Extensions
Show Super Hidden File Extensions

Even when you have configured Windows to display all file extensions, there are still some which remain hidden. This allows potentially dangerous files to be masked as safe files, fooling the user into executing them. This tweak helps expose those file extensions.

It is possible for a malicious user to name a file so that it looks safe to open, when in fact it may be executable containing dangerous content.

For example, a file could be displayed as "readme.txt" in explorer, when it fact it is really name "readme.txt.shs" but since the ".shs" portion of the filename is hidden it is impossible to tell it apart from a simple text file. Then once a user double-clicks to open this file, instead of seeing a text page as expected, the file will be executed by Windows as a scrap object and potentially harm the system.

To remove the potential to hide files, open your registry and using the search function find each occurance of a value named "NeverShowExt".

When this value is present the associated file extension will not be shown. To display the file extension highlight the "NeverShowExt" value and press Delete. Repeat this process for each extension you want to display.

Some common hidden extensions include:

Document Shortcut (.SHB)
[HKEY_CLASSES_ROOT\DocShortcut]

Internet Shortcut (.URL)
[HKEY_CLASSES_ROOT\InternetShortcut]

File Shortcut (.LNK)
[HKEY_CLASSES_ROOT\lnkfile]

DOS Shortcut (.PIF)
[HKEY_CLASSES_ROOT\piffile]

Explorer Command (.SCF)
[HKEY_CLASSES_ROOT\SHCmdFile]

Shell Scrap Object (.SHS)
[HKEY_CLASSES_ROOT\ShellScrap]

Restart Windows for the change to take effect.
XP1's Avatar
XP1 XP1 is offline
Member with 34 posts.
 
Join Date: Aug 2005
Experience: 2 + 2 = 22
08-Apr-2007, 04:02 AM #2
For Windows Vista, there is a required restart to reflect upon the registry changes.

I have this in a REG file so it's easier for me to do this on multiple computers (text below and attached TXT file).

Editing may be needed to suit your needs.

REG File:
Code:
Windows Registry Editor Version 5.00

; Show Super Hidden File Extensions

; Document Shortcut (.SHB)
[HKEY_CLASSES_ROOT\DocShortcut]
"NeverShowExt"=-

; Internet Shortcut (.URL)
[HKEY_CLASSES_ROOT\InternetShortcut]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut]
"NeverShowExt"=-

; File Shortcut (.LNK)
[HKEY_CLASSES_ROOT\lnkfile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile]
"NeverShowExt"=-
[HKEY_CLASSES_ROOT\lnkfile2]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile2]
"NeverShowExt"=-

; MD-DOS Program Shortcut (.PIF)
[HKEY_CLASSES_ROOT\piffile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile]
"NeverShowExt"=-

; Windows Explorer Command (.SCF)
[HKEY_CLASSES_ROOT\SHCmdFile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile]
"NeverShowExt"=-

; Shell Scrap Object (.SHS)
[HKEY_CLASSES_ROOT\ShellScrap] 
"NeverShowExt"=-

; Microsoft Office Access
; Microsoft Office Access Data Access Page Shortcut (.MAW)
[HKEY_CLASSES_ROOT\Access.Shortcut.DataAccessPage.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.DataAccessPage.1]
"NeverShowExt"=-
; Microsoft Office Access Diagram Shortcut (.MAG)
[HKEY_CLASSES_ROOT\Access.Shortcut.Diagram.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Diagram.1]
"NeverShowExt"=-
; Microsoft Office Access Form Shortcut (.MAF)
[HKEY_CLASSES_ROOT\Access.Shortcut.Form.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Form.1]
"NeverShowExt"=-
; ; Microsoft Office Access 2007 Open Function (.MAU)
[HKEY_CLASSES_ROOT\Access.Shortcut.Function.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Function.1]
"NeverShowExt"=-
; Microsoft Office Access Macro Shortcut (.MAM)
[HKEY_CLASSES_ROOT\Access.Shortcut.Macro.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Macro.1]
"NeverShowExt"=-
; Microsoft Office Access Module Shortcut (.MAD)
[HKEY_CLASSES_ROOT\Access.Shortcut.Module.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Module.1]
"NeverShowExt"=-
; Microsoft Office Access Query Shortcut (.MAQ)
[HKEY_CLASSES_ROOT\Access.Shortcut.Query.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Query.1]
"NeverShowExt"=-
; Microsoft Office Access Report Shortcut (.MAR)
[HKEY_CLASSES_ROOT\Access.Shortcut.Report.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Report.1]
"NeverShowExt"=-
; Microsoft Office Access StoredProcedure shortcut (.MAS)
[HKEY_CLASSES_ROOT\Access.Shortcut.StoredProcedure.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.StoredProcedure.1]
"NeverShowExt"=-
; Microsoft Office Access Table Shortcut (.MAT)
[HKEY_CLASSES_ROOT\Access.Shortcut.Table.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Table.1]
"NeverShowExt"=-
; Microsoft Office Access View Shortcut (.MAV)
[HKEY_CLASSES_ROOT\Access.Shortcut.View.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.View.1]
"NeverShowExt"=-

; ClickOnce Installed Application Shortcut (.DEPLOY)
[HKEY_CLASSES_ROOT\Application.Reference]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference]
"NeverShowExt"=-

; Compressed (zipped) Folder SendTo Drop Target (.ZFSendTo)
[HKEY_CLASSES_ROOT\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=-

; Mail Recipient SendTo Drop Target (.MAPIMAIL)
[HKEY_CLASSES_ROOT\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-

; Desktop SendTo Drop Target (.DESKLINK)
[HKEY_CLASSES_ROOT\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-

; My Documents SendTo Drop Target (.MYDOCS)
[HKEY_CLASSES_ROOT\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=-

; Microsoft Office 2007 Groove Synchronization Shortcut (.GLK)
[HKEY_CLASSES_ROOT\GrooveLinkFile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GrooveLinkFile]
"NeverShowExt"=-

; Windows Internet Explorer URL Association (Legacy Disabled)
; [HKEY_CLASSES_ROOT\IE.AssocFile.URL]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL]
; "NeverShowExt"=-

; Citrix Program Neighborhood Agent File (.PNAGENT)
; [HKEY_CLASSES_ROOT\PNAgentFile]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PNAgentFile]
; "NeverShowExt"=-

; Search Folder
; [HKEY_CLASSES_ROOT\SearchFolder]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchFolder]
; "NeverShowExt"=-
Attached Files
File Type: txt Show Super Hidden File Extensions.reg.txt (4.9 KB, 775 views)
Lets_Fixit's Avatar
Lets_Fixit Lets_Fixit is offline
Computer Specs
Junior Member with 11 posts.
 
Join Date: Apr 2007
Location: Vancouver Island Canada
Experience: 6 years remote computer repairs
16-Apr-2007, 09:03 PM #3
thank you that was a good post and i used regseeker to search and find ( NeverShowExt )
and was fast
fury756's Avatar
fury756 fury756 is offline
Computer Specs
Junior Member with 13 posts.
 
Join Date: Jul 2006
Location: Escondido, CA
Experience: Intermediate
16-Aug-2008, 07:04 PM #4
Thanks for these posts. Any guesses what MS reasoning is behind making the default for this file group, even after "show hidden extensions", to remain hidden? Probably over my head, but it seems absurd!
tbird6820's Avatar
tbird6820 tbird6820 is offline
Computer Specs
Member with 20 posts.
 
Join Date: Aug 2008
Experience: Intermediate
17-Aug-2008, 06:55 PM #5
Great stuff, Thanks Saxon.
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑