LandzDown Forum

Security => Security Software Programs => Topic started by: ancient1 on November 06, 2013, 10:09:50 AM

Title: oddity in the File Types monitor
Post by: ancient1 on November 06, 2013, 10:09:50 AM
Here's an oddity.

WinPatrol is not monitoring the RTF file type. Also, .RTF is not listed in WinPatrol's "File Types" tab (see the attached image). Also, .RTF is not listed in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

However, attempts to add .RTF on the "File Types" tab fail, eliciting the message "This file type is already being monitored."
Title: Re: oddity in the File Types monitor
Post by: Corrine on November 06, 2013, 12:52:02 PM
Hi, ancient1.

WinPatrol is monitoring .RTF files.  Do you have the most recent install of WinPatrol (29.0.2013)?
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 06, 2013, 01:30:03 PM
Hi, ancient1.

WinPatrol is monitoring .RTF files.  Do you have the most recent install of WinPatrol (29.0.2013)?

No, it's not.

Yes, I have 29.0.2013.
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 06, 2013, 02:10:15 PM
This issue comes up whenever a particular piece of software, LibreOffice, gets updated. It usurps the .RTF file name extension, even when you tell the installer not to. It would be nice to have WinPatrol monitor the RTF file type, but, as stated, it does not. One always has to go through Windows Default Programs and switch back manually.
Title: Re: oddity in the File Types monitor
Post by: Corrine on November 06, 2013, 05:02:39 PM
Hi, ancient1.

Did you look at the image I attached to my previous post?  It showed RTF highlighted as a file type being monitored.  In addition, please also note the screen capture attached to this post which indeed lists RTF in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

Let's see if you may have changed a setting along the way. 

Please launch WinPatrol an click on the Options Tab.  From there, click "Hide Alert Messages".  Make sure that you do NOT have "File Type Associations" checked under the "Always Allow Changes" column.   
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 06, 2013, 05:14:27 PM
Hi, ancient1.

Did you look at the image I attached to my previous post?  It showed RTF highlighted as a file type being monitored.  In addition, please also note the screen capture attached to this post which indeed lists RTF in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext.

Let's see if you may have changed a setting along the way. 

Please launch WinPatrol an click on the Options Tab.  From there, click "Hide Alert Messages".  Make sure that you do NOT have "File Type Associations" checked under the "Always Allow Changes" column.

Did you look at the image I attached? Please explain how screen grabs from you computer pertain to my computer.

The option you mention is not checked.
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 06, 2013, 06:39:19 PM
This will be my final post on this topic.

To recap the original post:

1. RTF is not listed in WinPatrol's "File Types" tab (please see the attached image). Nor is it listed in HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext (please see the attached image). Nor is WinPatrol alerting on changes to associations for the .RTF extension. (The fact that these things are not true for someone else's setup is nice...for that person.)

2. All attempts to add RTF using the Add button on the File Types tab fail, eliciting the message "This file type is already being monitored."
Title: Re: oddity in the File Types monitor
Post by: Corrine on November 06, 2013, 10:35:37 PM
I'm sorry for the misunderstanding, ancient1.  I was under the impression that you were reporting that in general RTF is not correctly included in the WinPatrol program which is why I provided the images.

This issue comes up whenever a particular piece of software, LibreOffice, gets updated. It usurps the .RTF file name extension, even when you tell the installer not to. It would be nice to have WinPatrol monitor the RTF file type, but, as stated, it does not. One always has to go through Windows Default Programs and switch back manually.

After you have restored RTF via Windows Default Programs to winword.exe from whatever LibreOffice has changed it to have you tried checking the box on the Options tab to "Lock File Types"?  Does it show in WinPatrol as being listed then?  The only thing I'm seeing LibreOffice associated with is .XLS files.


Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 07, 2013, 12:45:40 PM
Quote
I'm sorry for the misunderstanding, ancient1.
OK.

Quote
After you have restored RTF via Windows Default Programs to winword.exe from whatever LibreOffice has changed it to have you tried checking the box on the Options tab to "Lock File Types"?
No. But I did so now and rebooted.

Quote
Does it show in WinPatrol as being listed then?
No. RTF is still not listed on WinPatrol's "File Types" tab and still cannot be added.

Quote
The only thing I'm seeing LibreOffice associated with is .XLS files.
56 file types are currently associated with LibreOffice in my setup. WinPatrol monitors one of those (.XLS).

I reverted "Lock File Types" to unchecked.

Experimentally, I added a file type that was not being monitored, via the Add button, and rebooted. The result: (1) That file type is not listed in the "File Types" tab, nor in WinPatrol Log / File Types, nor in the Ext registry key. (2) Attempting to add that file type via the Add button now results in the familiar error message "This file type is already being monitored." (3) WinPatrol is not alerting to changes in associations for that file type. The experiment was repeated with a second file type. Same outcome.

File types monitoring is enabled.

As many as 3 separate sources of data are involved here: the one that populates the File Types tab, the one that determines which file types are actually monitored, and the one consulted by the Add routine. Obviously, at least one of these sources is out of sync with the others.

Probably the next order of business is an extreme clean install of WinPatrol. That would be a weekend project.

WinPatrol 29.0.2013.0
Windows 7 Home Premium 64-bit SP1, English (Canada)
Title: Re: oddity in the File Types monitor
Post by: Corrine on November 07, 2013, 02:14:58 PM
Hi, ancient1.

If you do decide to go with a clean install of WinPatrol, be sure to note your PLUS code first.  You may want to use the WinPatrol Removal Tool, available from this page:  http://www.winpatrol.com/download.html

In the meantime, I'll point Bill to this thread since he may have seen this type of issue before.
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 09, 2013, 11:55:35 AM
Update:

Removed WinPatrol completely using the Control Panel uninstaller, then the WinPatrol removal tool, then CCleaner's registry tool (nothing found), and finally a manual inspection of Program Files, Program Files (x86), AppData, and the Windows registry (nothing found).

Installed WinPatrol.

"File Types" is still FUBAR.




------------------------------------

Windows 7 Home Premium x64 Service Pack 1, English (Canada)
--
ASUS Desktop PC CM6630 Series
Intel(R) Core(TM) i5-2310 CPU @ 2.90GHz
RAM 6.00 GB
BIOS American Megatrends, v0419
Intel HD Graphica 1000 (GT1)
--
avast Free Antivirus 2014
Windows Firewall
WinPatrol PLUS 29.0.2013.0
Title: Re: oddity in the File Types monitor
Post by: ky331 on November 09, 2013, 10:00:25 PM
Corrine,

I'm experiencing the same issue as ancient1 with WinPatrol 29.0.2013 on Win7x64 Pro SP1... but if I'm not mistaken, this issue has been present under previous versions of WinPatrol as well.   File Types have long been locked on this machine.  In my case, I have installed Apache OpenOffice 4 [rather than LibreOffice], as well as retaining Microsoft Word.   To mention/compare just two of the filetypes of which I've taken note:

a) .DOC does not appear in my WinPatrol under File Types (yet like ancient1, if I try to add it, Scotty tells me that "This file type is already being monitored"); while .RTF files are listed/monitored, and are associated with OpenOffice's SWriter.

b) Looking in the registry under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext, there IS an entry for .DOC, with data OOBE.Document, and also an entry for .RTF, with data rtffile.

c) But in Control Panel, Default Programs, Associate a file type or protocol with a specific program, I have .doc associated with Microsoft Word for Windows, and .rtf with WordPad.

When I click on a file to open it, the (c) Control Panel defaults are followed, rather than what WinPatrol shows [or omits].

Hoping BillP might find this (additional information) helpful.
Title: Re: oddity in the File Types monitor
Post by: Corrine on November 10, 2013, 12:09:03 AM
Thank you for the additional information, ky331.  I believe Bill has had appointments and was attending a couple of events so hasn't responded to my email.  However, I pointed the Facebook WinPatrol group to this thread, hoping others may report a similar problem to add to the documentation. 
Title: Re: oddity in the File Types monitor
Post by: ky331 on November 10, 2013, 01:45:32 AM
Here's more information... which I believe may help shed some light on the issue:

On my 32-bit WinXP Pro SP3 system, I'm (still) running (the older) Apache OpenOffice 3 (3.4.1) in addition to Microsoft Word.   

a) On this system, .DOC appears TWICE in my WinPatrol under File Types:  once with title "Microsoft Word 97-2003 Document", opening with OpenOffice's SWriter, with "type" listed as "System"; the second instance with title "Microsoft Word Document", opening with WinWord, with "type" = "Explorer".
Likewise, .RTF appears TWICE:  once opening with OpenOffice's SWriter (Type=System), the second one opening with WordPad (Type=Explorer).

b) Looking in the registry under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Ext, there is an entry for .DOC, this time with data WordPad.Document.1 [and, as was the case for my Win7 system, an entry for .RTF, with data rtffile ].
But on this 32-bit XP system, there are two additional registry entries under HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\ExtProgID :
One for .DOC, with data Word.Document.8, and one for .RTF with data rtffile.
Presumably, these explain the two "Explorer"-type entries I cited above.

c) In Control Panel, Folder Options, File Types, I have DOC associated with Microsoft Word  for Windows, and RTF with WordPad --- agreeing with the two entries that WinPatrol classified as type = "Explorer" --- and again, these are the programs that open with I click on the associated file.

I'll conclude by noting the differences here:   Operating system (XP vs. 7; and 32-bit vs. 64), and alternate software (OO3 vs. OO4).   I'm assuming one of the O/S differences [its type and/or architecture] is contributing to what's happening.
Title: Re: oddity in the File Types monitor
Post by: BillPStudios on November 10, 2013, 03:17:40 AM
I would really like to thank everyone for taking the time to research what well described as an "oddity". There is obviously a bug in the core of the File Type monitoring code.  As I read though I though about a few possibilities including could some other program be removing RTF from the WinPatrol list? Considering the program still makes the change when you chose not to use RTF's it might be suspicious. Naturally, I'd be surprised by any program going out of their way to mess with WinPatrol.
Based on your details, that isn't happening.

I also thought about the fact Windows actually has 2 to 3 different locations for file associations.  There is a regular file association registry, there is the Class registry hive that allows you to associate a file with an extensions and there is even a special registry key that is used just by Explorer.  That still doesn't seem to be the main problem.

 :thud:
The key issue for me is the mystery of the missing .RTF listing. I so love screen shots and your samples show that there is something very wrong and it has been confirmed by ky331.
It doesn't make sense that RTF does not show up in the list but when you try to add it Scotty says it's already in the list.  There aren't any extensions hard coded. By design WinPatrol will look at the registry folder you displayed. That is the same list I check when you try to add a new file type.

The next version of WinPatrol will have a fix that resolves this mystery. I really should be going to bed but I don't think I can sleep until I try and figure out how this could happen.

Again, thank you Ancient1 for having the patience and for taking the time to explain this so well. Thanks also to Corinne :rose: for trying to make sense of it and urging me to stop by. And even Ky331 for making me confident this isn't just a fluke. I haven't had any other reports like this so if not for the details here I may not have given it the attention it deserves.

I'm sure if I can track down why RTF isn't showing up, it will also explain why WinPatrol isn't blocking LibreOffice from making its change.

Thanks again,
Bill
Title: Re: oddity in the File Types monitor
Post by: BillPStudios on November 10, 2013, 03:19:24 PM
Yea, I couldn't rest until I was able to look and figure out where the main failure is occurring.
I still need to find out why I'm not in sync but I can confirm that the list used in the display of file types is obtained in the followinf registry key

HKEY_CURRENT_USER\Software\BillP Studios\WinPatrol\Class

The default value will typically appear as the file extensions separated by a semi-colon.

AVI;BAT;CAB;CAT;CHM;COM;CMD;CSS;DOC;EML;EXE;INF;JS;LOG;MSI;MSG;MID;MP3;PIF;RAM;REG;RTF;SBS;SCR;TXT;URL;VBS;VBE;WSF;WSH;XLS;

RTF should be included by default but if it was somehow removed it could screw things up.  I still have some research to do but I was able to confirm this string is used in the display of file types which are shown on our list as being monitored.

( I guess I was tired because I just noticed I wrote this last night and it was still unsent on my screen this afternoon.  ) :laughing:

Thanks,
Bill
Title: Re: oddity in the File Types monitor
Post by: ancient1 on November 11, 2013, 12:37:30 PM
ky331, you mentioned a mismatch in the "Command" column in the "File Types" tab. In my case, WinPatrol lists the command for .TXT files as NOTEPAD.EXE. That is a mismatch. The program that opens .TXT files has long been NoteTab Pro, not Notepad. Just now I switched it to Notepad++, then back again to NoteTab Pro. Scotty slept through it all.

I have now checked two other computers: someone else's Windows 7 Home Premium x64 SP1 machine, running WinPatrol 28 (not 29) Free; and a Windows 8 Pro x64 desktop on which I installed WinPatrol 29 Free. In the former, WinPatrol exhibits the RTF issue. In the latter, it does not.
Title: Re: oddity in the File Types monitor
Post by: ky331 on November 11, 2013, 01:22:25 PM
Thanks, ancient1.   The more "clues" to this puzzle, the easier it should be for BillP to solve it.
Title: Re: oddity in the File Types monitor
Post by: ancient1 on August 18, 2014, 04:53:28 PM
This problem maybe affects just a tiny minority of users, so I am not complaining here, just reporting. The situation is unchanged as of WinPatrol 2014 v 32.0.2014.5. WinPatrol's "File Types" is still broken and dysfunctional for some of us.
Title: Re: oddity in the File Types monitor
Post by: ky331 on August 18, 2014, 06:32:15 PM
ancient1,

As you may (or may not) be aware, BillP/family had some health issues, and ultimately decided to transfer control of WinPatrol to another party.

Hopefully the new owner, Bret, will... at his earliest convenience... check out what's happening [or not] in this thread.
Title: Re: oddity in the File Types monitor
Post by: Corrine on August 19, 2014, 01:24:40 AM
I gave Bret a head's up to let him know that this is still a problem.  He'll be taking a look at it and checking the records and with Bill to see if it is a one-off or something a large number of users are running into.
Title: Re: oddity in the File Types monitor
Post by: Bret Lowry on August 19, 2014, 11:06:00 AM
Hi,

Corrine brought this thread to my attention. This is the first I've heard of this issue. At first I thought, I see RTF on my computer, so maybe it will be as simple as upgrading to V32. But, as I read on, I realized that is not the case.
I'm going to read through the thread again more closely and see if I can get a test machine to exhibit this behavior. It is always easier to fix something if you can get a repro.

I apologize about the problems with file types and will be working to discover what is happening. I will also be monitoring this thread, so if you find any additional information, please do not hesitate to post. From what I've seen and read in Bill's response to the initial posting, the posts are very thorough in describing what is happening. That should help.

Thanks,
Bret.
Title: Re: oddity in the File Types monitor
Post by: LilBambi on August 20, 2014, 03:54:25 PM
Sometimes you really need a removal program to fix whatever went wrong or got corrupted somehow.

Someone recently got Malwarebytes Anti-Malware from an untrusted source. I removed it fine, and tried to install the real one from malwarebytes.org and got errors all over the place. I got the removal tool from Malwarebytes.org (via the link in their forums), and then installed Malwarebytes Anti-Malware fine and it is working great. Between it and the other tools, I was able to clean the computer up and the owner is very happy. But I could not have done it without that uninstaller. Same has been true with many AV programs.

Might want to give it (winpatrolremove.exe ) a try (from Corrine's link).
Title: Re: oddity in the File Types monitor
Post by: ancient1 on August 20, 2014, 06:17:36 PM
Sometimes you really need a removal program to fix whatever went wrong or got corrupted somehow.

Someone recently got Malwarebytes Anti-Malware from an untrusted source. I removed it fine, and tried to install the real one from malwarebytes.org and got errors all over the place. I got the removal tool from Malwarebytes.org (via the link in their forums), and then installed Malwarebytes Anti-Malware fine and it is working great. Between it and the other tools, I was able to clean the computer up and the owner is very happy. But I could not have done it without that uninstaller. Same has been true with many AV programs.

Might want to give it (winpatrolremove.exe ) a try (from Corrine's link).

I did, as reported.

So far in this thread, 3 different computers belonging to 3 different owners are reported to have the same problem. All of them Win7-64 machines. If 3 independent sad sacks were unlucky enough to be hit by the same corruption, that is, if WinPatrol is prone to a particular corruption, then perhaps the developers need to look into that.

LilBambi, please, if you have the use of a Win7-64 PC, I wonder if you would check whether (a) WinPatrol on that PC detects and alerts to changes in file types and (b) new file types can be added via the Add button.
Title: Re: oddity in the File Types monitor
Post by: LilBambi on August 20, 2014, 11:04:34 PM
Sometimes you really need a removal program to fix whatever went wrong or got corrupted somehow.

Someone recently got Malwarebytes Anti-Malware from an untrusted source. I removed it fine, and tried to install the real one from malwarebytes.org and got errors all over the place. I got the removal tool from Malwarebytes.org (via the link in their forums), and then installed Malwarebytes Anti-Malware fine and it is working great. Between it and the other tools, I was able to clean the computer up and the owner is very happy. But I could not have done it without that uninstaller. Same has been true with many AV programs.

Might want to give it (winpatrolremove.exe ) a try (from Corrine's link).

I did, as reported.

So far in this thread, 3 different computers belonging to 3 different owners are reported to have the same problem. All of them Win7-64 machines. If 3 independent sad sacks were unlucky enough to be hit by the same corruption, that is, if WinPatrol is prone to a particular corruption, then perhaps the developers need to look into that.

LilBambi, please, if you have the use of a Win7-64 PC, I wonder if you would check whether (a) WinPatrol on that PC detects and alerts to changes in file types and (b) new file types can be added via the Add button.

I prefer 64-bit Win7, but my hardware on my 'new to me' laptop needed the 32-bit version for driver support sadly. So I had to install the 32-bit version of my Win7 Ultimate. I am happy with it, as now I have my Windows 7 Ultimate (Retail) alive and well again after the last computer died after a few short months. :(

So, as much I as would love to help out with that on a 64-bit system, my system works fine with it (32-bit). And the few customers I have put the new version on with both 32-bit and 64-bit systems haven't had any problems as yet but they don't worry about customizations on their systems.

I agree it should be looked into.  Not sure why it would do that.

But in the meantime, was what I was talking about. And you did it.
Title: Re: oddity in the File Types monitor
Post by: JDBush61 on August 20, 2014, 11:19:49 PM
LilBambi, please, if you have the use of a Win7-64 PC, I wonder if you would check whether (a) WinPatrol on that PC detects and alerts to changes in file types and (b) new file types can be added via the Add button.

Hi ancient1,

Since LilBambi is currently running 32 bit Windows 7, maybe I can help you? The laptop I'm typing from is my Sony Vaio, 64-bit, Win 7, with WinPatrol (current version) installed. To be honest, I actually am at a loss as to how WinPatrol works, so not quite sure how to do the checks you're interested in. However, if you -- or someone -- can quickly outline for me what to do to check the file-type questions you stated above, then I'm more than happy to help. Let me know.

Best,

John
Title: Re: oddity in the File Types monitor
Post by: ancient1 on August 21, 2014, 11:28:42 AM
LilBambi, please, if you have the use of a Win7-64 PC, I wonder if you would check whether (a) WinPatrol on that PC detects and alerts to changes in file types and (b) new file types can be added via the Add button.

Hi ancient1,

Since LilBambi is currently running 32 bit Windows 7, maybe I can help you? The laptop I'm typing from is my Sony Vaio, 64-bit, Win 7, with WinPatrol (current version) installed. To be honest, I actually am at a loss as to how WinPatrol works, so not quite sure how to do the checks you're interested in. However, if you -- or someone -- can quickly outline for me what to do to check the file-type questions you stated above, then I'm more than happy to help. Let me know.

Best,

John

John, here's the easy one:

Open the File Types tab in WinPatrol. Are the DOC and RTF types present (for this, it is convenient to click the "Extension" header to sort the list temporarily by extensions)? If not, click the Add button and try adding the absent one. Is that successful, or are you blocked with an error message claiming that "This file type is already being monitored"?

It might be helpful if a few people, using any OS, did this and reported the results along with detailed OS and WinPatrol version info.
Title: Re: oddity in the File Types monitor
Post by: ancient1 on August 21, 2014, 11:40:46 AM
... and whether a non-Microsoft office suite or word processor has even been installed on that computer.
Title: Re: oddity in the File Types monitor
Post by: ky331 on August 21, 2014, 12:22:02 PM
Here's an example on 32-bit WinXP SP3 and WinPatrol 32.0.2014.5:

By default, .TXT files open with NotePad.  And this is showing up in WinPatrol (Command=notepad.exe, Class=txtfile, Type=system).

Emphasize that I have verified that FileTypes are LOCKED under WinPatrol's Options tab.

If I then go to Control Panel, Folder Options, File Types, select the .TXT extension and change it to WordPad, this becomes my new default:   If I open My Documents Folder and click on a .TXT file, it now opens with WordPad.   WinPatrol, despite FileTypes being locked, allowed the change.

In fact, on my 32-bit XP system, WinPatrol now actually shows TWO entries for .TXT files:   the one I mentioned above, plus a new one  (Command=wordpad.exe, Class=WordPad MFC Application, Type=explorer)

If I then go through Control Panel to change the .TXT type again, this time to WORD, the first (type=system) entry in WinPatrol remains intact, while the second changes to (Command=WinWord.exe, Class=Microsoft WORD for Windows, Type=explorer).   Again, the change is allowed --- silently --- despite FileTypes being LOCKED in WinPatrol.

I'm gonna try this out under Win7 and report back in a bit...
Title: Re: oddity in the File Types monitor
Post by: ky331 on August 21, 2014, 12:45:57 PM
Now on 64-bit Windows 7 SP1.   Everything else is the same as above, and I see I'm starting with WinPatrol showing .TXT as (Command=notepad.exe, Class=txtfile, Type=system).

On Win7, it's Control Panel, DEFAULT PROGRAMS, Associate a File Type or Protocol with a Specific Program --- to change a file type.

Changing .TXT to WordPad, I now confirm that when I go to My Documents and click on a .TXT file, it indeed opens with WordPad.   But there is NO change whatsoever in WinPatrol's reporting:   The original .TXT entry (type=system) remains... but UNlike the experience just mentioned above on WinXPx32, there is NOT a new (type=explorer) entry added.   WinPatrol completely ignored the change here.

Changing .TXT a second time, to OpenOffice Writer, the same thing happens:   WinPatrol allows... and ignores... this second change as well:  WinPatrol still shows .TXT files (type=system) being opened by NotePad, yet they are in fact now opening with OpenOffice Writer.

By the way, I should also mention that I have WinPatrol PLUS, and that FileTypes (already noted as being locked) are set to be monitored in Real Time --- so it's a not a matter that I didn't wait long-enough for WinPatrol to sense the change.

Title: Re: oddity in the File Types monitor
Post by: JDBush61 on August 21, 2014, 02:56:08 PM

John, here's the easy one:

Open the File Types tab in WinPatrol. Are the DOC and RTF types present (for this, it is convenient to click the "Extension" header to sort the list temporarily by extensions)? If not, click the Add button and try adding the absent one. Is that successful, or are you blocked with an error message claiming that "This file type is already being monitored"?

It might be helpful if a few people, using any OS, did this and reported the results along with detailed OS and WinPatrol version info.

ancient1, my apologies in advance if this isn't helpful. I was probably premature in offering my assistance, as ky331 and most others here are much more knowledgeable about WinPatrol.

To answer your question:

I'm running Win 7 64-bit SP1 and WinPatrol free version. I checked the file types tab and my WinPatrol shows both DOC and RTF extensions as being present. Example:

1) Microsoft Office Word 97-2003 Document; Command=WINWORD.EXE; Class=Word.Document.8; Extension=.DOC; System
2) Rich Text Format; Command=WINWORD.EXE; Class=Word.RTF.8; Extension=.RTF; System

Not sure if this helps you, but here are many other extensions listed, e.g., .TXT, .XLS, .WSH, .WSF, .VBS, etc., etc.

As for your second question, no non-Microsoft office suite or word processor has ever been installed on this laptop.

Hope this info is of some help to you. I'll now bow out and let the experienced folks take over. 
Title: Re: oddity in the File Types monitor
Post by: ancient1 on August 21, 2014, 08:05:43 PM
Nice work, John. (I'm an outsider, too.)
Title: Re: oddity in the File Types monitor
Post by: JDBush61 on August 21, 2014, 09:36:59 PM
You're welcome, ancient1. Wish I knew more about how WinPatrol works and how to use it. I keep it installed because... well, not quite sure why I keep it installed. Hope your problems get resolved.
Title: Re: oddity in the File Types monitor
Post by: ky331 on August 24, 2014, 10:31:59 AM
Here's yet another example:  I've just noticed that WinPatrol, without any warning/announcement, has apparently allowed CryptoPrevent v7.x [a legitimate security program] to "take control" of the .PIF and .SCR file-type associations --- they are now showing up in WinPatrol under my File Types tab (both Win7 and WinXP).

I reported this, in greater detail, here:  http://www.landzdown.com/web-news/cryptolocker-ransomware/msg169473/#msg169473
Title: Re: oddity in the File Types monitor
Post by: Rednose on August 27, 2014, 11:34:40 PM
Yes, I can confirm this. I am using CryptoPrevent too, and WinPatrol didn't warn/alert me either.

Greetz, Red.