When doing "pranks" like that, it is not enough to just follow a step-by-step tutorial or a batch script; it's best to know something about how the actual data is stored – it becomes easier to recover later.
All file associations are kept in Registry, which can be edited using regedit or reg. The shell looks for them under HKEY_CLASSES_ROOT
, which is a merged view of HKEY_LOCAL_MACHINE\Software\Classes
(system-wide) and HKEY_CURRENT_USER\Software\Classes
(user-local).
- [
HKEY_CLASS_ROOT
]
- [
.txt
]
- (default) = "
txtfile
" – pointer to another key under HKCR
- [
txtfile
]
- (default) = "
Text Document
" – textual description as displayed in Explorer
- [
shell
] – the actions to use for double-click and context-menu
- (default) = (not set) – the action to use on double-click; defaults to "
open
"
- [
open
]
- (default) = (not set) – label displayed in context menu; defaults to "
Open
"
- [
command
]
- (default) = "
%SystemRoot%\system32\NOTEPAD.EXE %1
"
For most extensions, the HKCR\.extn\(Default)
value points to a file type key under the same HKCR; for example, .exe
points to HKCR\exefile
.
(In rare cases, though, all information is under the extension's key directly, with HKCR\.extn\(Default)
containing the description. These seem to be very rare, though – maybe a leftover of Windows 9x or 3.x...)
Make backups. reg save HKLM\Software\Classes hklm-classes.hiv
Also, remember that the Command Prompt does not care about extensions; if you try to run an executable program, it will always run no matter how it is named, or what its extension is associated with.
it's on a batch virus google search – RobotHumans – 2011-11-07T14:08:13.037