Classic Shell is a free software for Windows that brings back several of the features that were modified or dropped in newer versions of the Windows operating system. The full list of features includes:

• The classic Windows start menu with eight available skins
• Classic Windows Explorer
• Classic Internet Explorer 9

Windows users can select which features they want installed on their system during installation. It is possible to only install the classic start menu for instance, or only classic Windows Explorer. Installation requires elevated privileges and changes are immediately available and visible without a system restart.

The classic Windows start menu for instance is available right after the installation finishes. The classic Windows Explorer menu on the other hand is only partially available.

A right-click on the toolbar and the selection of Classic Explorer Bar enables the toolbar in Windows Explorer. A click on the options button opens a configuration menu with interesting settings. Here it is possible to add or remove toolbar buttons from the Explorer toolbar and configure other features of Windows Explorer.

Some of the things that you can configure here is a different location bar layout (disable breadcrumbs), change the navigation pane style to XP classic or simple, enable sort headers in all view modes or to replace the file and folder conflict dialogs (file exists for instance when copying).

Classic Shell adds three configuration options to Microsoft’s Internet Explorer 9 web browser. It adds a caption to the title bar to display the page title there and shows the security zone and loading progress in the browser’s status bar.

Windows Vista or Windows 7 users who miss some of the features that they used to work with under Windows XP, should take Classic Shell for a test ride to see if it resolves some of the issues that they have.

The Open Source software is compatible with both 32-bit and 64-bit editions of the Windows operating system. Downloads are offered at the program homepage over at Sourceforge.

Attackers could exploit the vulnerability to infect Windows operating systems during connection of removable drives, if autoplay is enabled on the system. The attack uses a specifically prepared lnk-file, containing code that is executed because Windows Shell does not parse that parameter sufficiently.

Affected are all Microsoft operating systems since (and including) Windows XP. Microsoft mentions other attack scenarios besides removable devices. The vulnerability can also be exploited via WebDAV or network shares.

Microsoft mentions three mitigating factors in the security advisory. A successful attack will give the attacker the same rights as the active user. Limited usage rights would mean that the attack could have less impact than an attack on a system where the user has administrative rights.

Systems with autoplay disabled cannot be attacked during connection. A user would have to launch “Windows Explorer or a similar application and browse to the root folder of the removable disk” for the attack to be started.

Finally, “Blocking outbound SMB connections on the perimeter firewall will reduce the risk of remote exploitation using file shares”.

A patch is currently not offered, a workaround exists however. The following steps need to be completed to protect a computer system:

Disable the displaying of icons for shortcuts

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the “Changing Keys And Values” Help topic in Registry Editor (Regedit.exe) or view the “Add and Delete Information in the Registry” and “Edit Registry Data” Help topics in Regedt32.exe.

1. Click Start, click Run, type Regedit in the Open box, and then click OK
2. Locate and then click the following registry key:
   HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler
3. Click the File menu and select Export
4. In the Export Registry File dialog box, enter LNK_Icon_Backup.reg and click Save

   Note This will create a backup of this registry key in the My Documents folder by default

5. Select the value (Default) on the right hand window in the Registy Editor. Press Enter to edit the value of the key. Remove the value, so that the value is blank, and press Enter.
6. Restart explorer.exe or restart the computer.

Impact: Will disable all shortcut icons, which means for instance that all Windows 7 taskbar items or start menu items are showing as white icons, which makes identification hard to impossible.

Microsoft suggests to disable the WebClient service to block the most likely remote attack vector through the Web Distributed Authoring and Versioning (WebDAV) client service.

To disable the WebClient Service, follow these steps:

• Click Start, click Run, type Services.msc and then click OK.
• Right-click WebClient service and select Properties.
• Change the Startup type to Disabled. If the service is running, click Stop.
• Click OK and exit the management application.

Additional information are available at the Microsoft Security Advisory page and the Wilders Security forum.

Modules of current malware were first time detected by “VirusBlokAda” (http://anti-virus.by/en/) company specialists on the 17th of June, 2010 and were added to the anti-virus bases as Trojan-Spy.0485 and Malware-Cryptor.Win32.Inject.gen.2. During the analysis of malware there was revealed that it uses USB storage device for propagation.

You should take into consideration that virus infects Operation System in unusual way through vulnerability in processing lnk-files (without usage of autorun.inf file).

So you just have to open infected USB storage device using Microsoft Explorer or any other file manager which can display icons (for i.e. Total Commander) to infect your Operating System and allow execution of the malware.

Malware installs two drivers: mrxnet.sys and mrxcls.sys. They are used to inject code into systems processes and hide malware itself. That’s the reason why you can’t see malware files on the infected USB storage device. We have added those drivers to anti-virus bases as Rootkit.TmpHider and SScope.Rookit.TmpHider.2. Note that both drivers are signed with digital signature of Realtek Semiconductor Corp. (www.realtek.com).

Thus, current malware should be added to very dangerous category causes the risk of the virus epidemic at the current moment.

After we have added a new recordes to the anti-virus bases we are admitting a lot of detections of Rootkit.TmpHider and SScope.Rookit.TmpHider.2 all over the world.

Expect a patch soon that is addressing the issue.

The UP button was used in Windows XP to provide the user with an option to display the contents of the parent folder. Microsoft has removed the UP button and replaced it with a breadcrumb structure in the Explorer address bar since then.

These breadcrumbs can be clicked on to display the contents of the folders directly.

windows explorer breadcrumb

Every single directory level is directly accessible from the address bar. Some users, like Samer for instance, seem to prefer using the UP button instead.

Here are three options to navigate UP in Windows Explorer:

1. Breadcrumbs – This is the default option. Breadcrumbs are displayed in Windows Explorer and all the user needs to do is to click on a folder in the structure to display its contents.

2. Keyboard Shortcut – Most Windows users do not know that it is also possible to navigate up by pressing ALT-UP on the keyboard. This is the preferred option of keyboard junkies.

3. Using the UP button – Samer has all the instructions on this one. Windows Vista and Windows 7 users need to download and install the program Classic Shell to add the UP button. It requires ten steps of manual configuration in total as the button will not appear right after installation.

What’s left to say? How do you navigate in Windows Explorer? Let us know in the comments.

Other programs that get installed may also add new handlers to the Windows Explorer menu which are then available by right-clicking and selecting new from the Windows Explorer menu as well.

It happens every now and then that handlers are added to the menu that the computer user never makes use of. This is for instance the case for contact, bmp and jntfile documents on our test system. They are on the other hand displayed in the menu making the selection process of the file types that are actually used more complicated.

The free Open source program Shell New Handler offers the functionality to manage the new handlers in Windows Explorer. It displays all handlers with their name, description and Windows Registry path. A checkbox defines if the handler is displayed in Windows Explorer.

New handlers that are not needed can easily be disabled in Windows Explorer by unchecking them in the application. The changes are immediately visible in Windows Explorer.

Shell New Handler can be downloaded from its project website over at Sourceforge. It requires the Microsoft .net Framework 3.5 and runs fine on 32-bit and 64-bit Windows operating systems.

The application will display a configuration window after installation which is displaying the shell entries that have been added by the application. This includes copying the path, opening the command prompt, running files with parameters or opening notepad or paint.

Not all of the entries are needed though. It is possible to remove some entries from the context menu entry. New entries – called commands in the application – can be added as well. Every entry consists of a title, program name, arguments, directories and other variables that can be defined during creation. Entries can be moved around to change their position in the context menu.

It is for instance possible to add any executable file to the right-click context menu including specific launch parameters. Another interesting feature of Open++ is the ability to use short path and prompts for arguments when pressing keys on the keyboard at the same time.

The application is running as a rundll.exe process with about 3 Megabytes of computer memory usage after installation.

A way to manage the context menu entries would be to edit them right in the Windows Registry. A more secure solution is by the use of software like Shell Menu View by NirSoft. The portable software displays a list of all registered shell extensions of a Windows operating system with information like the menu name, the file extensions or the path of the application.

The tables can be sorted in various ways and there is a search to find that one extension that you want to edit right now. A right-click on any row in the software program opens a context menu that provides options to disable or enable an extension, open the Registry key of that extension or print a list of all or selected items.

ShellExView is a portable application that runs on most Windows operating systems but works best in Windows XP and Windows 2000 because they can make use of the disable feature.

Shell Enhancer adds some long needed functions to Windows and when I write Windows I mean Windows XP or newer versions. The main functions are window and task management each offering numerous options that make your live easier. I think I use some examples to explain some of the functions of Shell Enhancer.

With Shell Enhancer it is possible to resize windows without having to move the mouse to a border of it. Pressing the ALT key plus one of the mouse keys resizes the active window fluently to the desired size. The window can be moved, resized with two static sides and resized completely by using the hotkey and the mouse. It’s far easier to click anywhere in the window to resize it.

Some other functions that are provided are to minimize windows to the system tray, set the transparency level of windows, set automatic options for windows (when firefox started make it always on top and set the transparency level to 90%), a task switcher with preview option, hide desktop icons and activate mouse gestures.

We are not finished yet. Screen Corner Tasks can be configured. Those are tasks that are executed when the mouse is placed for a certain time in one of the screen corners.

And then we have the Hotkey Tasks Manager. You can import a list of preconfigured task that do all kind of things like opening the search engine with the search results of a phrase that you have marked, maximizing explorer windows, opening a link in a browser. Those are basic tasks but the application can process complex tasks as well. You could for instance run five applications in a row, create a system restore point after the termination of the third application, open notepad, insert text into notepad, close notepad, send keystrokes to a confirmation window and initiate system shutdown. All with one hotkey.

Shell Enhancer is an excellent software, it does not have such a large memory footprint if you consider all the functions that it offers. If you need one or more of those functions regularly or want to start certain programs or windows in certain states then you should give it a try. It might be a bit intimidating at the beginning but you get used to it pretty quickly.