Stan Brown <
the_stan_brown@fastmail.fm> wrote:
Thanks to those who responded, but from the responses I
see I must not have made the problem clear.
The problem is that occasionally, when I double-click a
file, or some type that has an associated program,
Windows 10 pops up a "How do you want to open this
file?" dialog for no apparent reason. My existing
associated program is highlighted, below that are
several other choices including Windows Store, and
below them is a check box for "Always open with this
program" (quoted from memory, so probably not the exact
words). I tick "Always" and click OK. Double-clicking
that file works just fine again, until some days or
weeks later I get that annoying pop-up again.
That is the issue: that gratuitous pop-up. It's not
just Irfanview and Excel; I gave those as examples.
(The point of the Excel example is that I think it
shows this isn't just Microsoft trying to nag me to
switch to their software from a third-party
application.) And my file association is not lost,
because Windows 10 always highlights the program I had
previously chosen. It's as though Windows is trying to
get me to change file associations, for some reason I
can't fathom.
I don't need help with setting file associations; I
need help in stopping this stupid pop-up.
(Cause might be due to filetype protection mentioned at the end of this
post which I mentioned earlier. Check that part first. If not the
cause, read the rest.)
Since the choice popup doesn't always occur, wait until it does show up.
Don't select always. Close the popup (abort the file open), and go look
in Default Apps to see the filetype associations. When the popup
appears, check if there is an association for that filetype. I'm
wondering if the choice popup appears because, at that moment, there is
no association versus a bogus popup when the association is defined at
that moment.
You supposedly keep resetting the filetype association when the popup
appears, so there's no way to then check if the association was actually defined at that moment. Maybe it wasn't defined at that moment, you
redefine it, so looking later just has you see what you selected in the
popup. When the popup appears, is that filetype association defined at
that moment?
At the moment the popup appears, if the association is missing then
something is deleting it. Could be another program you run that
attempts to create or change the association. Peter mentioned PaintShop
Pro being rude in trying to change associations to point to itself.
RealPlayer had that rude behavior for a long time: everytime you loaded RealPlayer, it modified the filetype associations.
I wish I could remember the product, but there was a security program
that would alert you when filetype associations got changed. I forget
why I quit using it. As I recall, it generated too many alerts, and
some were bogus in that it was supposed to alert when there was a
filetype change, but seemed to pend up the alerts until the next time it
was loaded (as a startup program) whereupon I'd get a ton of alerts.
Some were no longer valid by then. The free version polled for the
changes. I think the minimum polling interval was 1 minute. The
payware version ran in the background to constantly monitor for changes,
so something couldn't make a change, do something, and change back
before the 1-minute polling interval. I just cannot remember the name
of this product, but it was popular in its heyday.
Ooh, update. While hunting around for registry monitor tools, I came
across an article that mentioned the old one I used: WinPatrol (by
Bill P).
https://www.bleepingcomputer.com/download/winpatrol/
Says last updated in 2018. As I recall, because of the pending
alerts with the free version, I quit using it a few years before
that. I think I saw in some forums that it had been discontinued,
and my pleas to fix the pending alerts was ignored, so I quit using
it. Bill P had a dodgy reputation, because he had been a prior black
hat hacker who decided to go legit, and use his expertise to make
money the honest way by selling his software. Bill P sold off
WinPatrol to Bret Lowry. The winpatrol.com web site got changed to
Ruiware owned by Bret who decided not to move forward with the
Bill's programs, dropped them, and killed the Ruiware web site.
https://www.corporationwiki.com/p/2f45j6/bret-lowry
Since the Ruiware web site disappeared, if you want to try
WinPatrol you'll need to find it at some download site, like:
https://www.softpedia.com/dyn-search.php?search_term=winpatrol
However, if you can't find the payware version (for free) then you'll
probably incur the pending alerts problem that I encounted in the
freeware version. Unlike other security tools, like anti-virus
software, WinPatrol never relied on signatures. It monitored
untoward events, like filetype association changes.
With SysInternals ProcMon (Process Monitor), you can define a filter
that would look for changes under the HKEY_CLASSES_ROOT key, and
specifically on the .ext subkey that you're noticing the filetype
association is getting lost. However, ProcMon records *all* events.
Adding a filter to watch some level of registry change is just changing
the view you see of which events you want to monitor. All events are
still getting monitored, and the log can get quite large. So large, in
fact, that Windows will slow down, and eventually slow to a crawl that
you'd think Windows had hung. Periodically you need to stop the logging
in ProcMon, clear its log, and restarting logging. I've not done
registry monitoring using ProcMon, and, from what I see of defining
event filters in it, you can select registry operations, like RegOpen,
but not select a particular key to view events on it, or its subkeys.
Maybe someone else knows how to use ProcMon to filter its event logs to
show change (create, rename, change data item value) on a particular
registry key.
I remember looking briefly at Process Hacker, but I can't tell you if it
will monitor registry change events. My recollection is it was more an alternative of SysInternals Process Explorer (which I use occasionally,
and enabled its lookup on processes at VirusTotal to see if a process
might be suspicious).
https://sourceforge.net/projects/processhacker/
I've heard of, but never used, Registry Live Watch. However, it is old
(last update was 2009, and not tested as of Windows 8, and beyond). It
is supposed to monitor a user-defined registry key for changes, and any
changes to its subkeys.
http://leelusoft.altervista.org/registry-live-watch.html
However, depending on how long it takes for the filetype association to disappear (causing the choice popup), you might get nuisanced with the
GUI for this tool for a long time. Perhaps it can be minimized, but I
don't know if it will restore its window, or show a popup, when it
detects the monitored registry key got changed.
https://www.majorgeeks.com/files/details/registry_live_watch.html
That says Registry Live works on Windows XP to 10, but the product site
says there has been no testing on Windows 8, or higher. MajorGeeks says
it ran okay under Windows 10.
Another I've heard of, but not use, is MJ Registry Watcher found at:
https://jacobsm.com/mjsoft.htm#rgwtchr
_Windows 10 filetype association protection "feature"_
Hmm, here's something interesting about how Windows 10 itself will reset filetype associations should it discover an incompatible program is
making registry changes to effect filetype association changes. I
alluded to that earlier where I mention not to have the program try to
edit the registry to define filetype associations, but instead use the
Default Apps wizard in Windows 10. Some filetypes are protected, and
those use an OS-generated hash to store with the filetype association.
Programs don't know and cannot generate the hash.
https://www.winhelponline.com/blog/windows-10-resetting-file-associations/
Perhaps you are trying to get a program to change filetype associations,
those are protected, so Windows 10 disallows the change, and resets it.
I forget the app, but it had an option to change a filetype to use that
program as the handler. No matter how many times you tried to set that
option, it never stuck. You had to go into the Default Apps wizard to
set the filetype association which also added the correct hash value to
the registry key. Eventually the offending app changed its behavior.
Instead of it trying to modify the filetype association, it merely
opened the Default Apps wizard where you had to navigate the wizard to
set the filetype association to that program.
The article says I will see an "App default was reset" notification, but
I don't recall ever seeing that popup or toast notification when a
program tried to directly edit the registry to change a filetype
association. Not all filetypes are protected with the OS-generated
hash. Only some of the major ones incorporate the hash protection.
Could be some program you want is rudely attempting to change a filetype association by editing the registry, but it won't add the UserChoice key
nor will it know how to generate a valid hash code. Could the program automatically attempts to make the registry change when you load it, or
you are going into its settings to attempt changing the filetype
association. Nope, programs are no longer allowed to make changes on
protected registry settings. This was to thwart malware that attempts
to fuck up the system with various registry settings. Filetype
associations (some of them) are considered protected now in Windows 10.
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)