(OT) Ad-aware deleted entries in HOSTS!

[omega]

Also... there are loads of ways of adding 'open with notepad' to the
right click menu.

Or very fast, to even just create a notepad lnk and put it in sendto.
Whenever I have to use someone else's computer, I always do this the
first moment I sit down, as the absence of the open text option makes
me turn purple.

 

[Mister Charlie]

not?

Most of the time Ad-Aware will specify what kind of spyware the object
is (tracking cookie, VX2 object, etc.) Only in a few cases will it
not be clear.

Put each of the list of things Ad-Aware finds into the Google search
engine with the word "spyware" added and odds are you'll find it
referenced as such or not on one of the anti-spyware sites.

The main problem with this approach is a lot of people post their list
of files on anti-spyware and tech support sites to ask people which
items are spyware. This results in a lot of good programs showing up
in a Google search with the word "spyware", so you have to thoroughly
check the results until you find a site that specifically states the
search word is indeed spyware. Another way is to go to an anti-spyware
site that maintains a search engine of spyware and enter the program
name there.

What is unfortunate about Ad-Aware is that even with the latest
definition file, it will NOT find everything on your machine in many
cases. There will usually be a few items left that you will have to
find and clean out manually - or run another anti-spyware utility like
Spybot.

Perhaps it is the luck of a Fool but I have almost always simply deleted
what AdAware finds and never had a problem. And NO spyware program wil
get everything, not Spybot, not anything. So yes, it is incumbent on
users to have at least one secondary program (as well an anti-virus and
a firewall program in place) to afford a general sense of protection.

 

[jo]

Or very fast, to even just create a notepad lnk and put it in sendto.
Whenever I have to use someone else's computer, I always do this the
first moment I sit down, as the absence of the open text option makes
me turn purple.

That's a nice tip; I always forget the send to menu.

 

[omega]

Just tested. Made a change to the Hosts file and saved it. Wasn't
prompted for a file extension. No extension added.
No silly fonts.

This is a relief. Now the real test would be Winword in that role.
I recall the way that one liked to put its fists up and give me maniacal
speeches about "losing all my formatting" when all I'd asked it to do
was open and close a text file.

I think HostsToggle is Pricelessware.
HostsToggle is nice... it lets you turn the Hosts file on and off as
well as giving you a quick access for editing. I'd like to substitute
Edxor for Wordpad but have not bothered to look into how to do it yet.

I've right nowt downloaded it and had Regmon take a peek. The current
version at least, it is using whatever prog entry you have here:

HKCR\txtfile\shell\open\command

So I'd stick Edxor there, instead of Wordpad.

 

[jo]

I've right nowt downloaded it and had Regmon take a peek. The current
version at least, it is using whatever prog entry you have here:

HKCR\txtfile\shell\open\command

So I'd stick Edxor there, instead of Wordpad.

Thx. But...

I have Notepad there (AKA Edxor), and yet Hosts opens in Wordpad.

 

[omega]

Thx. But...

I have Notepad there (AKA Edxor), and yet Hosts opens in Wordpad.

That surprises me. After Regmon told me what key HostsToggle consults,
I'd made sure to test. I put several different editors under that key,
in turn, and each time it was whichever one there, which HostsToggle
then launched. I did shut it down and restart it between each reg change.
But, you say you already had notepad/edxor there, and it is not being
honored. I don't see where it might be digging up Wordpad from then.

I've just now Regmon'd it again. The story going on at my machine is
that HostsToggle first looks here:

HKCR\.TXT

Since the value I have pointing from that extensions key is to the fileype
key "txtfile," it next looks here:

HKCR\txtfile

I don't know whether it would here go for the default verb if different
from the Open key under there. But you probably would have spotted if
you had Wordpad hanging out in that area anywhere. How about that first
extension key, HKCR\.TXT, any chance at all you have a value there that
says something other than txtfile?

 

[jo]

That surprises me. After Regmon told me what key HostsToggle consults,
I'd made sure to test. I put several different editors under that key,
in turn, and each time it was whichever one there, which HostsToggle
then launched. I did shut it down and restart it between each reg change.
But, you say you already had notepad/edxor there, and it is not being
honored. I don't see where it might be digging up Wordpad from then.

I've just now Regmon'd it again. The story going on at my machine is
that HostsToggle first looks here:

HKCR\.TXT

Since the value I have pointing from that extensions key is to the fileype
key "txtfile," it next looks here:

HKCR\txtfile

I don't know whether it would here go for the default verb if different
from the Open key under there. But you probably would have spotted if
you had Wordpad hanging out in that area anywhere. How about that first
extension key, HKCR\.TXT, any chance at all you have a value there that
says something other than txtfile?

The values are as you describe them. Nothing odd looking. I wondered if
HostsToggle might be getting upset that my 'Notepad' is a renamed Edxor,
so pointed the command value to Edxor in Program Files. Hosts opened in
Wordpad.
I thought about it for a bit, realised I am far too dim for this sort of
stuff, and overwrote WordPad with Edxor.
That did the trick.

 

[omega]

The values are as you describe them. Nothing odd looking. I wondered if
HostsToggle might be getting upset that my 'Notepad' is a renamed Edxor,
so pointed the command value to Edxor in Program Files. Hosts opened in
Wordpad.
I thought about it for a bit, realised I am far too dim for this sort of
stuff, and overwrote WordPad with Edxor.
That did the trick.

But now you've hurt Wordpad's feelings! I can hear it wimpering in the
oblivion you sent it into. <g>

If it was my machine, I'd still feel compelled to find out how Wordpad
was getting called. If you eventually end up curious to pursue, maybe
do a search in your registry. I recommend this small reg editor for the
search: Regmagik. Download choices for it listed in recent mid:
<[email protected]>

Regmagik

Tools > Find >

Search For:
wordpad.exe

Search under the Following Key:
CLASSES_ROOT

(Watch the horizontal splitter, separating the Find pane from the main
reg tree interface view. Occasionally my Find pane disappears from
some repositioning I did in a previous session, and I have to remember
to use the mouse to drag it back to view.)

I'm thinking the search might turn up wordpad.exe in there, somewhere
or other, in your associations. Maybe some bad tweaker program you
tested wrote a value in there. I've had the experience of a couple bad
tweaker programs (can't name names handily, but think they'd by now
have died a natural death anyway) which automatically wrote changes
to my reg, totally without permission.

 

[omega]

The values are as you describe them. Nothing odd looking. I wondered if
HostsToggle might be getting upset that my 'Notepad' is a renamed Edxor,
so pointed the command value to Edxor in Program Files. Hosts opened in
Wordpad.

You got me thinking about that. And success: I got Hosts Toggle to inflict
that same behavior on me - opening the hosts file in Wordpad. This once I
followed your config and put "notepad.exe" in that key.

HKCR\txtfile\shell\open\command

It honors our entry only when we have a text editor there with its own name.
It has a special prejudice -- against the name notepad. I would believe this
by design. That the author was thinking about the max file size limit of the
MS notepad in W9x.

Now, whether one then goes and changes one's whole global key there, merely
to appease HostsToggle, or accepts the Wordpad launch, or else if there is
some subtle trick to pull, that's another subject. As now, I am happy that
the mystery is solved. And I completely retract all my insulting accusations
about your registry being impure with a hidden wordpad association.

 

[omega]

The values are as you describe them. Nothing odd looking. I wondered if
HostsToggle might be getting upset that my 'Notepad' is a renamed Edxor,
so pointed the command value to Edxor in Program Files. Hosts opened in
Wordpad.
I thought about it for a bit, realised I am far too dim for this sort of
stuff, and overwrote WordPad with Edxor.
That did the trick.

In case you wanted to be a little less drastic, you could resurrect Wordpad's
body up from the dead. But change the rules a bit. Not let it come running so
obediently whenever someone calls from it. Send Notepad there in disguise.

-------------------------------------------------------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\WORDPAD.EXE]
@="c:\\windows\\notepad.exe"
;
-------------------------------------------------------------------

If you want to preserve being able launch Wordpad by typing it in the Run command
and similar, create an .lnk to its executable and put that .lnk in your path (like
in the Windir). That will take precedence in those contexts. And HostsToggle from
what I can see, it won't notice that, still blindly believes the AppPaths lie.

 

[omega]

The values are as you describe them. Nothing odd looking. I wondered if
Jo, woops, it is only now that this sinks in for me: that you said here you'd
already tried changing that key to give a key path pointing to edxor.exe instead
of to notepad.exe. I'd done a sequence of tests, about five, and my result was that
the name notepad was the only one that made HostsToggle misbehave. When you did
it, maybe you had not exited and restarted HostsToggle? Or did not say the right
incantations. You know how illogical computers are; you have to do the exact same
thing X times until that moment where they finally get in the mood to throw out
the result.

More fun than changing that regkey anyway were our other options. Deciding between
burying Wordpad in the backyard, or telling lies about its location.

 

[jo]

You got me thinking about that. And success: I got Hosts Toggle to inflict
that same behavior on me - opening the hosts file in Wordpad. This once I
followed your config and put "notepad.exe" in that key.

HKCR\txtfile\shell\open\command

It honors our entry only when we have a text editor there with its own name.
It has a special prejudice -- against the name notepad. I would believe this
by design. That the author was thinking about the max file size limit of the
MS notepad in W9x.

The thing that now irritates me is that I tried putting Edxor there
under its own name from Program Files. I assume I did it wrong,
somehow... ah well, hardly a first.
Since you said it works for you, i went back and tried again. Success.

Now, whether one then goes and changes one's whole global key there, merely
to appease HostsToggle, or accepts the Wordpad launch, or else if there is
some subtle trick to pull, that's another subject.

I'm happy with the changed key; Edxor loads as fast as Notepad and is
much better.

As now, I am happy that
the mystery is solved.

Me too... and I wouldn't have gone anywhere near trying to solve it if
you hadn't got interested. Thank you.

And I completely retract all my insulting accusations
about your registry being impure with a hidden wordpad association.

How kind. And there was me spending a fruitless hour playing about
with Wordpad entries I found.
Still, I learnt about Regmagik which is a good thing. And I learnt
that my registry editing leaves a bit to be desired, which is another
good thing.

(This is a repost because my post of last night at 23.13 has still not
got to my main or back up newsserver.)

 

[ms]

(e-mail address removed) (News Reader):



I use the Run box.

notepad c:\windows\hosts

Hello Karen, nice to see you posting again.

Mike Sa

 

[Frank Bohan]

Susan Bugher <[email protected]> wrote in message

Is there any way to set up a default editing program for the Hosts
file? I've tried the standard 'Always use this program...' in the
Open With box, but it doesn't hold. I'm guessing it's because there
is no file extension. Any suggestions?

Have a look at HostsToggle:

HostsToggle is a Hosts file management utility, designed to make transitions
between multiple Hosts settings easier. HostsToggle adds a red button to
the
system tray, from which you can enable/disable, load, and backup your Hosts
file.

http://www.accs-net.com/hosts/HostsToggle/

===

Frank Bohan
¶ Illiterate? Write for free help.

 

[jo]

Have a look at HostsToggle:

LOL

Something makes me feel I am in someone's kill file

 

[omega]

The thing that now irritates me is that I tried putting Edxor there
under its own name from Program Files. I assume I did it wrong,
somehow... ah well, hardly a first.
Since you said it works for you, i went back and tried again. Success.

I am gratified that you got stubborn there, and pursued to success. As
to it not working the first time, who knows. I routinely typo some syntax
detail, such as irregular number of quote characters and that sort of
thing, which then forces me to have to review reg and bat things I do.
But for your case of it not working after you first tested the change,
I'm most inclined to ascribe that to how computers can occasionally just
be inexeplicably erratic.

In fact... somewhere in my testing, there was an instant where I recall it
indeed launched Wordpad for no clear reason, despite my having an editor
name other than notepad in the key. I ignored this event, put it out of
my mind, refused to let it compromise my essential conclusion. There were
whatever variables going on right then, anyway, to justify my not worrying
about it, such as my playing around with win.ini entries and some other
things.

And besides, if I only see something weird occur once or as a rare random
event, then I do what I can to /not/ try to figure it out. I once dealt
with a computer that displayed positively Twilight Zone behavior. There
is no way what it did is possible, not in what I understand of this galaxy;
but I swear, I witnessed it. It was a normal old first-generation Pentium,
running w98, and when it rebooted, it continued playing the music CD.
Not only after Windows existed, but even right through all the BIOS beeps
during the restart. Right up to somewhere in the OS loading process.

That's flat-out imposssible, the CD playing all the way through the
shutdown-reboot process. Yet, it happenened. Over the course of the couple
of years where I used that computer (maintained it, for the lazy relative
who owned it), there developed a total of some three separate occasions
where I witnessed that bizarre event occur.

Despite how it sounds, I can only asked to be believed that (1) I don't
have one of those brains which secretes hallucinations, (2) nor suffer
from advanced syphillus, (3) nor was indulging in any drugs. Since what
I witnessed cannot be explained, the only way I found to cope was to pack
it up and ship off to the folks at X-Files.

So, for a reg change not having the logical result one time alone, that is
a small matter to me, when I compare to the trauma I endured during my CD-
player abductions.

 

[omega]

Hello Karen, nice to see you posting again.

Thanks, and hiiya Mike!

(Btw, I hope you are still keeping up the good fight for us, and
periodically emailing authors with the request to make available
no-install downloads.)

 

[Roger Johansson]

That's flat-out imposssible, the CD playing all the way through the
shutdown-reboot process. Yet, it happenened. Over the course of the
couple of years where I used that computer (maintained it, for the lazy
relative who owned it), there developed a total of some three separate
occasions where I witnessed that bizarre event occur.

It has happened to me too, and I know a little about electronics so I
wasn't so surprised.

What happened was simply that the shut-down routines in the operating
system missed doing what they are supposed to do.

The CD-player has supply of power all the time, and the soundcard too, so
there is no problem technically to let it keep on playing through a
reboot.

But there are routines in the operating systems which normally turn off
the CD-Rom unit and reset it, and that stops the music.


Sorry if I destroyed the supernatural quality of the experience for you
with this explanation. I hope you appreciate to find an explanation of
these events instead.

 

[omega]

I'm happy with the changed key; Edxor loads as fast as Notepad and is
much better.

Since it's common for us to put our preferred text editor in the windir
with name notepad.exe (as you had it), makes it best that other developers
have not taken the pre-judgement course that is apparently in effect here.
And, unimportant, but my thought is that HostsToggle's route shouldn't
even be necessary, its automatic call for Wordpad; that is, not even for
systems that do in fact have the MS Notepad in place there and in a w9x
environment. As I remember, the MS Notepad pops up a message on its own
about not being able to handle file size exceeding X kb, while offering
to load it with Wordpad.

This workaround we've arrived at for using HostsToggle, to point to a
different editor name, it's good at least that it does the trick. And
there are no disadvantages.

Even perhaps a couple of small advantages, in having specific text
editor name there. For ex, I change my "txtfile" default handler around
periodically, when I want to provide some new editor with that extended
auditioning opportunity. While I do this, I leave my solid standby
"notepad.exe" binary (Win32pad for me) in the windir, still handling
various other filetypes and roles. In other words, I enjoy allocating
some division of labor, and not have my current notepad.exe alone for
all the various textual filetypes.

I'd say too that having the specific editor entry in the txtfile key
could reduce the immediate impact of experiencing a nasty editor installer
overwriting the notepad binary in the windir. Well, ok, I can remember no
examples of that specifically. (Maybe only because the MS SystemRestore
thingy would often make that futile). Instead where I see hostile takeover
behaviour occur as a pattern, its reg association changes committed by
installers. Well, as far as file overwrite method, do have one story ...

Name of the criminal in this tale is ScriptPad*. This is not a report
about an installer. Those often do lots of bad things. But at least they
only do them once. How a program behaves each time it is launched, that
is the serious matter. ScriptPad, on any run, it does a couple of small
nasties, and then one major one. First, it always forcibly copies an lnk
to itself into the sendto folder. Second, it writes an entry into the
registry trying to demand to be put in an htm openwith list. Now, the
biggy. Whenever it is launched, it automatically copies its huge 1250kb
corps into the sysdir. When it does this, it names that file notepad.exe.

Since the order of path lookup is such that sysdir is first, before windir,
the consequence is that ScriptPad immediately takes over everything where
"notepad.exe" is associated and/or called.

In an area where you see a lot of megalomania already, editors who pull
tricks to try to seize take-over of Notepad's position, ScriptPad surely
wins top prize, in its audacity.

 

[omega]

It has happened to me too, and I know a little about electronics so I
wasn't so surprised.

What happened was simply that the shut-down routines in the operating
system missed doing what they are supposed to do.

The CD-player has supply of power all the time, and the soundcard too, so
there is no problem technically to let it keep on playing through a
reboot.

But there are routines in the operating systems which normally turn off
the CD-Rom unit and reset it, and that stops the music.


Sorry if I destroyed the supernatural quality of the experience for you
with this explanation. I hope you appreciate to find an explanation of
these events instead.

I'm sorry, too. Next time I am at the beautician's, and everyone else is
swapping ghost stories, what will I have left, so that I can fit in?

I cannot say I understand, really. I mean, I did once read on subject re
the power supply being on even when you'd hit "off" on your computer...
But, as to the CD sound, well, part of the stumper for me, it's that
I'd always assumed that the soundcard does nothing without drivers, and
those drivers, they are loaded by the OS...

Since you know something of electronics (where I do not), I will accept
your authority that the occurence was in fact within the laws of things,
instead of inexplainable. Means that finally, after these years of that
baffling me, I can now stop worrying my pretty little head over it.

(Now I'm left only with my replace problem,, how to get along at the
beautician's. At last resort, I guess I could hack it maybe, say brush
up on reading about some Elvis sightings before next visit. Those folks
seemed to get a little unhappy when I used the word computer, anyway.)