[Saxon]

Show Super Hidden File Extensions

Even when you have configured Windows to display all file extensions, there are still some which remain hidden. This allows potentially dangerous files to be masked as safe files, fooling the user into executing them. This tweak helps expose those file extensions.

It is possible for a malicious user to name a file so that it looks safe to open, when in fact it may be executable containing dangerous content.

For example, a file could be displayed as "readme.txt" in explorer, when it fact it is really name "readme.txt.shs" but since the ".shs" portion of the filename is hidden it is impossible to tell it apart from a simple text file. Then once a user double-clicks to open this file, instead of seeing a text page as expected, the file will be executed by Windows as a scrap object and potentially harm the system.

To remove the potential to hide files, open your registry and using the search function find each occurance of a value named "NeverShowExt".

When this value is present the associated file extension will not be shown. To display the file extension highlight the "NeverShowExt" value and press Delete. Repeat this process for each extension you want to display.

Some common hidden extensions include:

Document Shortcut (.SHB)
[HKEY_CLASSES_ROOT\DocShortcut]

Internet Shortcut (.URL)
[HKEY_CLASSES_ROOT\InternetShortcut]

File Shortcut (.LNK)
[HKEY_CLASSES_ROOT\lnkfile]

DOS Shortcut (.PIF)
[HKEY_CLASSES_ROOT\piffile]

Explorer Command (.SCF)
[HKEY_CLASSES_ROOT\SHCmdFile]

Shell Scrap Object (.SHS)
[HKEY_CLASSES_ROOT\ShellScrap]

Restart Windows for the change to take effect.

[XP1]

For Windows Vista, there is a required restart to reflect upon the registry changes.

I have this in a REG file so it's easier for me to do this on multiple computers (text below and attached TXT file).

Editing may be needed to suit your needs.

REG File:

Windows Registry Editor Version 5.00

; Show Super Hidden File Extensions

; Document Shortcut (.SHB)
[HKEY_CLASSES_ROOT\DocShortcut]
"NeverShowExt"=-

; Internet Shortcut (.URL)
[HKEY_CLASSES_ROOT\InternetShortcut]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut]
"NeverShowExt"=-

; File Shortcut (.LNK)
[HKEY_CLASSES_ROOT\lnkfile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile]
"NeverShowExt"=-
[HKEY_CLASSES_ROOT\lnkfile2]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile2]
"NeverShowExt"=-

; MD-DOS Program Shortcut (.PIF)
[HKEY_CLASSES_ROOT\piffile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile]
"NeverShowExt"=-

; Windows Explorer Command (.SCF)
[HKEY_CLASSES_ROOT\SHCmdFile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile]
"NeverShowExt"=-

; Shell Scrap Object (.SHS)
[HKEY_CLASSES_ROOT\ShellScrap] 
"NeverShowExt"=-

; Microsoft Office Access
; Microsoft Office Access Data Access Page Shortcut (.MAW)
[HKEY_CLASSES_ROOT\Access.Shortcut.DataAccessPage.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.DataAccessPage.1]
"NeverShowExt"=-
; Microsoft Office Access Diagram Shortcut (.MAG)
[HKEY_CLASSES_ROOT\Access.Shortcut.Diagram.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Diagram.1]
"NeverShowExt"=-
; Microsoft Office Access Form Shortcut (.MAF)
[HKEY_CLASSES_ROOT\Access.Shortcut.Form.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Form.1]
"NeverShowExt"=-
; ; Microsoft Office Access 2007 Open Function (.MAU)
[HKEY_CLASSES_ROOT\Access.Shortcut.Function.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Function.1]
"NeverShowExt"=-
; Microsoft Office Access Macro Shortcut (.MAM)
[HKEY_CLASSES_ROOT\Access.Shortcut.Macro.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Macro.1]
"NeverShowExt"=-
; Microsoft Office Access Module Shortcut (.MAD)
[HKEY_CLASSES_ROOT\Access.Shortcut.Module.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Module.1]
"NeverShowExt"=-
; Microsoft Office Access Query Shortcut (.MAQ)
[HKEY_CLASSES_ROOT\Access.Shortcut.Query.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Query.1]
"NeverShowExt"=-
; Microsoft Office Access Report Shortcut (.MAR)
[HKEY_CLASSES_ROOT\Access.Shortcut.Report.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Report.1]
"NeverShowExt"=-
; Microsoft Office Access StoredProcedure shortcut (.MAS)
[HKEY_CLASSES_ROOT\Access.Shortcut.StoredProcedure.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.StoredProcedure.1]
"NeverShowExt"=-
; Microsoft Office Access Table Shortcut (.MAT)
[HKEY_CLASSES_ROOT\Access.Shortcut.Table.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Table.1]
"NeverShowExt"=-
; Microsoft Office Access View Shortcut (.MAV)
[HKEY_CLASSES_ROOT\Access.Shortcut.View.1]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.View.1]
"NeverShowExt"=-

; ClickOnce Installed Application Shortcut (.DEPLOY)
[HKEY_CLASSES_ROOT\Application.Reference]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference]
"NeverShowExt"=-

; Compressed (zipped) Folder SendTo Drop Target (.ZFSendTo)
[HKEY_CLASSES_ROOT\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=-

; Mail Recipient SendTo Drop Target (.MAPIMAIL)
[HKEY_CLASSES_ROOT\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-

; Desktop SendTo Drop Target (.DESKLINK)
[HKEY_CLASSES_ROOT\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=-

; My Documents SendTo Drop Target (.MYDOCS)
[HKEY_CLASSES_ROOT\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=-

; Microsoft Office 2007 Groove Synchronization Shortcut (.GLK)
[HKEY_CLASSES_ROOT\GrooveLinkFile]
"NeverShowExt"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GrooveLinkFile]
"NeverShowExt"=-

; Windows Internet Explorer URL Association (Legacy Disabled)
; [HKEY_CLASSES_ROOT\IE.AssocFile.URL]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL]
; "NeverShowExt"=-

; Citrix Program Neighborhood Agent File (.PNAGENT)
; [HKEY_CLASSES_ROOT\PNAgentFile]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PNAgentFile]
; "NeverShowExt"=-

; Search Folder
; [HKEY_CLASSES_ROOT\SearchFolder]
; "NeverShowExt"=-
; [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchFolder]
; "NeverShowExt"=-

[Lets_Fixit]

thank you that was a good post and i used regseeker to search and find ( NeverShowExt )
and was fast

[fury756]

Thanks for these posts. Any guesses what MS reasoning is behind making the default for this file group, even after "show hidden extensions", to remain hidden? Probably over my head, but it seems absurd!

[tbird6820]

Great stuff, Thanks Saxon.