Shell commands

  • Thread starter Thread starter dos
  • Start date Start date
"David H. Lipman" wrote:

> From: "dos" <dos@discussions.microsoft.com>
>
> | Hi,
> | should all shell commands have this "%1" %*? Can a virus modifie this value?
>
> Yes. Viruses have ben know to modify them.
>
> What the exact shell command syntax would be depend upon which one.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>
> Hm,
what do you think about this two?
..scr - - "%1" /S
..txt - Text Document - C:\WINDOWS\NOTEPAD.EXE %1
 
"David H. Lipman" wrote:

> From: "dos" <dos@discussions.microsoft.com>
>
> | Hi,
> | should all shell commands have this "%1" %*? Can a virus modifie this value?
>
> Yes. Viruses have ben know to modify them.
>
> What the exact shell command syntax would be depend upon which one.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>
> Hm,
what do you think about this two?
..scr - - "%1" /S
..txt - Text Document - C:\WINDOWS\NOTEPAD.EXE %1
 
"dos" wrote:

>
>
> "David H. Lipman" wrote:
>
> > From: "dos" <dos@discussions.microsoft.com>
> >
> > | Hi,
> > | should all shell commands have this "%1" %*? Can a virus modifie this value?
> >
> > Yes. Viruses have ben know to modify them.
> >
> > What the exact shell command syntax would be depend upon which one.
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
> >
> >
> > Hm,
> what do you think about this two?
> .scr - - "%1" /S
> .txt - Text Document - C:\WINDOWS\NOTEPAD.EXE %1
>
Sorry for double post!
 
can you complete the line
..scr and .txt is being called to execute or to do a tandem action with
another file that is can you please include the entire line thanks
--
Milo



"dos" wrote:

>
>
> "dos" wrote:
>
> >
> >
> > "David H. Lipman" wrote:
> >
> > > From: "dos" <dos@discussions.microsoft.com>
> > >
> > > | Hi,
> > > | should all shell commands have this "%1" %*? Can a virus modifie this value?
> > >
> > > Yes. Viruses have ben know to modify them.
> > >
> > > What the exact shell command syntax would be depend upon which one.
> > >
> > > --
> > > Dave
> > > http://www.claymania.com/removal-trojan-adware.html
> > > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
> > >
> > >
> > > Hm,
> > what do you think about this two?
> > .scr - - "%1" /S
> > .txt - Text Document - C:\WINDOWS\NOTEPAD.EXE %1
> >
> Sorry for double post!
 
"Milo" wrote:

> can you complete the line
> .scr and .txt is being called to execute or to do a tandem action with
> another file that is can you please include the entire line thanks
> --
> Milo
>
>
>
> "dos" wrote:
>
> >
> >
> > "dos" wrote:
> >
> > >
> > >
> > > "David H. Lipman" wrote:
> > >
> > > > From: "dos" <dos@discussions.microsoft.com>
> > > >
> > > > | Hi,
> > > > | should all shell commands have this "%1" %*? Can a virus modifie this value?
> > > >
> > > > Yes. Viruses have ben know to modify them.
> > > >
> > > > What the exact shell command syntax would be depend upon which one.
> > > >
> > > > --
> > > > Dave
> > > > http://www.claymania.com/removal-trojan-adware.html
> > > > Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
> > > >
> > > >
> > > > Hm,
> > > what do you think about this two?
> > > .scr - - "%1" /S
> > > .txt - Text Document - C:\WINDOWS\NOTEPAD.EXE %1
> > >
> > Sorry for double post!

In registry looks like this.
HKEY_CLASSES_ROOT\scrfile\Shell\config\command "%1"
HKEY_CLASSES_ROOT\scrfile\Shell\install\command rundll32.exe
desk.cpl,InstallScreenSaver %l
HKEY_CLASSES_ROOT\scrfile\Shell\Open\Command "%1" /S

HKEY_CLASSES_ROOT\txtfile\DefaultIcon %SystemRoot%\system32\shell32.dll,-152
HKEY_CLASSES_ROOT\txtfile\shell\open\command C:\WINDOWS\NOTEPAD.EXE %1
HKEY_CLASSES_ROOT\txtfile\shell\print\command
%SystemRoot%\system32\NOTEPAD.EXE /p %1
HKEY_CLASSES_ROOT\txtfile\shell\printto\command
%SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"
 
From: "dos" <dos@discussions.microsoft.com>


|
| In registry looks like this.
| HKEY_CLASSES_ROOT\scrfile\Shell\config\command "%1"
| HKEY_CLASSES_ROOT\scrfile\Shell\install\command rundll32.exe
| desk.cpl,InstallScreenSaver %l
| HKEY_CLASSES_ROOT\scrfile\Shell\Open\Command "%1" /S
|
| HKEY_CLASSES_ROOT\txtfile\DefaultIcon %SystemRoot%\system32\shell32.dll,-152
| HKEY_CLASSES_ROOT\txtfile\shell\open\command C:\WINDOWS\NOTEPAD.EXE %1
| HKEY_CLASSES_ROOT\txtfile\shell\print\command
| %SystemRoot%\system32\NOTEPAD.EXE /p %1
| HKEY_CLASSES_ROOT\txtfile\shell\printto\command
| %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4"

Let's get to the root...

What is the problem you are having and why are you asking ?

I don't see anything wrong in the above...

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
 
Back
Top