NeverShowExt

Friday 26 August 2005This is 19 years old. Be careful.

The next phase of Max’s Madlibs program is reading the madlib story out of a file rather than having it hardcoded in the program. First we put them in .txt files, but then I suggested using a new file extension, since the program didn’t care. Max thought having a custom file extension was very cool, so we started putting the text in .mad files.

As a geek, I always set my Windows explorer options to show all file extensions. But when I looked at the madlibs directory, something odd was happening. I saw “madlib.py”, but story1.mad was listed as “story1”. Where was the .mad extension?

I figured the answer must be in the registry somewhere, and it was. The registry entry for .mad (at \HKEY_CLASSES_ROOT\.mad) defines it as “Access.Shortcut.Module.1”, which has registry values (at \HKEY_CLASSES_ROOT\Access.Shortcut.Module.1) of:

  • (Default): Microsoft Office Access Module Shortcut
  • IsShortCut
  • NeverShowExt

That “NeverShowExt” value prevents the shell from displaying the file extension. The “IsShortCut” value makes the shell put the little arrow overlay on the icon.

Of course, this obscure feature of Windows has been exploited by the bad guys to fool users into running malicious programs. Exactly what extensions are marked as invisible like this will depend on what software you have installed, but here’s one guy’s census.

This Microsoft article about these entries is a breezy bestiary including other exotic examples like AlwaysShowExt, NoOpen, OpenWithList, and NoFileFolderConnection. And just to make things even hairier, it turns out you can use a COM class id as a file extension!

Comments

Add a comment:

Ignore this:
Leave this empty:
Name is required. Either email or web are required. Email won't be displayed and I won't spam you. Your web site won't be indexed by search engines.
Don't put anything here:
Leave this empty:
Comment text is Markdown.