Author Topic: oddity in the File Types monitor  (Read 13799 times)

0 Members and 1 Guest are viewing this topic.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
oddity in the File Types monitor
« on: November 06, 2013, 10:09:50 AM »
Here's an oddity.

WinPatrol is not monitoring the RTF file type. Also, .RTF is not listed in WinPatrol's "File Types" tab (see the attached image). Also, .RTF is not listed in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

However, attempts to add .RTF on the "File Types" tab fail, eliciting the message "This file type is already being monitored."

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 20768
  • "Stronger than the past, united in our goal."
    • View Profile
    • Security Garden
Re: oddity in the File Types monitor
« Reply #1 on: November 06, 2013, 12:52:02 PM »
Hi, ancient1.

WinPatrol is monitoring .RTF files.  Do you have the most recent install of WinPatrol (29.0.2013)?


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #2 on: November 06, 2013, 01:30:03 PM »
Hi, ancient1.

WinPatrol is monitoring .RTF files.  Do you have the most recent install of WinPatrol (29.0.2013)?

No, it's not.

Yes, I have 29.0.2013.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #3 on: November 06, 2013, 02:10:15 PM »
This issue comes up whenever a particular piece of software, LibreOffice, gets updated. It usurps the .RTF file name extension, even when you tell the installer not to. It would be nice to have WinPatrol monitor the RTF file type, but, as stated, it does not. One always has to go through Windows Default Programs and switch back manually.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 20768
  • "Stronger than the past, united in our goal."
    • View Profile
    • Security Garden
Re: oddity in the File Types monitor
« Reply #4 on: November 06, 2013, 05:02:39 PM »
Hi, ancient1.

Did you look at the image I attached to my previous post?  It showed RTF highlighted as a file type being monitored.  In addition, please also note the screen capture attached to this post which indeed lists RTF in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

Let's see if you may have changed a setting along the way. 

Please launch WinPatrol an click on the Options Tab.  From there, click "Hide Alert Messages".  Make sure that you do NOT have "File Type Associations" checked under the "Always Allow Changes" column.   


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #5 on: November 06, 2013, 05:14:27 PM »
Hi, ancient1.

Did you look at the image I attached to my previous post?  It showed RTF highlighted as a file type being monitored.  In addition, please also note the screen capture attached to this post which indeed lists RTF in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

Let's see if you may have changed a setting along the way. 

Please launch WinPatrol an click on the Options Tab.  From there, click "Hide Alert Messages".  Make sure that you do NOT have "File Type Associations" checked under the "Always Allow Changes" column.

Did you look at the image I attached? Please explain how screen grabs from you computer pertain to my computer.

The option you mention is not checked.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #6 on: November 06, 2013, 06:39:19 PM »
This will be my final post on this topic.

To recap the original post:

1. RTF is not listed in WinPatrol's "File Types" tab (please see the attached image). Nor is it listed in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext (please see the attached image). Nor is WinPatrol alerting on changes to associations for the .RTF extension. (The fact that these things are not true for someone else's setup is nice...for that person.)

2. All attempts to add RTF using the Add button on the File Types tab fail, eliciting the message "This file type is already being monitored."

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 20768
  • "Stronger than the past, united in our goal."
    • View Profile
    • Security Garden
Re: oddity in the File Types monitor
« Reply #7 on: November 06, 2013, 10:35:37 PM »
I'm sorry for the misunderstanding, ancient1.  I was under the impression that you were reporting that in general RTF is not correctly included in the WinPatrol program which is why I provided the images.

This issue comes up whenever a particular piece of software, LibreOffice, gets updated. It usurps the .RTF file name extension, even when you tell the installer not to. It would be nice to have WinPatrol monitor the RTF file type, but, as stated, it does not. One always has to go through Windows Default Programs and switch back manually.

After you have restored RTF via Windows Default Programs to winword.exe from whatever LibreOffice has changed it to have you tried checking the box on the Options tab to "Lock File Types"?  Does it show in WinPatrol as being listed then?  The only thing I'm seeing LibreOffice associated with is .XLS files.




Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #8 on: November 07, 2013, 12:45:40 PM »
Quote
I'm sorry for the misunderstanding, ancient1.
OK.

Quote
After you have restored RTF via Windows Default Programs to winword.exe from whatever LibreOffice has changed it to have you tried checking the box on the Options tab to "Lock File Types"?
No. But I did so now and rebooted.

Quote
Does it show in WinPatrol as being listed then?
No. RTF is still not listed on WinPatrol's "File Types" tab and still cannot be added.

Quote
The only thing I'm seeing LibreOffice associated with is .XLS files.
56 file types are currently associated with LibreOffice in my setup. WinPatrol monitors one of those (.XLS).

I reverted "Lock File Types" to unchecked.

Experimentally, I added a file type that was not being monitored, via the Add button, and rebooted. The result: (1) That file type is not listed in the "File Types" tab, nor in WinPatrol Log / File Types, nor in the Ext registry key. (2) Attempting to add that file type via the Add button now results in the familiar error message "This file type is already being monitored." (3) WinPatrol is not alerting to changes in associations for that file type. The experiment was repeated with a second file type. Same outcome.

File types monitoring is enabled.

As many as 3 separate sources of data are involved here: the one that populates the File Types tab, the one that determines which file types are actually monitored, and the one consulted by the Add routine. Obviously, at least one of these sources is out of sync with the others.

Probably the next order of business is an extreme clean install of WinPatrol. That would be a weekend project.

WinPatrol 29.0.2013.0
Windows 7 Home Premium 64-bit SP1, English (Canada)

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 20768
  • "Stronger than the past, united in our goal."
    • View Profile
    • Security Garden
Re: oddity in the File Types monitor
« Reply #9 on: November 07, 2013, 02:14:58 PM »
Hi, ancient1.

If you do decide to go with a clean install of WinPatrol, be sure to note your PLUS code first.  You may want to use the WinPatrol Removal Tool, available from this page:  http://www.winpatrol.com/download.html

In the meantime, I'll point Bill to this thread since he may have seen this type of issue before.


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline ancient1

  • Jr. Member
  • **
  • Posts: 21
    • View Profile
Re: oddity in the File Types monitor
« Reply #10 on: November 09, 2013, 11:55:35 AM »
Update:

Removed WinPatrol completely using the Control Panel uninstaller, then the WinPatrol removal tool, then CCleaner's registry tool (nothing found), and finally a manual inspection of Program Files, Program Files (x86), AppData, and the Windows registry (nothing found).

Installed WinPatrol.

"File Types" is still FUBAR.




------------------------------------

Windows 7 Home Premium x64 Service Pack 1, English (Canada)
--
ASUS Desktop PC CM6630 Series
Intel(R) Core(TM) i5-2310 CPU @ 2.90GHz
RAM 6.00 GB
BIOS American Megatrends, v0419
Intel HD Graphica 1000 (GT1)
--
avast Free Antivirus 2014
Windows Firewall
WinPatrol PLUS 29.0.2013.0

Offline ky331

  • LzD Friends
  • Hero Member
  • *****
  • Posts: 703
    • View Profile
Re: oddity in the File Types monitor
« Reply #11 on: November 09, 2013, 10:00:25 PM »
Corrine,

I'm experiencing the same issue as ancient1 with WinPatrol 29.0.2013 on Win7x64 Pro SP1... but if I'm not mistaken, this issue has been present under previous versions of WinPatrol as well.   File Types have long been locked on this machine.  In my case, I have installed Apache OpenOffice 4 [rather than LibreOffice], as well as retaining Microsoft Word.   To mention/compare just two of the filetypes of which I've taken note:

a) .DOC does not appear in my WinPatrol under File Types (yet like ancient1, if I try to add it, Scotty tells me that "This file type is already being monitored"); while .RTF files are listed/monitored, and are associated with OpenOffice's SWriter.

b) Looking in the registry under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext, there IS an entry for .DOC, with data OOBE.Document, and also an entry for .RTF, with data rtffile.

c) But in Control Panel, Default Programs, Associate a file type or protocol with a specific program, I have .doc associated with Microsoft Word for Windows, and .rtf with WordPad.

When I click on a file to open it, the (c) Control Panel defaults are followed, rather than what WinPatrol shows [or omits].

Hoping BillP might find this (additional information) helpful.

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 20768
  • "Stronger than the past, united in our goal."
    • View Profile
    • Security Garden
Re: oddity in the File Types monitor
« Reply #12 on: November 10, 2013, 12:09:03 AM »
Thank you for the additional information, ky331.  I believe Bill has had appointments and was attending a couple of events so hasn't responded to my email.  However, I pointed the Facebook WinPatrol group to this thread, hoping others may report a similar problem to add to the documentation. 


Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline ky331

  • LzD Friends
  • Hero Member
  • *****
  • Posts: 703
    • View Profile
Re: oddity in the File Types monitor
« Reply #13 on: November 10, 2013, 01:45:32 AM »
Here's more information... which I believe may help shed some light on the issue:

On my 32-bit WinXP Pro SP3 system, I'm (still) running (the older) Apache OpenOffice 3 (3.4.1) in addition to Microsoft Word.   

a) On this system, .DOC appears TWICE in my WinPatrol under File Types:  once with title "Microsoft Word 97-2003 Document", opening with OpenOffice's SWriter, with "type" listed as "System"; the second instance with title "Microsoft Word Document", opening with WinWord, with "type" = "Explorer".
Likewise, .RTF appears TWICE:  once opening with OpenOffice's SWriter (Type=System), the second one opening with WordPad (Type=Explorer).

b) Looking in the registry under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext, there is an entry for .DOC, this time with data WordPad.Document.1 [and, as was the case for my Win7 system, an entry for .RTF, with data rtffile ].
But on this 32-bit XP system, there are two additional registry entries under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\ExtProgID :
One for .DOC, with data Word.Document.8, and one for .RTF with data rtffile.
Presumably, these explain the two "Explorer"-type entries I cited above.

c) In Control Panel, Folder Options, File Types, I have DOC associated with Microsoft Word  for Windows, and RTF with WordPad --- agreeing with the two entries that WinPatrol classified as type = "Explorer" --- and again, these are the programs that open with I click on the associated file.

I'll conclude by noting the differences here:   Operating system (XP vs. 7; and 32-bit vs. 64), and alternate software (OO3 vs. OO4).   I'm assuming one of the O/S differences [its type and/or architecture] is contributing to what's happening.

Offline BillPStudios

  • Visiting Experts
  • Full Member
  • *****
  • Posts: 70
    • View Profile
    • WinPatrol
Re: oddity in the File Types monitor
« Reply #14 on: November 10, 2013, 03:17:40 AM »
I would really like to thank everyone for taking the time to research what well described as an "oddity". There is obviously a bug in the core of the File Type monitoring code.  As I read though I though about a few possibilities including could some other program be removing RTF from the WinPatrol list? Considering the program still makes the change when you chose not to use RTF's it might be suspicious. Naturally, I'd be surprised by any program going out of their way to mess with WinPatrol.
Based on your details, that isn't happening.

I also thought about the fact Windows actually has 2 to 3 different locations for file associations.  There is a regular file association registry, there is the Class registry hive that allows you to associate a file with an extensions and there is even a special registry key that is used just by Explorer.  That still doesn't seem to be the main problem.

 :thud:
The key issue for me is the mystery of the missing .RTF listing. I so love screen shots and your samples show that there is something very wrong and it has been confirmed by ky331.
It doesn't make sense that RTF does not show up in the list but when you try to add it Scotty says it's already in the list.  There aren't any extensions hard coded. By design WinPatrol will look at the registry folder you displayed. That is the same list I check when you try to add a new file type.

The next version of WinPatrol will have a fix that resolves this mystery. I really should be going to bed but I don't think I can sleep until I try and figure out how this could happen.

Again, thank you Ancient1 for having the patience and for taking the time to explain this so well. Thanks also to Corinne :rose: for trying to make sense of it and urging me to stop by. And even Ky331 for making me confident this isn't just a fluke. I haven't had any other reports like this so if not for the details here I may not have given it the attention it deserves.

I'm sure if I can track down why RTF isn't showing up, it will also explain why WinPatrol isn't blocking LibreOffice from making its change.

Thanks again,
Bill