Laptops Forum·2,723 discussions

Unable to show EXE file extension

Locked

Dear all,

My laptop is installed with win xp and I have a strange problem: I wanted to rename an executable (.EXE) file into another file extension, but I can’t get it done!

I understand the usual thing to do is to first go to Windows Explorer, click on menu entry “Folder Option”. Then, under “View”, we are to unclick “Hide extension for known filetypes”, so as to reveal the extension for renaming.

However, for my case, some other types of file extensions appeared but not .EXE!

I understand the next step is to go to the tab “File types” and try to modify the file type behaviour from there. However, the file type “.EXE” is not even there for modification!

Does anyone has any idea why my laptop is behaving like this and any solution?

Thanks and Best Regards
TCK

Topic

Clarifications

In reply to Unable to show EXE file extension

Clarifications

Check of infections

In reply to Unable to show EXE file extension

By making sure that your AV Product is fully updated and that you have some Malware Scanner installed and Updated and then boot in Safe Mode and scan the system.

You should continue scanning till it is either clean or you can not remove something.

Besides whatever AV Product you have installed you should have Malware Bytes

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol&cdlPid=10878968

Spy Bot S&D

http://www.safer-networking.org/en/download/index.html

If you do not have a valid AV Product Installed AVG Free will do a good job

http://free.avg.com/download-avg-anti-virus-free-edition

Or Avast Home Free both do a good job but you only need 1 AV product installed.

http://www.avast.com/eng/download-avast-home.html

Col

A couple of suggestions

In reply to Unable to show EXE file extension

Windows? XP File Association Fixes
http://www.dougknox.com/xp/file_assoc.htm

Download Malwarebytes Anti-Malware, install it and update it and scan your Sysytem.
Malwarebytes

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
mbam-rules

Is this what you need to do?

In reply to A couple of suggestions

To show file extensions, first open “My Computer”, Then select “Folder Options” from the Tools menu.
When the Folder Options window opens, click the View tab. This will show the file and folder view settings.
One of the options under Advanced settings is “Hide extensions for known file types.” If this option is checked, uncheck the checkbox and click Apply or OK. This setting is system wide, so unchecking this box will make file extensions appear in all folders.

Edit: format

LOL. You and I are going in circles. :D

In reply to Is this what you need to do?

I posted a link below, which you had posted much earlier. Now you have suggested what the OP claims to have done in the first place. Then again, I wonder if that setting shouldn’t be looked at again, or be given the old “on /off, on /off treatment, which seems to work for some things.

LOL

In reply to LOL. You and I are going in circles. :D

it wouldnt hurt to recheck it. The on/off trick sometimes works. 😉

The OP should check to see if show Hidden and System files are unticked as well. 😀

Also check this link

In reply to LOL

http://www.winhelponline.com/articles/112/1/File-extension-for-exe-files-is-not-displayed-in-Explorer-after-a-Virus-attack.html

Ah, that was the type of thing I was looking for :-bd

In reply to Also check this link

Nice find. I figured, if malware will change media file extensions, changing executable extensions would make sense as part of an attack.

Nasty little critters

In reply to Ah, that was the type of thing I was looking for :-bd

some of this malware. Simple fix when you know how though. 😉

Good try but still not working

In reply to Also check this link

Hi Jacky Howe,

I tried both the solutions provided.

The first one didn’t seemed to have any effects.

For the 2nd one, the entry “HKEY_CLASSES_ROOT\exefile” on my laptop doesn’t have “NeverShowExt” as one of the values.

Thanks and Best Regards
Thong CK

didn’t work for my laptop

In reply to Is this what you need to do?

Hi Jacky Howe,

Thanks for your reply.

I did try this standard way of making file extension appears, but it just didn’t work.

Any other suggestions?

Thanks and Best Regards
thong CK

Check this link

In reply to didn’t work for my laptop

http://forums.cnet.com/5208-6132_102-0.html?messageID=2911990

Edit: missed a bit

Location of tdssserv.sys and Associated Malware

http://www.exterminate-it.com/malpedia/file/tdssserv.sys

Did you have system restore turned off and run the scans in Safe Mode.

tdsserv.sys

In reply to Check this link

Hi Jacky Howe,

I didn’t find tdsserv.sys in the stated directory. Anyway, I still run the exterminate-it test as stated – no malware turned up.

Thanks and Best Regards
Thong CK

If I am reading this right …

In reply to Unable to show EXE file extension

You unchecked the “Hide extension for known filetypes” – expecting to find an EXE file but got a file with a different extension.

Is this right?

In which case, what file were you expecting to have an EXE hanging off the end of it?

By the way – You never have EXE showing up in Filetypes.

Right

In reply to If I am reading this right …

You don’t associate EXE. It is a self-executing file.

I wonder if the file is actually an EXE to begin with.

If we look in other directories with EXE files in them, does the extension show there?

Unable to show EXE file extension

In reply to Unable to show EXE file extension

Dear all,

Thank you for your replies.

After receiving your suggestions, I installed Malwarebytes, Adaware, Spybot S&D, Norton antivirus and run scans in safe mode.

Malwarebytes and adaware did turned up a few minor bugs, while the rest declare my laptop clean.

However, EXE file extension still won’t turn up.

I further searched the web for solution, and one possible cause suggested seemed to be that some virus or malware have modified the registry before they were deleted.

Anyone has any experience in this respect?

Thanks and Best Regards
Thong CK

Reg change should not remove ext from filename

In reply to Unable to show EXE file extension

so you may have to add that extension manually to all suspected EXE files.

There is a fix, however, for EXE files that will not execute when double-clicked.
http://dougknox.com/xp/file_assoc.htm
See:
“EXE File Association Fix (Restore default association for EXE files)”
link on this page.

Perhaps the malware renamed your files. There is one out there, for sure, that changes various media file extensions, so it would not surprise me.

Do you happen to have the names of the malware removed? We could find out the symptoms and effects from the malware names.

not file association problem

In reply to Reg change should not remove ext from filename

Hi seanferd,

My problem is not really file association. EXE files does execute when double-clicked. It is just that I can’t see the file extension on Windows explorer, no matter what I do.

That is frustrating if you want to rename the file into a different type (like to send files over restrictive email service, etc)

Thanks and Best Regards
Thong CK

Did you read all the posts?

In reply to not file association problem

Jacky had a link for the EXE extension damaged by virus.

Say, can you open a cmd prompt

In reply to Unable to show EXE file extension

and navigate to a folder containing EXE files, then do a DIR /P or ATTRIB on that directory to see if the extensions show there?

If you go back and look at “Hide extensions of known file types”, is it still checked, or does it uncheck itself?

cmd prompt test

In reply to Say, can you open a cmd prompt

Hi Seanferd,

At cmd prompt, I can see the extension.

Going back, the “Hide extensions of known file types” is still unchecked (Did I mentioned that it has all the while been unchecked?).

Best Regards
Thong CK

OK, Wasn’t sure.

In reply to cmd prompt test

Some folks have had the issue that when they uncheck “Hide Known…”, it doesn’t stay unchecked.

What I’m still not understanding, though, is why can you not rename the file anyway, regardless as to whether or not it is showing an extension. What happens when you try to add .exe to a known executable file?

Would you care to post some relevant reg entries? Just export the entry, then paste the text from the file for
HKEY_CLASSES_ROOT\.exe
HKEY_CLASSES_ROOT\exefile

You could also navigate to
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and ensure that
HideFileExt is set to 0

Reaching a bit:
In the above key, create a new DWORD value, name it ShowSuperHidden, and set the value to 1. Log off and back on or reboot, and see if the EXE extension shows up.

Something strange at HKEY_CURRENT_USER

In reply to OK, Wasn’t sure.

Hi seanferd,

Please find below my registry export from
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

——————————————–
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
“ServerAdminUI”=dword:00000000
“Hidden”=dword:00000001
“ShowCompColor”=dword:00000001
“HideFileExt”=dword:00000001
“DontPrettyPath”=dword:00000000
“ShowInfoTip”=dword:00000001
“HideIcons”=dword:00000000
“MapNetDrvBtn”=dword:00000000
“WebView”=dword:00000001
“Filter”=dword:00000000
“SuperHidden”=dword:00000000
“SeparateProcess”=dword:00000000
“ListviewAlphaSelect”=dword:00000001
“ListviewShadow”=dword:00000001
“ListviewWatermark”=dword:00000001
“TaskbarAnimations”=dword:00000001
“StartMenuInit”=dword:00000002
“StartButtonBalloonTip”=dword:00000002
“TaskbarSizeMove”=dword:00000000
“NoNetCrawling”=dword:00000000
“FolderContentsInfoTip”=dword:00000001
“FriendlyTree”=dword:00000001
“WebViewBarricade”=dword:00000001
“DisableThumbnailCache”=dword:00000000
“HideFileExt “=dword:00000000
“ShowSuperHidden “=dword:00000001
“ClassicViewState”=dword:00000001
“PersistBrowsers”=dword:00000000
“Start_LargeMFUIcons”=dword:00000001
“Start_MinMFU”=dword:00000006
“Start_ShowRecentDocs”=dword:00000002
“Start_AutoCascade”=dword:00000001
“Start_NotifyNewApps”=dword:00000001
“TaskbarGlomming”=dword:00000001
“60582121”=”60582121″
“Start_ShowNetPlaces_ShouldShow”=dword:00000041
“Start_ShowNetConn_ShouldShow”=dword:00000042

——————————————
There seemed to be 2 rows of “HideFileExt”

“HideFileExt”=dword:00000001
“HideFileExt”=dword:00000000

Is this the source of my problem? So I just delete the row with value 00000001?

Also your requests, please find HKEY_CLASSES_ROOT\.exe

————————————-
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@=”exefile”
“Content Type”=”application/x-msdownload”

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@=”{098f2470-bae0-11cd-b579-08002b30bfeb}”

————————————-

HKEY_CLASSES_ROOT\exefile
————————————-
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile]
@=”Application”
“EditFlags”=hex:38,07,00,00
“TileInfo”=”prop:FileDescription;Company;FileVersion”
“InfoTip”=”prop:FileDescription;Company;FileVersion;Create;Size”

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@=”%1″

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
“EditFlags”=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@=”\”%1\” %*”

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies]

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\command]
@=”C:\\PROGRA~1\\MICROS~3\\COMMON\\Tools\\DEPENDS.EXE /dde”

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\ddeexec]
@=”[open(\”%1\”)]”

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@=”{86C86720-42A0-1069-A2E8-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@=”{86F19A00-42A0-1069-A2E9-08002B30309D}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@=”{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}]
@=””

————————————-

Thanks and Best Regards
Thong CK

Oh, yes. Delete “HideFileExt”=dword:00000001

In reply to Something strange at HKEY_CURRENT_USER

Hopefully, that will do it.
You can run a search from the registry root (My Computer) for HideFileExt and make sure there aren’t any duplicates in other keys, and that they are all set to 0.

Why it is only hiding EXE extensions, I cannot say.

Everything else looks OK to me.

Oh, and have you tried manually adding the EXE extension to a to a file by renaming in Explorer? I was curious to know if there was actually anything stopping you from doing it. (Although, if you looked at it in a cmd window, it might have a double exe extension, according to what you’ve seen previously.)

Ignore

In reply to Oh, yes. Delete “HideFileExt”=dword:00000001

not enough wheeties.

the “HideFileExt”=dword:00000000 turns it on and you will see the extension.
“HideFileExt”=dword:00000001 turns it off and you won’t see the extension.

It worked!

In reply to Oh, yes. Delete “HideFileExt”=dword:00000001

Hi seanferd,

After I delete the extra entry, the problem still remained. So I did a search in registry for all “HideFileExt” and I found following key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt]
“Type”=”checkbox”
“Text”=”@shell32.dll,-30503”
“HKeyRoot”=dword:80000001
“RegPath”=”Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced”
“ValueName”=”HideFileExt ”
“CheckedValue”=dword:00000001
“UncheckedValue”=dword:00000000
“DefaultValue”=dword:00000001
“HelpID”=”shell.hlp#51101”

Only after I set the entry “DefaultValue” from 1 to 0, then the problem go away.

Regarding your query, NO the PC did not stop me from adding extra .exe, but the file becomes “filename.exe.exe”, and it will still hide the 2nd .exe extension, so it displays “filename.exe”.

However, exposing a .exe this way is not helpful, because if I want to change the file type, renaming the file “filename.eee.exe” still will not change the file type.

Last but not least, I want to say a BIG thank you to you and Jacky Howe and all the others that have chipped in and help. Your kindness and patience are most admirable!

Thanks and Best Regards
Thong CK

Fantastic!

In reply to It worked!

I’m glad we all were able to narrow it down.

“filename.exe.exe” is what I expected it to do, I was just wondering isf something was actively preventing you from renaming. Glad that was not the case.

Also – Windows takes for the extension the characters after the last dot. Malware can make use of this to hide the real extension, as well as using the CLSID instead of an extension.

You are quite welcome to our help any time.

Kind regards,

Sean

Glad to see that you

In reply to It worked!

have sorted it out. Sean hit the nail on the head with HideFileExt. Check your USB drives as it may be related to W32/SillyFDC-CG. It is a worm for the Windows platform that spreads via removable drives and does almost the same thing.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
CheckedValue
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
DefaultValue
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Text
Lo dugem terus

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Type
(null)

Keep us informed as to your progress if you require further assistance. 😉 😀

---

If you think that any of the posts that have been made by all TechRepublic Members, have solved or contributed to solving the problem, please Mark them as Helpful so that others may benefit from the outcome. 😉 😀 :-bd

That’s an evil worm

In reply to It worked!

http://www.sophos.com/security/analyses/viruses-and-spyware/w32sillyfdccg.html

I’m afraid I do not like it at all. 😐

A couple of checks

In reply to Unable to show EXE file extension

Open up a Command Prompt
navigate to C:\> by pressing cd\ and pressing Enter.

Do a dir and check for an autorun.inf or any strange .bat .cmd files. If you do find them try this for us by substituting the actual names matching the file extension.

Type this in, including the TYPE command.

type C:\autorun.inf > C:\check.txt

type C:\batchname.bat >> C:\check.txt

type C:\cmdname.cmd >> C:\check.txt

Copy and paste this into the run box and press Enter.

cmd /k reg query hkcr\exefile\shell /s > C:\exe.txt

It should resemble this structure below.

! REG.EXE VERSION 3.0

HKEY_CLASSES_ROOT\exefile\shell

HKEY_CLASSES_ROOT\exefile\shell\open
EditFlags REG_BINARY 00000000

HKEY_CLASSES_ROOT\exefile\shell\open\command
REG_SZ “%1” %*

HKEY_CLASSES_ROOT\exefile\shell\runas

HKEY_CLASSES_ROOT\exefile\shell\runas\command
REG_SZ “%1” %*

Post the contents of both files for us please.

Also run this Rootkit Revealer GMer
Gmer
FAQ
FAQ

Almost forgot

In reply to A couple of checks

You could also try logging in with another User Account to see if it is a profile problem. 😉

For sure

In reply to Almost forgot

A good plan.

Delete "NeverShowExt"

In reply to Unable to show EXE file extension

Go to [HKEY_CLASSES_ROOT\exefile] and delete “NeverShowExt”.

[Author]

Replies