Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

I tried to install Sygate Personal Firewall on NT4(sp6). The installation
failed. No idea why, because (I'm guessing here) Sygate seems to have
blocked a logfile Dr Watson claimed it was creating. Whatever happened, the
error log wasn't created.

When I tried to uninstall Sygate, I discovered the following:

- Double clicking a program icon on the desktop opens the program in
Notepad.
- Trying to run a program via the start button menus does the same.
- Start|Run works fine.
- Right clicking a desktop icon and selecting "open" works fine.
- I can get into Control Panel, but anything I click in there loads into
Notepad. *
- .bat files run fine from the desktop. I haven't tested .cmd yet.
- Files associated with programs appear to work normally from the desktop
(the connected app runs and loads the file).

* Because of the Control Panel problem, I couldn't use "install/remove
programs", and no other method of uninstalling was available. Result: I had
to do a manual uninstall to get rid of Sygate.

There are a few remnants Regedit says it can't delete (keys under the name
LEGACY_SYGATE), and undoubtedly a few things I've missed. Does anyone know
if these registry entries could be causing the .exe problem, and if so, how
can I get rid of them? If they are not the cause, what could be, and how
might I fix it?

I would just tear my hair out, but the reason I want a firewall installed is
that I already tore it out while combatting a heap of viruses and other junk
that got onto my hard drives a couple of weeks ago

TIA.

--
Regards,
Crazy.
http://web.ukonline.co.uk/crazy.aljy

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

It seems to be some spyware/ virus activity. You need to get some Anti
Spyware program (You can search on google to find one, which best suits
your needs). I hope scanning and fixing the threats you will be able to
resolve the issue quickly.

Another good point to start working is kill any unknown programs
running. You can do this from Task Manager. I hope it will help you.
Keep us updated.

Regards,

K.N. Salman
http://enoise.net
http://superfreehosting.com

Crazy Aljy wrote:
> I tried to install Sygate Personal Firewall on NT4(sp6). The
installation
> failed. No idea why, because (I'm guessing here) Sygate seems to have
> blocked a logfile Dr Watson claimed it was creating. Whatever
happened, the
> error log wasn't created.
>
> When I tried to uninstall Sygate, I discovered the following:
>
> - Double clicking a program icon on the desktop opens the program in
> Notepad.
> - Trying to run a program via the start button menus does the same.
> - Start|Run works fine.
> - Right clicking a desktop icon and selecting "open" works fine.
> - I can get into Control Panel, but anything I click in there loads
into
> Notepad. *
> - .bat files run fine from the desktop. I haven't tested .cmd yet.
> - Files associated with programs appear to work normally from the
desktop
> (the connected app runs and loads the file).
>
> * Because of the Control Panel problem, I couldn't use
"install/remove
> programs", and no other method of uninstalling was available. Result:
I had
> to do a manual uninstall to get rid of Sygate.
>
> There are a few remnants Regedit says it can't delete (keys under the
name
> LEGACY_SYGATE), and undoubtedly a few things I've missed. Does anyone
know
> if these registry entries could be causing the .exe problem, and if
so, how
> can I get rid of them? If they are not the cause, what could be, and
how
> might I fix it?
>
> I would just tear my hair out, but the reason I want a firewall
installed is
> that I already tore it out while combatting a heap of viruses and
other junk
> that got onto my hard drives a couple of weeks ago
>
> TIA.
>
> --
> Regards,
> Crazy.
> http://web.ukonline.co.uk/crazy.aljy

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Thanks Kashif.

Avast, Ad-Aware, Spybot-SD, and a few other anti-spyware programs are
already installed. They find nothing suspicious. I've also tried killing
unknown apps, but to no avail.

I did find a registry backup one of the anti-spyware programs made, so I was
able to restore the registry to a previous state and do another scan to get
rid of the spyware/adware entries it restored. I still have the problem with
..exe files loading in Notepad, which leads me to think Sygate has changed
one or more files on my system.

I have backups of all the old DLL's (only the DLL's) on my system, so I'll
try that next, then see what happens.

--
Regards,
Crazy.
http://web.ukonline.co.uk/crazy.aljy


"Kashif" <kashifns@gmail.com> wrote in message
news:1115223293.631739.54860@o13g2000cwo.googlegroups.com...
> It seems to be some spyware/ virus activity. You need to get some Anti
> Spyware program (You can search on google to find one, which best suits
> your needs). I hope scanning and fixing the threats you will be able to
> resolve the issue quickly.
>
> Another good point to start working is kill any unknown programs
> running. You can do this from Task Manager. I hope it will help you.
> Keep us updated.
>
> Regards,
>
> K.N. Salman
> http://enoise.net
> http://superfreehosting.com
>
> Crazy Aljy wrote:
> > I tried to install Sygate Personal Firewall on NT4(sp6). The
> installation
> > failed. No idea why, because (I'm guessing here) Sygate seems to have
> > blocked a logfile Dr Watson claimed it was creating. Whatever
> happened, the
> > error log wasn't created.
> >
> > When I tried to uninstall Sygate, I discovered the following:
> >
> > - Double clicking a program icon on the desktop opens the program in
> > Notepad.
> > - Trying to run a program via the start button menus does the same.
> > - Start|Run works fine.
> > - Right clicking a desktop icon and selecting "open" works fine.
> > - I can get into Control Panel, but anything I click in there loads
> into
> > Notepad. *
> > - .bat files run fine from the desktop. I haven't tested .cmd yet.
> > - Files associated with programs appear to work normally from the
> desktop
> > (the connected app runs and loads the file).
> >
> > * Because of the Control Panel problem, I couldn't use
> "install/remove
> > programs", and no other method of uninstalling was available. Result:
> I had
> > to do a manual uninstall to get rid of Sygate.
> >
> > There are a few remnants Regedit says it can't delete (keys under the
> name
> > LEGACY_SYGATE), and undoubtedly a few things I've missed. Does anyone
> know
> > if these registry entries could be causing the .exe problem, and if
> so, how
> > can I get rid of them? If they are not the cause, what could be, and
> how
> > might I fix it?
> >
> > I would just tear my hair out, but the reason I want a firewall
> installed is
> > that I already tore it out while combatting a heap of viruses and
> other junk
> > that got onto my hard drives a couple of weeks ago
> >
> > TIA.
> >
> > --
> > Regards,
> > Crazy.
> > http://web.ukonline.co.uk/crazy.aljy
>

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Scratch all this. I found the problem.

A registry entry I came across by pure chance.

[HKEY_CLASSES_ROOT\exefile\shell\open\command]

The default value was blank. The ones for comfile, batfile and similar
contained a default value of...

"%1" %*

Tried it and it works. It my be wrong, but I'll sweat about that if it
breaks

--
Regards,
Crazy.
http://web.ukonline.co.uk/crazy.aljy


"Crazy Aljy"
<ifyouspammeiwillripyourheadoff@abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqr
stuvwxyzabcdefghijk.com> wrote in message
news:ns9ee.20524$5A3.15441@newsfe4-win.ntli.net...
> Thanks Kashif.
>
> Avast, Ad-Aware, Spybot-SD, and a few other anti-spyware programs are
> already installed. They find nothing suspicious. I've also tried killing
> unknown apps, but to no avail.
>
> I did find a registry backup one of the anti-spyware programs made, so I
was
> able to restore the registry to a previous state and do another scan to
get
> rid of the spyware/adware entries it restored. I still have the problem
with
> .exe files loading in Notepad, which leads me to think Sygate has changed
> one or more files on my system.
>
> I have backups of all the old DLL's (only the DLL's) on my system, so I'll
> try that next, then see what happens.
>
> --
> Regards,
> Crazy.
> http://web.ukonline.co.uk/crazy.aljy
>
>
> "Kashif" <kashifns@gmail.com> wrote in message
> news:1115223293.631739.54860@o13g2000cwo.googlegroups.com...
> > It seems to be some spyware/ virus activity. You need to get some Anti
> > Spyware program (You can search on google to find one, which best suits
> > your needs). I hope scanning and fixing the threats you will be able to
> > resolve the issue quickly.
> >
> > Another good point to start working is kill any unknown programs
> > running. You can do this from Task Manager. I hope it will help you.
> > Keep us updated.
> >
> > Regards,
> >
> > K.N. Salman
> > http://enoise.net
> > http://superfreehosting.com
> >
> > Crazy Aljy wrote:
> > > I tried to install Sygate Personal Firewall on NT4(sp6). The
> > installation
> > > failed. No idea why, because (I'm guessing here) Sygate seems to have
> > > blocked a logfile Dr Watson claimed it was creating. Whatever
> > happened, the
> > > error log wasn't created.
> > >
> > > When I tried to uninstall Sygate, I discovered the following:
> > >
> > > - Double clicking a program icon on the desktop opens the program in
> > > Notepad.
> > > - Trying to run a program via the start button menus does the same.
> > > - Start|Run works fine.
> > > - Right clicking a desktop icon and selecting "open" works fine.
> > > - I can get into Control Panel, but anything I click in there loads
> > into
> > > Notepad. *
> > > - .bat files run fine from the desktop. I haven't tested .cmd yet.
> > > - Files associated with programs appear to work normally from the
> > desktop
> > > (the connected app runs and loads the file).
> > >
> > > * Because of the Control Panel problem, I couldn't use
> > "install/remove
> > > programs", and no other method of uninstalling was available. Result:
> > I had
> > > to do a manual uninstall to get rid of Sygate.
> > >
> > > There are a few remnants Regedit says it can't delete (keys under the
> > name
> > > LEGACY_SYGATE), and undoubtedly a few things I've missed. Does anyone
> > know
> > > if these registry entries could be causing the .exe problem, and if
> > so, how
> > > can I get rid of them? If they are not the cause, what could be, and
> > how
> > > might I fix it?
> > >
> > > I would just tear my hair out, but the reason I want a firewall
> > installed is
> > > that I already tore it out while combatting a heap of viruses and
> > other junk
> > > that got onto my hard drives a couple of weeks ago
> > >
> > > TIA.
> > >
> > > --
> > > Regards,
> > > Crazy.
> > > http://web.ukonline.co.uk/crazy.aljy
> >
>
>

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Hi Crazy,

I think your detective work is correct. Here is the appropriate registry entries
for that key from my system:

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

Hope this helps.

Calvin.

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Much appreciated, Calvin.

I have a few minor differences here, mainly with the EditFlags entries. I'll
give your settings a try and restore them if they don't work.

Many thanks.

--
Regards,
Crazy.
http://web.ukonline.co.uk/crazy.aljy


"Calvin" <nospam@spamcop.net> wrote in message
news:4279472d@duster.adelaide.on.net...
> Hi Crazy,
>
> I think your detective work is correct. Here is the appropriate registry
entries
> for that key from my system:
>
> [HKEY_CLASSES_ROOT\exefile]
> @="Application"
> "EditFlags"=hex:38,07,00,00
>
> [HKEY_CLASSES_ROOT\exefile\DefaultIcon]
> @="%1"
>
> [HKEY_CLASSES_ROOT\exefile\shell]
>
> [HKEY_CLASSES_ROOT\exefile\shell\open]
> "EditFlags"=hex:00,00,00,00
>
> [HKEY_CLASSES_ROOT\exefile\shell\open\command]
> @="\"%1\" %*"
>
> [HKEY_CLASSES_ROOT\exefile\shellex]
>
> [HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]
>
> [HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
> @="{86F19A00-42A0-1069-A2E9-08002B30309D}"
>
> Hope this helps.
>
> Calvin.
>

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Hi Crazy,

The 'edit Flags' entries are of no real consequence in this instance and may be
different on your system - they are set by the system based on which action is
the 'default' command and what other 'ancilliary' commands the particular file
type has attached to it.

Elsewise though, the entries should be basically the same on all systems.

Calvin.

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Hi Calvin.

When I changed the settings to what you have, I hit a few problems and had
to change them back. I'm not sure whether it was the edit flags or the
open\command default string, which was also slightly different.

In any case, it's working now, so I'm happy

--
Regards,
Crazy.
http://web.ukonline.co.uk/crazy.aljy


"Calvin" <nospam@spamcop.net> wrote in message
news:427c0e22$1@duster.adelaide.on.net...
> Hi Crazy,
>
> The 'edit Flags' entries are of no real consequence in this instance and
may be
> different on your system - they are set by the system based on which
action is
> the 'default' command and what other 'ancilliary' commands the particular
file
> type has attached to it.
>
> Elsewise though, the entries should be basically the same on all systems.
>
> Calvin.

Archived from groups: comp.security.firewalls,microsoft.public.windowsnt.registry (More info?)

Hi Crazy,

Glad the problem is solved anyway. As I said, there may be some variations
between systems - but the basics should be similar 'across the board'.

Calvin.