My Windows 10 OS was just almost ruined by a glitch on registry file association. The cause...

I tried to view some compressed vector images SVGZ format. When the "open with" dialog window was shown, I chose Google Chrome and checked "Always use this program". Then I suddenly noticed that all the SVGZ and exe file icons change to Google Chrome icon.

Then, whenever I ran an exe file, Google Chrome pops up and asks me to download that EXE. I even couldn't run any program from Win+R window or from command prompt because that will also open Google Chrome instead. Luckily I had a PowerShell window still opened and ran "reg query" to check out the problem regedit won't work because that will pop up Chrome, but reg worked, I guess because of the argument attached?.

Turns out the default value for HKEY_CLASSES_ROOT\.exe was mistakenly changed from "exefile" to "svgz_auto_file". Changing it back by running reg add HKCR\.exe /ve /d "exefile" and restarting the explorer solved the problem I was glad it worked, otherwise I couldn't even start explorer anymore.

It just blowed my mind how Windows can mistake SVGZ to EXE. These two just look in no way similar at all. Another thing that annoys me is that M$ blocked editing of many keys by assining TrustedInstaller the ownership of those keys, but left something as crucial as HKEY_CLASSES_ROOT\.exe open.

Although I am also partially responsible for this mess because I added full permission for this key to myself, a quick check on my workplace computer shows that by default Administrator also has full permission on this key.

This means basically you can just send anyone a malicious REG file which alters HKEY_CLASSES_ROOT\.exe key and if they were tricked to merge the REG file the action requires UAC popup and elevation to Administrator anyway it can instantely cripple their system.

Weiterlesen...