causes? and fixing 'broken' file association paths

Discussion in 'Software' started by mjnc, May 5, 2008.

Thread Status:
Not open for further replies.
  1. mjnc

    mjnc MajorGeek

    May 5, 2008

    Hello Geeks,

    Recently I was trying to repair a 'broken' file type association.
    When double-clicking on a .WAV filename in Explorer, I got an error message:

    Windows can not find C:\Program\Windows Media Player\wmplayer.exe

    (Windows XP Home SP2)

    Since I thought this might have been caused by some type of malware,
    I scaned my system with almost?? all of the malware tools recommended at
    MajorGeeks, but all the scans found nothing.

    I tried to repair this through Tools > Folder Options > File Types.
    Repeated attempts to Restore the association, Delete the filetype and
    re-install or to fix it through the Advanced button dialog all failed.
    Later, I found the path in the registry using Regedit and replaced

    C:\Program\Windows ...

    with

    C:\Program Files\Windows ...

    THIS CORRECTED THE PROBLEM.
    Double-clicking a .WAV file in Explorer now works as it should, launching Media Player, loading and playing the file.

    However, I found several other erroneous paths with the same
    C:\Program\....

    Some, like Adobe Reader, have been uninstalled/removed.
    I do not recall ever installing FastStone Image Viewer, although I did download the program.
    Still others, like VMWare, are unknown to me.

    I have several Questions:
    ==========================================================
    1) should I remove the registry entrys that point to non-existing paths?
    (Easy Cleaner did not find any of these.)

    2) should I manually correct the remaining paths or just leave them alone?

    3) what caused the path(s) to get corrupted?

    I have never used this forum before, but I thought this would be a good place
    to start.
    I would appreciate any insights or suggestions.

    Thanks,
    Michael
    :)

    ==========================================================
    Here is a partial list of the remaining faulty registry entries.
    You will notice that some of the paths are enclosed in double quotation marks
    while others are not. That is how they appear in the registry.
    ==========================================================

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AcroRd32.exe
    path REG_SZ "C:\Program\Adobe\Reader 8.0\Reader\"


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\dialer.exe
    path REG_SZ "C:\Program\Windows NT\dialer.exe"


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\FSViewer.exe
    path REG_SZ "C:\Program\FastStone Image Viewer\FSViewer.exe"


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\hrtzzm.exe
    path REG_SZ "C:\Program\MSN Gaming Zone\Windows\hrtzzm.exe"


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\hypertrm.exe
    path REG_SZ "C:\Program\Windows NT\hypertrm.exe"


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ICWCONN1.exe
    path REG_SZ "C:\Program\Internet Explorer\Connection Wizard\ICXCONN1.exe"

    similar entry for ICWCONN2.exe
    ------------------------------

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.exe
    (default) REG_SZ C:\Program\Internet Explorer\IEXPLORE.EXE
    path REG_SZ C:\Program\Internet Explorer;


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\INETWIZ.exe
    (default) REG_SZ "C:\Program\Internet Explorer\Connection Wizard\INETWIZ.EXE"
    path REG_SZ C:\Program\Internet Explorer\Connection Wizard;


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ISIGNUP.EXE
    (default) REG_SZ "C:\Program\Internet Explorer\Connection Wizard\ISIGNUP.EXE"
    path REG_SZ C:\Program\Internet Explorer\Connection Wizard;


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\moviemk.exe
    (default) REG_SZ C:\Program\Movie Maker\moviemk.exe


    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mplayer2.exe
    (default) REG_SZ "C:\Program\Windows Media Player\mplayer2.exe"
    path REG_SZ "C:\Program\Windows Media Player"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msinfo32.exe
    (default) REG_SZ C:\Program\Delade filler\Microsoft Shared\MSInfo\MSInfo32.exe
    path REG_SZ C:\Program\Delade filler\Microsoft Shared\MSInfo


    --------------------------------------------------------------------------
    Don't know what this one is / was - there is no directory named: C:\Program Files\VMWare
    --------------------------------------------------------------------------

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VMWareTray.EXE
    (default) REG_SZ C:\Program\VMWare\VMWare Tools\VMWareTray.exe
    path REG_SZ C:\Program\VMWare\VMWare Tools

    ==========================================================
     
  2. dlb

    dlb MajorGeek

    No help here... but I'll be keeping an eye on this one as I've recently run into numerous file association problems that in some cases originally stemmed from malware infections and their subsequent removal caused the association errors (as far as I can tell). In the past week, I've dealt with 5 PCs with this problem 3 of the 5 required repair OS installs, 1 had to be formatted and reloaded, and I was able to repair the other one manually. So if anyone has any answers, I'm really looking forward to hearing 'em, especially for question 3! (what causes the file associations/paths to get corrupted in the first place).
     
  3. plodr

    plodr Major Geek Super Extraordinaire

    If it were my computer, I change the paths from \Program to \Program Files

    I'm looking over your entries to be sure they are legitimate entries.
    If I find one that should not be there, I will tell you to bak up the registry and then remove it.
    All are okay. But remove any quotes in any of the REG_SZ oth for default and path
    None of my entries have quotes anywhere.

    VMWare stands for virtual machine and if you have it installed, it allows you to install other operating systems inside and run them.
    Here's a it of an explanation http://www.vmware.com/products/player/

    Like dlb, I'd be very curious to discover what changed all those entries.
     
  4. mjnc

    mjnc MajorGeek

    Thanks! I appreciate that. I left some out because they didn't mean anything
    to me. I my go back and get those as well and put them in a reply to this thread.

    After reading dlb's reply, I'm wondering if there is other damage that I just
    don't know about yet. rolleyes

    I just did a registry scan with CCleaner. It seems that it did find all of those
    invalid paths. Of course I did Not let it delete any of them.

    mjc
     
  5. mjnc

    mjnc MajorGeek

    I have been using a freeware ver. of Total Uninstall 2.35.
    Usually I use the standard Windows Add/Remove Programs,
    however, I have used TU to install/uninstall a few programs.

    I'm wondering - is it safe to use this version with Win XP Home SP2?

    I doubt that it would have changed registry paths for other apps., but
    I have wondered if it OK to use with XP.

    I am removing the quotes from the REG_SZ default and path entries.

    mjc
     
  6. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

  7. mjnc

    mjnc MajorGeek

    While I was correcting the registry entries, I came to the following entry which seems to me to be the most ominous.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPaths\msinfo32.exe
    (default) C:\Program\Delade filer\Microsoft Shared\MSInfo\MSInfo32.exe
    path C:\Program\Delade filler\Microsoft Shared\MSInfo

    The correct path is:

    C:\Program Files\Common Files\Microsoft Shared\MSInfo

    When I tried to run the MSInfo32.exe program from the Run dialog box, I naturally got a 'Windows can not find ...' error message.

    ALSO, when I navigated to:
    Start > Programs > Accessories > System Tools
    System Information Was Not Listed !!

    The \Delade filer\ showed up in several of the faulty paths.
    As yet, I have not found any info. about what this path is or how it got there.

    Has anyone seen this folder inserted into application paths?

    Thanks,
    mjc
     
  8. plodr

    plodr Major Geek Super Extraordinaire

    While googling the \Delade Filer seems to be associated with parts of Symantec Shared. I'm not sure which product in particular since Symantec has quite a few. I've found more with InstallShield and Panda so it might have been related to something you previously used and uninstalled. I don't think it is malware rather just leftovers of software that did a poor job cleaning up after itself.
     
  9. mjnc

    mjnc MajorGeek

    Thanks for the info. Haven't used anything from Symantec. No Panda software or online scans either. Seems more likely that is's an install/uninstall problem as you suggest. I don't know when the damage was done.
    If I did, I might be able to find which program was installed or uninstalled at that time.
     
  10. evilfantasy

    evilfantasy Malware Fighter

    File association fix tools.

    http://www.dougknox.com/xp/file_assoc.htm - Scroll to or click [FONT=Arial, Arial, Helvetica]EXE File Association Fix (Restore default association for EXE files)[/FONT]

    Or...

    DownloadDeckard's Association File Tool DAFT.exe and save it to your desktop.
    • Rename daft.exe to daft.com and double click on it to run.
    • Read the disclaimer and click OK.
    • Click on the Scan button.
    • If it finds faulty file associations, they will appear in red beside a checkbox. If this occurs, just place a checkmark (tick) in the boxes in question.
    • Click the Fix button.
    Also...

    Fix or Restore Broken .EXE .LNK .COM Association Caused by Virus
     
  11. mjnc

    mjnc MajorGeek

    @evilFantasy
    Thanks for your reply.
    This covers more than the problems I discovered.
    Haven't had a chance to really get into this information yet.
    I fixed the immediate problem - checked all of the entrys under
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPaths
    and corrected those that were still valid. Those that were invalid
    were removed with CCleaner.

    There is another matter I need to attend to first.
    My last Secunia security scan points to what I believe is an old ver.
    of Macromedia Flash Player which it says is not secure. I have the latest
    version installed, but this still shows as a security risk :confused

    macromedia flash 6.x
    C:\WINDOWS\SYSTEM32\Macromed\Flash\flash.ocx
     
  12. evilfantasy

    evilfantasy Malware Fighter

  13. mjnc

    mjnc MajorGeek

    Wow! Thanks. Done. Worked like a charm. :)
    Already had ver 9.0.124.0 installed, but this cleaned things up nicely.

    How do you put those links in your posts?
    Is it a standard <a href="" />

    mjc
     
  14. evilfantasy

    evilfantasy Malware Fighter

    Glad it worked!

    It's BB code. The forums don't accept HTML. If you do know any HTML then you can pick it up pretty easy.

    Look here for the BB code tags.
     
Thread Status:
Not open for further replies.

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds