Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Extension Mapping to Disguise a File Type
Windows 2000 associates a file name extension with a particular application. When a file from Explorer or My Computer is opened, it is graphically displayed with the associated application's icon. Changing this mapping is very simple, and can render the file nonexecutable. It is achieved by selecting it from the Explorer or My Computer window, selecting a file, right-clicking the Properties option, and pressing the Change button. This does not change the actual format of the file, but simply alters the Open With application list. The best defense is to encourage users to restrict their use of this facility.
A more serious problem can occur if the Registry is somehow violated. The HKEY_LOCAL_MACHINE\SOFTWARE\Classes key stores specific information on the application that is launched with each file extension. With Regedit or Regedit32, it is possible to remap a plain text file (.txt) extension, for example, to any application available in the system. Let's assume that someone has loaded a malign program that removes all files in the current working directory. Further, through access to the Administrator account, the Registry had been changed so that all .txt extension files are mapped to this damaging program. The obvious effect is that the next time anyone launches a text file, all files in that current working directory will be lost. This is just another reason to guard against unauthorized Registry modification.