VanguardLH wrote:
> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>
>> This MS forum shows a chap with a problem very similar to mine;
>> https://answers.microsoft.com/en-us/windows/forum/all/incorrect-icon-being-displayed-for-one-particular/b70a2913-4f8f-4435-a14a-eba38ca38e1a
>>
>> In addition to what he mentions, I've also quadrupled the size of the
>> icon cache. Oh, and BTW, the solutions suggested by the independent
>> advisor Paul Abayon didn't work either.
>
> I already mentioned using WinAero Tweaker to reset the icon cache, and
> to change its size. Or, you can follow online articles delving into the
> same issues, like using a .bat file to 'del' the icon .db file and
> reg.exe to change a registry setting.
>
> As I recall, I've only had to delete the icon cache just once, but so
> long ago that I don't remember for which version of Windows. Once the
> registry setting is changed to increase the cache size, very unlikely
> you have to do it again.
>
> Paul, in that article, didn't seem to help much. More like he was
> trying to keep the user occupied with busy-work rather than addressing
> the issue. He is one of those pseudo-techs that professes competence he
> doesn't have. There are lots of those in the MS Answers web forums.
> His only real help was in providing a link to the TenForums article.
> There are tons of online articles describing how to delete the icon
> cache file, and upping the size of the cache. I picked the WinAero
> articles, because the tweaker has links to them to provide information
> on just what the tweaker does (unlike a lot of tweakers that keep secret
> that info, like that makes them magical and special).

I'm teetering around a re-installation of Firefox; a complete clean
uninstall using IOBit, after saving all bookmarks and list of add-ons.

I'm reluctant to do that because it might work and remove the problem;
which is so abstruse that I'm aiming for a Nobel prize. I'll follow in
the footsteps of Watson & Crick, and Peter Higgs. (:-

Ed

P.S. I can't rid myself of a suspicion that MS are to blame here; they
perform somersaults and sleight of hand in order to keep Edge installed
and active. So, what have they done here? I recall a year or so ago that
I had two FFs running when I downloaded a second one from the Store; for
some reason I can't recall, probably just adventurous curiosity to see
what would happen.

On 4/10/24 06:52 AM, Ed Cryer wrote:
> VanguardLH wrote:
>> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>>
>>> This MS forum shows a chap with a problem very similar to mine;
>>> https://answers.microsoft.com/en-us/windows/forum/all/incorrect-icon-being-displayed-for-one-particular/b70a2913-4f8f-4435-a14a-eba38ca38e1a
>>>
>>> In addition to what he mentions, I've also quadrupled the size of the
>>> icon cache. Oh, and BTW, the solutions suggested by the independent
>>> advisor Paul Abayon didn't work either.
>>
>> I already mentioned using WinAero Tweaker to reset the icon cache, and
>> to change its size.  Or, you can follow online articles delving into the
>> same issues, like using a .bat file to 'del' the icon .db file and
>> reg.exe to change a registry setting.
>>
>> As I recall, I've only had to delete the icon cache just once, but so
>> long ago that I don't remember for which version of Windows.  Once the
>> registry setting is changed to increase the cache size, very unlikely
>> you have to do it again.
>>
>> Paul, in that article, didn't seem to help much.  More like he was
>> trying to keep the user occupied with busy-work rather than addressing
>> the issue.  He is one of those pseudo-techs that professes competence he
>> doesn't have.  There are lots of those in the MS Answers web forums.
>> His only real help was in providing a link to the TenForums article.
>> There are tons of online articles describing how to delete the icon
>> cache file, and upping the size of the cache.  I picked the WinAero
>> articles, because the tweaker has links to them to provide information
>> on just what the tweaker does (unlike a lot of tweakers that keep secret
>> that info, like that makes them magical and special).
>
> I'm teetering around a re-installation of Firefox; a complete clean uninstall using IOBit, after
> saving all bookmarks and list of add-ons.
>
> I'm reluctant to do that because it might work and remove the problem; which is so abstruse that I'm
> aiming for a Nobel prize. I'll follow in the footsteps of Watson & Crick, and Peter Higgs.   (:-
>
> Ed
>
> P.S. I can't rid myself of a suspicion that MS are to blame here; they perform somersaults and
> sleight of hand in order to keep Edge installed and active. So, what have they done here? I recall a
> year or so ago that I had two FFs running when I downloaded a second one from the Store; for some
> reason I can't recall, probably just adventurous curiosity to see what would happen.
>
If you don't have it turned on, Firefox sync will sync (by choice) bookmarks, settings, etc. If
you re-install and turn sync back on, it will restore those bookmarks.
All you need is an email and make a password to set it up. I"m not even sure the email address has
to be valid, I don't remember (it's been too long) if it sent you a verification email or not.
--
Linux Mint 21.3 Cinnamon 6.0.4 Kernel 5.15.0-102-generic
Al

Big Al wrote:
> On 4/10/24 06:52 AM, Ed Cryer wrote:
>> I'm teetering around a re-installation of Firefox; a complete clean
>> uninstall using IOBit, after saving all bookmarks and list of add-ons.
>>
>> I'm reluctant to do that because it might work and remove the problem;
>> which is so abstruse that I'm aiming for a Nobel prize. I'll follow in
>> the footsteps of Watson & Crick, and Peter Higgs.   (:-
>>
>> Ed
>>
>> P.S. I can't rid myself of a suspicion that MS are to blame here; they
>> perform somersaults and sleight of hand in order to keep Edge
>> installed and active. So, what have they done here? I recall a year or
>> so ago that I had two FFs running when I downloaded a second one from
>> the Store; for some reason I can't recall, probably just adventurous
>> curiosity to see what would happen.
>>
> If you don't have it turned on, Firefox sync will sync (by choice)
> bookmarks, settings, etc.   If you re-install and turn sync back on, it
> will restore those bookmarks.
> All you need is an email and make a password to set it up.  I"m not even
> sure the email address has to be valid, I don't remember (it's been too
> long) if it sent you a verification email or not.
Experiment I've conducted on this rogue icon.
Properties of .html file.
Open with, Change.
I change it to Edge, icons of all html files in that folder change
before my eyes to the Edge icon.
I change it to Opera, icons of all html files in that folder change
before my eyes to the Opera icon.
I change it to Safari, icons of all html files in that folder change
before my eyes to the Safari icon.
I change it to Slimjet, icons of all html files in that folder change
before my eyes to the Slimjet icon.
I change it to Internet Explorer, icons of all html files in that folder
change before my eyes to the Edge icon.
I change it to Firefox, icons of all html files in that folder change
before my eyes to the wrong icon; the Notepad one that doesn't appear in
FF's icons.
Why? Why? Why? What's blocking? What interferes with the routing? Where
is that icon coming from? How can I trace the path being followed?
Ed

Ed Cryer <ed@somewhere.in.the.uk> wrote:

> VanguardLH wrote:
>> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>>
>>> This MS forum shows a chap with a problem very similar to mine;
>>> https://answers.microsoft.com/en-us/windows/forum/all/incorrect-icon-being-displayed-for-one-particular/b70a2913-4f8f-4435-a14a-eba38ca38e1a
>>>
>>> In addition to what he mentions, I've also quadrupled the size of the
>>> icon cache. Oh, and BTW, the solutions suggested by the independent
>>> advisor Paul Abayon didn't work either.
>>
>> I already mentioned using WinAero Tweaker to reset the icon cache, and
>> to change its size. Or, you can follow online articles delving into the
>> same issues, like using a .bat file to 'del' the icon .db file and
>> reg.exe to change a registry setting.
>>
>> As I recall, I've only had to delete the icon cache just once, but so
>> long ago that I don't remember for which version of Windows. Once the
>> registry setting is changed to increase the cache size, very unlikely
>> you have to do it again.
>>
>> Paul, in that article, didn't seem to help much. More like he was
>> trying to keep the user occupied with busy-work rather than addressing
>> the issue. He is one of those pseudo-techs that professes competence he
>> doesn't have. There are lots of those in the MS Answers web forums.
>> His only real help was in providing a link to the TenForums article.
>> There are tons of online articles describing how to delete the icon
>> cache file, and upping the size of the cache. I picked the WinAero
>> articles, because the tweaker has links to them to provide information
>> on just what the tweaker does (unlike a lot of tweakers that keep secret
>> that info, like that makes them magical and special).
>
> I'm teetering around a re-installation of Firefox; a complete clean
> uninstall using IOBit, after saving all bookmarks and list of add-ons.
>
> I'm reluctant to do that because it might work and remove the problem;
> which is so abstruse that I'm aiming for a Nobel prize. I'll follow in
> the footsteps of Watson & Crick, and Peter Higgs. (:-
>
> Ed
>
> P.S. I can't rid myself of a suspicion that MS are to blame here; they
> perform somersaults and sleight of hand in order to keep Edge installed
> and active. So, what have they done here? I recall a year or so ago that
> I had two FFs running when I downloaded a second one from the Store; for
> some reason I can't recall, probably just adventurous curiosity to see
> what would happen.

Deleting the iconcache.db file (and optionally increasing its size), and
logging out and back in, did not work for you? Have you tried it yet?

Corruption of the icon cache has been a problem for every Windows
version. Increasing the cache size will alleviate the problem until you
install so many program with so many app icons that the cache gets
filled again to start truncating its content.

VanguardLH wrote:
> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>
>> VanguardLH wrote:
>>> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>>>
>>>> This MS forum shows a chap with a problem very similar to mine;
>>>> https://answers.microsoft.com/en-us/windows/forum/all/incorrect-icon-being-displayed-for-one-particular/b70a2913-4f8f-4435-a14a-eba38ca38e1a
>>>>
>>>> In addition to what he mentions, I've also quadrupled the size of the
>>>> icon cache. Oh, and BTW, the solutions suggested by the independent
>>>> advisor Paul Abayon didn't work either.
>>>
>>> I already mentioned using WinAero Tweaker to reset the icon cache, and
>>> to change its size. Or, you can follow online articles delving into the
>>> same issues, like using a .bat file to 'del' the icon .db file and
>>> reg.exe to change a registry setting.
>>>
>>> As I recall, I've only had to delete the icon cache just once, but so
>>> long ago that I don't remember for which version of Windows. Once the
>>> registry setting is changed to increase the cache size, very unlikely
>>> you have to do it again.
>>>
>>> Paul, in that article, didn't seem to help much. More like he was
>>> trying to keep the user occupied with busy-work rather than addressing
>>> the issue. He is one of those pseudo-techs that professes competence he
>>> doesn't have. There are lots of those in the MS Answers web forums.
>>> His only real help was in providing a link to the TenForums article.
>>> There are tons of online articles describing how to delete the icon
>>> cache file, and upping the size of the cache. I picked the WinAero
>>> articles, because the tweaker has links to them to provide information
>>> on just what the tweaker does (unlike a lot of tweakers that keep secret
>>> that info, like that makes them magical and special).
>>
>> I'm teetering around a re-installation of Firefox; a complete clean
>> uninstall using IOBit, after saving all bookmarks and list of add-ons.
>>
>> I'm reluctant to do that because it might work and remove the problem;
>> which is so abstruse that I'm aiming for a Nobel prize. I'll follow in
>> the footsteps of Watson & Crick, and Peter Higgs. (:-
>>
>> Ed
>>
>> P.S. I can't rid myself of a suspicion that MS are to blame here; they
>> perform somersaults and sleight of hand in order to keep Edge installed
>> and active. So, what have they done here? I recall a year or so ago that
>> I had two FFs running when I downloaded a second one from the Store; for
>> some reason I can't recall, probably just adventurous curiosity to see
>> what would happen.
>
> Deleting the iconcache.db file (and optionally increasing its size), and
> logging out and back in, did not work for you? Have you tried it yet?
>
> Corruption of the icon cache has been a problem for every Windows
> version. Increasing the cache size will alleviate the problem until you
> install so many program with so many app icons that the cache gets
> filled again to start truncating its content.

I know you seem convinced that this is the cause. You mention it time
and again. But it was one of the first things I did. It's in the
Appdata/ Local folder.

There are other iconcache files in Appdata/ Local/ Microsoft/ Windows/
Explorer folder; lots of them, things like iconcache_48.

Maybe these are involved.

Ed

Ed Cryer <ed@somewhere.in.the.uk> wrote:

> I know you seem convinced that [icon cache corruption] is the cause.
> You mention it time and again. But it was one of the first things I
> did.

I mentioned it several times, because until now you did NOT mention
doing it at first. Might've been the first thing you did, but the last
you admitted. Apparently it did not help.

Um, after deleting the iconcache.db file, you did logoff and logon
again, right? The cache gets read into memory. Deleting the file won't
remove the memory image. Since the file is under your %userprofile%
folder, separate caches are maintained for each Windows account. Just
logging out and logging in should reload the file into memory; else, I'd
next try rebooting Windows.

> There are other iconcache files in Appdata/ Local/ Microsoft/ Windows/
> Explorer folder; lots of them, things like iconcache_48.

I've read other articles that mention iconcache_* files. Since they are
cache files, should be okay to delete them, and get them rebuilt. I
would do a backup first to restore them if found they're really needed.

I have:

%localappdata%
iconcache.db (hidden file)
iconcache.db.backup (hidden file)

%localappdata%\Microsoft\Windows\Explorer
iconcache_*.db (17 files)

Mine were modified today or yesterday, no earlier. From what I've read
of others trying to delete the Explorer\iconcache_*.db files, they were
targeting those files only because of "iconcache" in their filename.
When they tried to delete those files, they got an error the files were
in-use by explorer.exe (which functions as both the file manager and the
desktop manager). You can open a cmd.exe shell (I'd make it an admin
aka elevated shell), and enter "taskkill /f /im explorer.exe" to kill
all instances of that process. The desktop disappears. Then use the
command shell to use 'del' commands on the iconcache_*.db files. Then
run explorer.exe, and the desktop should reappear.

When I've had to correct an icon problem (very rare), I only focused on
deleting the iconcache.db file, not the iconcache_*.db files.

On 4/10/2024 11:15 AM, Ed Cryer wrote:
> Big Al wrote:
>> On 4/10/24 06:52 AM, Ed Cryer wrote:
>
>>> I'm teetering around a re-installation of Firefox; a complete clean uninstall using IOBit, after saving all bookmarks and list of add-ons.
>>>
>>> I'm reluctant to do that because it might work and remove the problem; which is so abstruse that I'm aiming for a Nobel prize. I'll follow in the footsteps of Watson & Crick, and Peter Higgs.   (:-
>>>
>>> Ed
>>>
>>> P.S. I can't rid myself of a suspicion that MS are to blame here; they perform somersaults and sleight of hand in order to keep Edge installed and active. So, what have they done here? I recall a year or so ago that I had two FFs running when I downloaded a second one from the Store; for some reason I can't recall, probably just adventurous curiosity to see what would happen.
>>>
>> If you don't have it turned on, Firefox sync will sync (by choice) bookmarks, settings, etc.   If you re-install and turn sync back on, it will restore those bookmarks.
>> All you need is an email and make a password to set it up.  I"m not even sure the email address has to be valid, I don't remember (it's been too long) if it sent you a verification email or not.
>
> Experiment I've conducted on this rogue icon.
>
> Properties of .html file.
> Open with, Change.
> I change it to Edge, icons of all html files in that folder change before my eyes to the Edge icon.
> I change it to Opera, icons of all html files in that folder change before my eyes to the Opera icon.
> I change it to Safari, icons of all html files in that folder change before my eyes to the Safari icon.
> I change it to Slimjet, icons of all html files in that folder change before my eyes to the Slimjet icon.
> I change it to Internet Explorer, icons of all html files in that folder change before my eyes to the Edge icon.
> I change it to Firefox, icons of all html files in that folder change before my eyes to the wrong icon; the Notepad one that doesn't appear in FF's icons.
>
> Why? Why? Why? What's blocking? What interferes with the routing? Where is that icon coming from? How can I trace the path being followed?
>
> Ed

What's interesting, is the HTML can be assigned to some startup item.

"firefox default browser agent 308046B0AF4A39CB startup item"

https://support.mozilla.org/en-US/questions/1283844

I think that string is present on all installations, and it is not
a personal identifier.

It's also not a startup item on the computer.

The icon that appears, is a gray firefox in the background, with
a PDF "banner" in big letters at the bottom. And that's not
an icon inside the firefox.exe itself.

So while the file extension assignment dialog shows the word "Firefox",
the actual assignment is something different. Look in the Registry for:

FirefoxPDF - 308046B0AF4A39CB
DefaultIcon C:\Program Files\Mozilla Firefox\firefox.exe,5 # But there is no 5 in the .rsrc

We're already off to a good start.

And my icons "sorta work". There's no blank sheet icons, but
again, some items, the icon selection is not reflected
in what you see on the screen.

For example, if the registry specifies

DefaultIcon C:\Program Files\Mozilla Firefox\firefox.exe,1

it actually uses "8" in File Explorer. When there is a 1 and it could use it.
Only the scale of "8" may favor its selection.

Paul

Paul wrote:
> On 4/10/2024 11:15 AM, Ed Cryer wrote:
>> Big Al wrote:
>>> On 4/10/24 06:52 AM, Ed Cryer wrote:
>>
>>>> I'm teetering around a re-installation of Firefox; a complete clean uninstall using IOBit, after saving all bookmarks and list of add-ons.
>>>>
>>>> I'm reluctant to do that because it might work and remove the problem; which is so abstruse that I'm aiming for a Nobel prize. I'll follow in the footsteps of Watson & Crick, and Peter Higgs.   (:-
>>>>
>>>> Ed
>>>>
>>>> P.S. I can't rid myself of a suspicion that MS are to blame here; they perform somersaults and sleight of hand in order to keep Edge installed and active. So, what have they done here? I recall a year or so ago that I had two FFs running when I downloaded a second one from the Store; for some reason I can't recall, probably just adventurous curiosity to see what would happen.
>>>>
>>> If you don't have it turned on, Firefox sync will sync (by choice) bookmarks, settings, etc.   If you re-install and turn sync back on, it will restore those bookmarks.
>>> All you need is an email and make a password to set it up.  I"m not even sure the email address has to be valid, I don't remember (it's been too long) if it sent you a verification email or not.
>>
>> Experiment I've conducted on this rogue icon.
>>
>> Properties of .html file.
>> Open with, Change.
>> I change it to Edge, icons of all html files in that folder change before my eyes to the Edge icon.
>> I change it to Opera, icons of all html files in that folder change before my eyes to the Opera icon.
>> I change it to Safari, icons of all html files in that folder change before my eyes to the Safari icon.
>> I change it to Slimjet, icons of all html files in that folder change before my eyes to the Slimjet icon.
>> I change it to Internet Explorer, icons of all html files in that folder change before my eyes to the Edge icon.
>> I change it to Firefox, icons of all html files in that folder change before my eyes to the wrong icon; the Notepad one that doesn't appear in FF's icons.
>>
>> Why? Why? Why? What's blocking? What interferes with the routing? Where is that icon coming from? How can I trace the path being followed?
>>
>> Ed
>
> What's interesting, is the HTML can be assigned to some startup item.
>
> "firefox default browser agent 308046B0AF4A39CB startup item"
>
> https://support.mozilla.org/en-US/questions/1283844
>
> I think that string is present on all installations, and it is not
> a personal identifier.
>
> It's also not a startup item on the computer.
>
> The icon that appears, is a gray firefox in the background, with
> a PDF "banner" in big letters at the bottom. And that's not
> an icon inside the firefox.exe itself.
>
> So while the file extension assignment dialog shows the word "Firefox",
> the actual assignment is something different. Look in the Registry for:
>
> FirefoxPDF - 308046B0AF4A39CB
> DefaultIcon C:\Program Files\Mozilla Firefox\firefox.exe,5 # But there is no 5 in the .rsrc
>
> We're already off to a good start.
>
> And my icons "sorta work". There's no blank sheet icons, but
> again, some items, the icon selection is not reflected
> in what you see on the screen.
>
> For example, if the registry specifies
>
> DefaultIcon C:\Program Files\Mozilla Firefox\firefox.exe,1
>
> it actually uses "8" in File Explorer. When there is a 1 and it could use it.
> Only the scale of "8" may favor its selection.
>
> Paul
The Windows utilities that handle icons in .exe files start with 0. And
when I look into my firefox.exe the 5 entry is indeed a PDF image.
There are seven icons in all.
Well, well, well! Could it be that it's getting its 8 from a default
icon dll?
Ed

VanguardLH wrote:
> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>
>> I know you seem convinced that [icon cache corruption] is the cause.
>> You mention it time and again. But it was one of the first things I
>> did.
>
> I mentioned it several times, because until now you did NOT mention
> doing it at first. Might've been the first thing you did, but the last
> you admitted. Apparently it did not help.
>
> Um, after deleting the iconcache.db file, you did logoff and logon
> again, right? The cache gets read into memory. Deleting the file won't
> remove the memory image. Since the file is under your %userprofile%
> folder, separate caches are maintained for each Windows account. Just
> logging out and logging in should reload the file into memory; else, I'd
> next try rebooting Windows.
>
>> There are other iconcache files in Appdata/ Local/ Microsoft/ Windows/
>> Explorer folder; lots of them, things like iconcache_48.
>
> I've read other articles that mention iconcache_* files. Since they are
> cache files, should be okay to delete them, and get them rebuilt. I
> would do a backup first to restore them if found they're really needed.
>
> I have:
>
> %localappdata%
> iconcache.db (hidden file)
> iconcache.db.backup (hidden file)
>
> %localappdata%\Microsoft\Windows\Explorer
> iconcache_*.db (17 files)
>
> Mine were modified today or yesterday, no earlier. From what I've read
> of others trying to delete the Explorer\iconcache_*.db files, they were
> targeting those files only because of "iconcache" in their filename.
> When they tried to delete those files, they got an error the files were
> in-use by explorer.exe (which functions as both the file manager and the
> desktop manager). You can open a cmd.exe shell (I'd make it an admin
> aka elevated shell), and enter "taskkill /f /im explorer.exe" to kill
> all instances of that process. The desktop disappears. Then use the
> command shell to use 'del' commands on the iconcache_*.db files. Then
> run explorer.exe, and the desktop should reappear.
>
> When I've had to correct an icon problem (very rare), I only focused on
> deleting the iconcache.db file, not the iconcache_*.db files.

I've tried that before, but I've done it again to please you.
All the deletes worked, the IconCacheToDelete folder appeared, I
rebooted, all iconcaches recreated, IconCacheToDelete gone.

I then look around. Everything ok, with the single exception of that
rogue icon. Nothing has altered.

Ed

On 4/11/2024 5:14 AM, Ed Cryer wrote:

>
> Well, well, well! Could it be that it's getting its 8 from a default icon dll?
>
> Ed

It does suggest they're not cleaning up as well as they should.

I had expected better of them, and then I had a look...

Normally, there should not be a need for Firefox to interact
with the Registry. I don't really know how they've done what
they have done. Whether there is an interface that indirectly
sprays those items, or they actually did reg interface things
directly.

I suspect their freeware Installer Kit they use (NSIS) likely
has all of the gubbins to do this properly. But perhaps none
of the staff are skilled at driving it. They don't use
InstallShield (commercial), because that would be an admission
that they had participated in the Windows ecosystem.

*******

This is an example of a mapping protected by the Microsoft hash.
This scheme was recently changed by a "driver" for the function.
The gentleman at the site below, will have to redo his reverse
engineering (if he still enjoys puzzles).

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
"Hash"="xh8KhPWlZL0="
"ProgId"="AcroExch.Document"

There is a tool here for setting the hash (scheme now defunt).
This is the guy that reverse engineered the previous scheme.
Due to DMCA, he could not document every step or receive
a "hacking charge".

http://kolbi.cz/blog/?p=346

http://www.kolbi.cz/SetUserFTA_v1.5.zip

SHA256 of SetUserFTA.exe (58,880 bytes)
(6B7DBA337D2490083391623C1E2EAAFEC9C3DCBDE1DCDB2ABFD0E1F0C2BF31B8)

SetUserFTA.exe .pdf AcroExch.Document.DC

Paul

Paul wrote:
> On 4/11/2024 5:14 AM, Ed Cryer wrote:
>
>>
>> Well, well, well! Could it be that it's getting its 8 from a default icon dll?
>>
>> Ed
>
> It does suggest they're not cleaning up as well as they should.
>
> I had expected better of them, and then I had a look...
>
> Normally, there should not be a need for Firefox to interact
> with the Registry. I don't really know how they've done what
> they have done. Whether there is an interface that indirectly
> sprays those items, or they actually did reg interface things
> directly.
>
> I suspect their freeware Installer Kit they use (NSIS) likely
> has all of the gubbins to do this properly. But perhaps none
> of the staff are skilled at driving it. They don't use
> InstallShield (commercial), because that would be an admission
> that they had participated in the Windows ecosystem.
>
> *******
>
> This is an example of a mapping protected by the Microsoft hash.
> This scheme was recently changed by a "driver" for the function.
> The gentleman at the site below, will have to redo his reverse
> engineering (if he still enjoys puzzles).
>
> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
> "Hash"="xh8KhPWlZL0="
> "ProgId"="AcroExch.Document"
>
> There is a tool here for setting the hash (scheme now defunt).
> This is the guy that reverse engineered the previous scheme.
> Due to DMCA, he could not document every step or receive
> a "hacking charge".
>
> http://kolbi.cz/blog/?p=346
>
> http://www.kolbi.cz/SetUserFTA_v1.5.zip
>
> SHA256 of SetUserFTA.exe (58,880 bytes)
> (6B7DBA337D2490083391623C1E2EAAFEC9C3DCBDE1DCDB2ABFD0E1F0C2BF31B8)
>
> SetUserFTA.exe .pdf AcroExch.Document.DC
>
> Paul

My rogue icon is the first in shell32.dll. And when I look at that dll
with Icofx it is listed as 1(8).
8-7=1.

Ed

Ed Cryer <ed@somewhere.in.the.uk> wrote:

> I then look around. Everything ok, with the single exception of that
> rogue icon. Nothing has altered.

I've had the blank page icon show up for some .url shortcuts. Too long
since I created them to remember which web browser and version of it was
used to create the shortcut, or if I right-click in a folder to use New
Shortcut to add a URL shortcut there, or if I dragged from the address
bar of the web browser to create the shortcut. Alternatively, I'd copy
the URL from the old blank page .url shortcut, delete the old shortcut,
and use right-click in the folder to New -> Shortcut, and enter the URL
in the first dialog page (which interprets http: and https: entries as
URLs to create a .url shorcut instead of a .lnk shortcut to a file).

I just hunted through my Downloads folder where there are subfolders by
category, and then more subfolders by product. I put URL shortcuts in
those product folders, so I know where I got the product. Some had the
blank page icon despite most other .url shortcuts show the Firefox icon.
I double-clicked on the blank page .url shortcut to open the page in
Firefox. Then I deleted the .url shortcut, and created a new one by
dragging the padlock icon in Firefox's address bar to the same folder.
Basically I deleted the old .url shortcut to create a new one. The old
one had the blank page icon. The new one has the Firefox icon.

A while ago, there were different .url shortcuts that Microsoft would
create depending on how you performed the create. It's been too long to
remember the details, but I recall that I didn't like the .url shortcut
that Windows created, and had to use a workaround to create the legacy
style of shortcut. I think the style changed in Windows 7, and lots of
users were complaining that .url shortcuts didn't work like before.
There was something different between creating a new shortcut and
entering the URL string, and dragging a URL from the web browser's
address bar.

When I open a .url shortcut file (this one pointing to my e-mail
client's home page) which shows the Firefox icon, I see:

[InternetShortcut]
URL=https://www.emclient.com/
IDList=
HotKey=0
IconFile=C:\Users\leeho\AppData\Local\Mozilla\Firefox\Profiles\8eskbbyh.default-release\shortcutCache\21nlP3+4Q2kXQWsYPh_tHp9lFzx_SdafGFVT4v_r7Fo=.ico
IconIndex=0

The URL field is obvious. The IconFile field shows from which file the
icon is found. IconIndex is the resource index for the icon. Could be
zero or non-zero for an icon resource inside an .exe or .dll file, but
this shortcut is pointing to an .ico icon file (which I don't recall can
have more than one icon, so the index is zero).

I found another .url shortcut that had the blank page icon, and in
Notepad its content was:

[InternetShortcut]
URL=https://www.microsoft.com/en-us/software-download/windows10
IDList=
HotKey=0
IconFile=C:\Users\lee_hodsdon\AppData\Local\Mozilla\Firefox\Profiles\6u4gergv.default\shortcutCache\QxrMc9AYfHUvWIXr8t+QwA==.ico
IconIndex=0

The one with the Firefox icon pointed to the .ico file under my current
Firefox profile folder (8eskbbyh.default-release). The one with the
blank page icon points to a Firefox folder (6u4gergv.default) that does
not exist. I might've change or refreshed (create a new profile), or
somehow had that old profile folder before, but I don't now, so the old
..url shortcut with a blank page icon couldn't find the old .ico file.

The old .url shortcut that had a blank icon (because its .ico file
didn't exist anymore) was created back in 2016, so it's been 8 years
since I created that shortcut. In that time, a profile I had in Firefox
back then doesn't exist anymore, so any .url shortcuts pointing to it
won't find the .ico file.

Have you tried copying the URL in the .url shortcut's properties,
deleting the old .url shortcut file, and create a new .url shortcut
using the same URL string?

Have you ever right-clicked on the blank page icon .url shortcuts to
click "Change icon"? You said that in your first post, but not to what
you pointed to in finding an icon. If you don't keep the file from
which shortcut intends to get the icon, or not keep the .exe or .dll
file from where you selected an icon resource inside (or the resource
index changes, like in an updated version of the file), Windows no
longer can find the icon, so it'll display the generic blank page icon.

In the past, I would save the favicon.ico file from a web site to store
in a media folder. I could then use Change Icon in the .url shortcut
properties to point to the web site's icon. However, a .url shortcut
uses what is specified for the handler, so I had to create a regular
shortcut that ran "firefox.exe <url>" as a program instead of pointing
at a URL. Then change icon worked. I accidentally deleted the favicon
folder, and all those shortcuts I had changed to point there went to the
blank page icon. I recovered the folder from backups, and the URL
shortcuts started using the favicons I had saved.

This reminds of even longer ago when I created URL shortcuts that they
managed to use the favicon.ico at a web site, if it had one, but that
was tenuous. If I cleared the web browser's cache, the cached favicons
were gone, and why I started to grab favion.ico files from web sites to
store in my own separate "cache" folder.

When you go into Default Apps, and select "Default apps by filetypes",
and look at ".URL - Internet Shortcut", what handler is specified?
Internet Browser, or Firefox? Change back to Internet Browser if you
somehow changed that to Firefox.

On 4/11/2024 3:27 PM, Ed Cryer wrote:
> Paul wrote:
>> On 4/11/2024 5:14 AM, Ed Cryer wrote:
>>
>>>
>>> Well, well, well! Could it be that it's getting its 8 from a default icon dll?
>>>
>>> Ed
>>
>> It does suggest they're not cleaning up as well as they should.
>>
>> I had expected better of them, and then I had a look...
>>
>> Normally, there should not be a need for Firefox to interact
>> with the Registry. I don't really know how they've done what
>> they have done. Whether there is an interface that indirectly
>> sprays those items, or they actually did reg interface things
>> directly.
>>
>> I suspect their freeware Installer Kit they use (NSIS) likely
>> has all of the gubbins to do this properly. But perhaps none
>> of the staff are skilled at driving it. They don't use
>> InstallShield (commercial), because that would be an admission
>> that they had participated in the Windows ecosystem.
>>
>> *******
>>
>> This is an example of a mapping protected by the Microsoft hash.
>> This scheme was recently changed by a "driver" for the function.
>> The gentleman at the site below, will have to redo his reverse
>> engineering (if he still enjoys puzzles).
>>
>> [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
>> "Hash"="xh8KhPWlZL0="
>> "ProgId"="AcroExch.Document"
>>
>> There is a tool here for setting the hash (scheme now defunt).
>> This is the guy that reverse engineered the previous scheme.
>> Due to DMCA, he could not document every step or receive
>> a "hacking charge".
>>
>> http://kolbi.cz/blog/?p=346
>>
>>     http://www.kolbi.cz/SetUserFTA_v1.5.zip
>>
>>        SHA256 of SetUserFTA.exe   (58,880 bytes)
>>        (6B7DBA337D2490083391623C1E2EAAFEC9C3DCBDE1DCDB2ABFD0E1F0C2BF31B8)
>>
>>        SetUserFTA.exe .pdf AcroExch.Document.DC
>>
>>     Paul
>
> My rogue icon is the first in shell32.dll. And when I look at that dll with Icofx it is listed as 1(8).
> 8-7=1.
>
> Ed

So your registry actually has a reference to shell32.dll,1 for a Firefox entry ?

What would do that ?

If the new protection was present on your OS, this article explains
how today, you could deal with it.

https://kolbi.cz/blog/2024/04/03/userchoice-protection-driver-ucpd-sys/

Paul

Paul wrote:
> On 4/11/2024 3:27 PM, Ed Cryer wrote:
>> My rogue icon is the first in shell32.dll. And when I look at that dll with Icofx it is listed as 1(8).
>> 8-7=1.
>>
>> Ed
>
> So your registry actually has a reference to shell32.dll,1 for a Firefox entry ?
>
> What would do that ?
>
> If the new protection was present on your OS, this article explains
> how today, you could deal with it.
>
> https://kolbi.cz/blog/2024/04/03/userchoice-protection-driver-ucpd-sys/
>
> Paul

You've read more into my sentences than I put there.
I know about shell32.dll. It's widely used, so I looked there first for
the rogue icon. I didn't find it in the registry.

I suppose that Windows has a default option in case an icon route is
crippled. Something like "use the first icon in .....".

Ed

VanguardLH wrote:
> Ed Cryer <ed@somewhere.in.the.uk> wrote:
>
>> I then look around. Everything ok, with the single exception of that
>> rogue icon. Nothing has altered.
>
> I've had the blank page icon show up for some .url shortcuts. Too long
> since I created them to remember which web browser and version of it was
> used to create the shortcut, or if I right-click in a folder to use New
> Shortcut to add a URL shortcut there, or if I dragged from the address
> bar of the web browser to create the shortcut. Alternatively, I'd copy
> the URL from the old blank page .url shortcut, delete the old shortcut,
> and use right-click in the folder to New -> Shortcut, and enter the URL
> in the first dialog page (which interprets http: and https: entries as
> URLs to create a .url shorcut instead of a .lnk shortcut to a file).
>
> I just hunted through my Downloads folder where there are subfolders by
> category, and then more subfolders by product. I put URL shortcuts in
> those product folders, so I know where I got the product. Some had the
> blank page icon despite most other .url shortcuts show the Firefox icon.
> I double-clicked on the blank page .url shortcut to open the page in
> Firefox. Then I deleted the .url shortcut, and created a new one by
> dragging the padlock icon in Firefox's address bar to the same folder.
> Basically I deleted the old .url shortcut to create a new one. The old
> one had the blank page icon. The new one has the Firefox icon.
>
> A while ago, there were different .url shortcuts that Microsoft would
> create depending on how you performed the create. It's been too long to
> remember the details, but I recall that I didn't like the .url shortcut
> that Windows created, and had to use a workaround to create the legacy
> style of shortcut. I think the style changed in Windows 7, and lots of
> users were complaining that .url shortcuts didn't work like before.
> There was something different between creating a new shortcut and
> entering the URL string, and dragging a URL from the web browser's
> address bar.
>
> When I open a .url shortcut file (this one pointing to my e-mail
> client's home page) which shows the Firefox icon, I see:
>
> [InternetShortcut]
> URL=https://www.emclient.com/
> IDList=
> HotKey=0
> IconFile=C:\Users\leeho\AppData\Local\Mozilla\Firefox\Profiles\8eskbbyh.default-release\shortcutCache\21nlP3+4Q2kXQWsYPh_tHp9lFzx_SdafGFVT4v_r7Fo=.ico
> IconIndex=0
>
> The URL field is obvious. The IconFile field shows from which file the
> icon is found. IconIndex is the resource index for the icon. Could be
> zero or non-zero for an icon resource inside an .exe or .dll file, but
> this shortcut is pointing to an .ico icon file (which I don't recall can
> have more than one icon, so the index is zero).
>
> I found another .url shortcut that had the blank page icon, and in
> Notepad its content was:
>
> [InternetShortcut]
> URL=https://www.microsoft.com/en-us/software-download/windows10
> IDList=
> HotKey=0
> IconFile=C:\Users\lee_hodsdon\AppData\Local\Mozilla\Firefox\Profiles\6u4gergv.default\shortcutCache\QxrMc9AYfHUvWIXr8t+QwA==.ico
> IconIndex=0
>
> The one with the Firefox icon pointed to the .ico file under my current
> Firefox profile folder (8eskbbyh.default-release). The one with the
> blank page icon points to a Firefox folder (6u4gergv.default) that does
> not exist. I might've change or refreshed (create a new profile), or
> somehow had that old profile folder before, but I don't now, so the old
> .url shortcut with a blank page icon couldn't find the old .ico file.
>
> The old .url shortcut that had a blank icon (because its .ico file
> didn't exist anymore) was created back in 2016, so it's been 8 years
> since I created that shortcut. In that time, a profile I had in Firefox
> back then doesn't exist anymore, so any .url shortcuts pointing to it
> won't find the .ico file.
>
> Have you tried copying the URL in the .url shortcut's properties,
> deleting the old .url shortcut file, and create a new .url shortcut
> using the same URL string?
>
> Have you ever right-clicked on the blank page icon .url shortcuts to
> click "Change icon"? You said that in your first post, but not to what
> you pointed to in finding an icon. If you don't keep the file from
> which shortcut intends to get the icon, or not keep the .exe or .dll
> file from where you selected an icon resource inside (or the resource
> index changes, like in an updated version of the file), Windows no
> longer can find the icon, so it'll display the generic blank page icon.
>
> In the past, I would save the favicon.ico file from a web site to store
> in a media folder. I could then use Change Icon in the .url shortcut
> properties to point to the web site's icon. However, a .url shortcut
> uses what is specified for the handler, so I had to create a regular
> shortcut that ran "firefox.exe <url>" as a program instead of pointing
> at a URL. Then change icon worked. I accidentally deleted the favicon
> folder, and all those shortcuts I had changed to point there went to the
> blank page icon. I recovered the folder from backups, and the URL
> shortcuts started using the favicons I had saved.
>
> This reminds of even longer ago when I created URL shortcuts that they
> managed to use the favicon.ico at a web site, if it had one, but that
> was tenuous. If I cleared the web browser's cache, the cached favicons
> were gone, and why I started to grab favion.ico files from web sites to
> store in my own separate "cache" folder.
>
> When you go into Default Apps, and select "Default apps by filetypes",
> and look at ".URL - Internet Shortcut", what handler is specified?
> Internet Browser, or Firefox? Change back to Internet Browser if you
> somehow changed that to Firefox.

Beware of exacerbating a small problem. You make changes, and then along
come updates for Windows and installed software which turn a small
problem into a large one.
I'm about to re-install Firefox. That is the simplest and safest solution.

Thanks for accompanying me on the journey.

Ed