Discussion:
Context Menu
(too old to reply)
David E. Ross
2024-03-28 20:10:22 UTC
Permalink
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?

I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
--
David E. Ross
<http://www.rossde.com/>

Demonstrators worldwide are demanding that Israel stop
fighting in Gaza. Why does it seem that no one is demanding
that Hamas stop fighting? And where are the demonstrations
against Russia fighting in the Ukraine.
J. P. Gilliver
2024-03-28 20:51:17 UTC
Permalink
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
Interesting! I too have that option in my context menu - but I have the
AVG icon (four-colour thing) by it.

Might be a setting in AVG ... (Though I can't see it in a quick look.)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

* SLMR 2.1a #113 * Tits like watermelons, sparrows like bacon rind.
- 03-22-97 Dave Beecham <***@pandbox.demon.co.uk> (quoted by
Gene Wirchenko, in alt.windows7.general, 2012-10-16.)
VanguardLH
2024-03-28 21:42:30 UTC
Permalink
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
https://www.majorgeeks.com/content/page/how_to_deleteaddand_edit_context_menu_items.html

Mentions CCleaner, but its Startup -> Context Menu panel only lets you
enable, disable, or delete current shell extensions. I've used the
Nirsoft Shell Extension Viewer that the article mentions. I recall
hearing about Context Menu, a shell extension editor, many years ago,
but I never used it.

Positions of entries in the context menu (and its submenus) don't change
until you install something else that adds a shell extension. So,
wherever the entry is shown now is the same place it will be shown
later. If you use the content menu a lot to run AVG on selected files,
it should be in the same place it was before.

As I recall, icons are image files the entries must look up. When
Windows load, it builds the shell extension list for the context menu,
but its the entries themselves that get the icons. Using the tools
above, like ShellExView, look at a content menu entry's properties to
see at what handler that entry points. Whether an .exe or .dll, the
icon would be a resource defined with the file. Not all of them will
have image resources. Each program registers itself in the registry,
like registering a DLL file that contains the resources, and it's the
DLL that handles the icon and name as resources. Because it's the
program that manages its resource, like icons, many context menu editors
just let you enable, disable, or delete context menu entries, and
possibly enable or disable the icon for those using the old style of
defining the resource in the registry. Users aren't going to re-write
the .exe or .dll files of a program to add an icon resource.

One of the tools listed at:

https://www.thewindowsclub.com/remove-click-context-menu-items-editors

might let you assign an icon to a shell extension entry. There's also:

https://www.sevenforums.com/tutorials/21878-context-menu-add-shortcuts-icons.html

as a guide to editing shell extension properties. However, that seems
to use the old style of registry entries to define resources for a shell
extension rather than registering a DLL from which the resources are
obtained. The old method may work depending on how AVG registers
itself.

The onus (of including an icon in their context menu entry) is really
upon AVG (owned by Avast). You could submit a request for enhancement
asking them to either specify an icon the old way, or add an icon
resource into their .exe or .dll file that is for their registered
handler in the registry defined as a shell extension. You could try
contacting AVG (https://www.avg.com/en-us/contacts#pc) to mention you
would like them to include an icon resource in their program that shows
up with its context menu entry.
J. P. Gilliver
2024-03-29 02:29:53 UTC
Permalink
Post by VanguardLH
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
[]
Post by VanguardLH
The onus (of including an icon in their context menu entry) is really
upon AVG (owned by Avast). You could submit a request for enhancement
asking them to either specify an icon the old way, or add an icon
resource into their .exe or .dll file that is for their registered
handler in the registry defined as a shell extension. You could try
contacting AVG (https://www.avg.com/en-us/contacts#pc) to mention you
would like them to include an icon resource in their program that shows
up with its context menu entry.
Was the icon there and it now isn't, or has it always been missing?

One thing to try is re-installing AVG (with or without uninstalling it
beforehand [obviously, if you're going to try uninstalling it, download
the installer then disconnect from the internet]). I hesitate to suggest
that, though, as AVG has so many settings and similar that I'd be
hesitant to do it, as I'd never get it back how I have it.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

Beauty is in the eye of the beer holder...
David E. Ross
2024-03-29 03:40:19 UTC
Permalink
Post by J. P. Gilliver
Post by VanguardLH
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
[]
Post by VanguardLH
The onus (of including an icon in their context menu entry) is really
upon AVG (owned by Avast). You could submit a request for enhancement
asking them to either specify an icon the old way, or add an icon
resource into their .exe or .dll file that is for their registered
handler in the registry defined as a shell extension. You could try
contacting AVG (https://www.avg.com/en-us/contacts#pc) to mention you
would like them to include an icon resource in their program that shows
up with its context menu entry.
Was the icon there and it now isn't, or has it always been missing?
One thing to try is re-installing AVG (with or without uninstalling it
beforehand [obviously, if you're going to try uninstalling it, download
the installer then disconnect from the internet]). I hesitate to suggest
that, though, as AVG has so many settings and similar that I'd be
hesitant to do it, as I'd never get it back how I have it.
It has been this way across several versions of AVG AntiVirus Free.
--
David E. Ross
<http://www.rossde.com/>

Demonstrators worldwide are demanding that Israel stop
fighting in Gaza. Why does it seem that no one is demanding
that Hamas stop fighting? And where are the demonstrations
against Russia fighting in the Ukraine.
JJ
2024-03-28 23:02:57 UTC
Permalink
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
Some choices...

https://www.majorgeeks.com/files/details/context_menu.html

https://www.majorgeeks.com/files/details/context_menu_editor.html

https://www.majorgeeks.com/files/details/context_menu_manager.html

Only context menu shell extensions can add sub menu items.

Menu items which are added by context menu shell extensions can not be
edited. Only the context menu shell extension can be enabled or disabled, to
remove/restore all of the menu items from specific context menu shell
extension.
Ed Cryer
2024-03-29 09:44:04 UTC
Permalink
Post by JJ
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
Some choices...
https://www.majorgeeks.com/files/details/context_menu.html
https://www.majorgeeks.com/files/details/context_menu_editor.html
https://www.majorgeeks.com/files/details/context_menu_manager.html
Only context menu shell extensions can add sub menu items.
Menu items which are added by context menu shell extensions can not be
edited. Only the context menu shell extension can be enabled or disabled, to
remove/restore all of the menu items from specific context menu shell
extension.
I've tried
https://www.majorgeeks.com/files/details/context_menu_manager.html
and it seems useful; certainly worth a look-at by the OP.

Ed
J. P. Gilliver
2024-03-29 11:19:48 UTC
Permalink
Post by Ed Cryer
Post by JJ
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
Some choices...
https://www.majorgeeks.com/files/details/context_menu.html
https://www.majorgeeks.com/files/details/context_menu_editor.html
https://www.majorgeeks.com/files/details/context_menu_manager.html
Only context menu shell extensions can add sub menu items.
Menu items which are added by context menu shell extensions can not be
edited. Only the context menu shell extension can be enabled or disabled, to
remove/restore all of the menu items from specific context menu shell
extension.
I've tried
https://www.majorgeeks.com/files/details/context_menu_manager.html
and it seems useful; certainly worth a look-at by the OP.
Ed
Looked good - it specifically says (on majorgeeks) "allows you to modify
menu names/icons", so should do what DER wants! Unfortunately (again on
MG) "The default language is Chinese, but the app will prompt you to
change it on the first run (app restart required)."; sure enough it did,
but that attempt popped up some security crash, and subsequent runs
didn't pop up the option! For me, anyway. Anyone know where it stores
the fact that it's been run so I can clear it and try again? It doesn't
"install" - it's just a single executable. (Well, two, with identical
functions, depending on whether you've got .NET 3.5 or 4.0; apparently
3.5 is part of 7.) It looks as if it's probably an excellent utility,
but I don't speak Chinese!
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

Our thorny national debate about Brexit could turn out to be irrelevant.
Sooner or later the EU as we know it may no longer be there for us to leave.
- Katya Adler, BBC Europe editor (RT, 2017/2/4-10)
Ed Cryer
2024-03-29 19:17:12 UTC
Permalink
Post by J. P. Gilliver
Post by Ed Cryer
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed.  When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon.  That means I have to read the text for each context
item to locate AVG's link.  I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
 Some choices...
 https://www.majorgeeks.com/files/details/context_menu.html
 https://www.majorgeeks.com/files/details/context_menu_editor.html
 https://www.majorgeeks.com/files/details/context_menu_manager.html
 Only context menu shell extensions can add sub menu items.
 Menu items which are added by context menu shell extensions can not be
edited. Only the context menu shell extension can be enabled or disabled, to
remove/restore all of the menu items from specific context menu shell
extension.
I've tried
https://www.majorgeeks.com/files/details/context_menu_manager.html
and it seems useful; certainly worth a look-at by the OP.
Ed
Looked good - it specifically says (on majorgeeks) "allows you to modify
menu names/icons", so should do what DER wants! Unfortunately (again on
MG) "The default language is Chinese, but the app will prompt you to
change it on the first run (app restart required)."; sure enough it did,
but that attempt popped up some security crash, and subsequent runs
didn't pop up the option! For me, anyway. Anyone know where it stores
the fact that it's been run so I can clear it and try again? It doesn't
"install" - it's just a single executable. (Well, two, with identical
functions, depending on whether you've got .NET 3.5 or 4.0; apparently
3.5 is part of 7.) It looks as if it's probably an excellent utility,
but I don't speak Chinese!
It went smoothly here.
I opened the Net 4.0 version, selected en-us language, and got presented
with a very user-friendly GUI, several context-menu items listed (not
all, of course; context-menu settings are so widely and madly scattered
that I'd bet not even MS's top programmer knows the full itinerary).
Anyway, I switched off a trial item, "open with Administrator" (which I
don't use and is mere clutter), and Bob's your uncle, it went.

Afterthought.
I did this in a Win10 environment. Maybe that accounts for the
J. P. Gilliver
2024-03-29 20:03:11 UTC
Permalink
[]
Post by Ed Cryer
Post by J. P. Gilliver
Post by Ed Cryer
I've tried
https://www.majorgeeks.com/files/details/context_menu_manager.html
and it seems useful; certainly worth a look-at by the OP.
Ed
Looked good - it specifically says (on majorgeeks) "allows you to
modify menu names/icons", so should do what DER wants! Unfortunately
(again on MG) "The default language is Chinese, but the app will
prompt you to change it on the first run (app restart required).";
sure enough it did, but that attempt popped up some security crash,
and subsequent runs didn't pop up the option! For me, anyway. Anyone
know where it stores the fact that it's been run so I can clear it
and try again? It doesn't "install" - it's just a single executable.
(Well, two, with identical functions, depending on whether you've got
.NET 3.5 or 4.0; apparently 3.5 is part of 7.) It looks as if it's
probably an excellent utility, but I don't speak Chinese!
It went smoothly here.
I opened the Net 4.0 version, selected en-us language, and got
presented with a very user-friendly GUI, several context-menu items
listed (not all, of course; context-menu settings are so widely and
madly scattered that I'd bet not even MS's top programmer knows the
full itinerary).
I tried the 3.5 version, and something opened, then something saying
(something like) would I like to use other than Chinese, then something
like "security problem; you can press Continue anyway", which I did. It
then came up (or remained up) in Chinese. I tried that (3.5) version
again, and it came up in Chinese, without the "do you want to change"
thing which crashed. I tried the 4.0 version, and that came up in
Chinese, again without the "do you want to change" popup. So it had
obviously logged _somewhere_ that I was past the first try. But I have
no idea where, so I can't clear the flag to get the change box - and
possibly crash message - again.
Post by Ed Cryer
Anyway, I switched off a trial item, "open with Administrator" (which I
don't use and is mere clutter), and Bob's your uncle, it went.
Afterthought.
I did this in a Win10 environment. Maybe that accounts for the difference.
Ed
I'm in 7-32.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

While no one was paying attention, weather reports became accurate and the
news became fiction. Did not see that coming. - Scott Adams, 2015
VanguardLH
2024-03-29 17:22:53 UTC
Permalink
Post by JJ
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu
I see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file
or folder, the context menu shows "Scan selected items for viruses"
but without any icon. That means I have to read the text for each
context item to locate AVG's link. I want to edit the item to show
AVG's icon, which would speed my ability to locate that link.
Some choices...
https://www.majorgeeks.com/files/details/context_menu.html
https://www.majorgeeks.com/files/details/context_menu_editor.html
https://www.majorgeeks.com/files/details/context_menu_manager.html
Only context menu shell extensions can add sub menu items.
Menu items which are added by context menu shell extensions can not
be edited. Only the context menu shell extension can be enabled or
disabled, to remove/restore all of the menu items from specific
context menu shell extension.
I've tried context_menu_manager and it seems useful; certainly worth a
look-at by the OP.
The Github project site is tough to read unless you know Chinese:

https://github.com/BluePointLilac/ContextMenuManager

Editing (the registry) to add/change an icon is the old way. The new
way is the program itself via resources in its .exe or .dll files. The
OP can try the old way (add a registry data item) to see if it works,
but if the program controls the entry properties (name, icon, etc) then
the old way gets ignored. When I've seen others noting of trying this,
the additional data item made no difference. It's worth a shot, though.
Probably can't hurt, but I'd save an image backup or export the registry
just in case.
Newyana2
2024-03-29 03:42:38 UTC
Permalink
"David E. Ross" <***@nowhere.invalid> wrote

| Is there a file or registry entry where I can edit the context menu I
| see when right-clicking on a file or folder?
|

There are multiple possibilities. HKCR\*\shell will
hold tiems that produce a menu for all files, like
"Open with Notepad". Shellex subkeys will create
items under the first horizontal line in the context
menu.

These same items can also be put under specific
keys, such as HKCR\.txt or HKCR\txtfile.

With folders it should be under HKCR\Folder or
HKCR\Directory.

Some are not easy to figure out. They may only point
to a CLSID. When you look that up under HKCR\CLSID
it may or may not tell you what the item is.

If you see propertysheet handler keys, those are
meant to add a tab to the Properties window.
J. P. Gilliver
2024-03-29 09:30:16 UTC
Permalink
Post by Newyana2
| Is there a file or registry entry where I can edit the context menu I
| see when right-clicking on a file or folder?
|
There are multiple possibilities. HKCR\*\shell will
hold tiems that produce a menu for all files, like
"Open with Notepad". Shellex subkeys will create
items under the first horizontal line in the context
menu.
These same items can also be put under specific
keys, such as HKCR\.txt or HKCR\txtfile.
With folders it should be under HKCR\Folder or
HKCR\Directory.
Some are not easy to figure out. They may only point
to a CLSID. When you look that up under HKCR\CLSID
it may or may not tell you what the item is.
If you see propertysheet handler keys, those are
meant to add a tab to the Properties window.
Assuming it _is_ in one or more of those places, DER would probably like
to know - since that's what he originally asked about! - what the entry
looks like that controls the _icon_ (where there is one) next to the
text, in the context menu. To repeat his query: he has the "Scan
selected items for viruses" entry in his context menu as I do, but
unlike mine, in his case, it doesn't have the AVG icon next to it. He
would like it to be there, as it makes it easier to see in a busy
context menu.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

did you hear about the guy who was frozen to absolute zero? He was 0K ...
- Jason in alt.windows7.general (and three other 'groups), 2018-5-1
Newyana2
2024-03-29 13:58:02 UTC
Permalink
"J. P. Gilliver" <***@255soft.uk> wrote


| To repeat his query: he has the "Scan
| selected items for viruses" entry in his context menu as I do, but
| unlike mine, in his case, it doesn't have the AVG icon next to it. He
| would like it to be there, as it makes it easier to see in a busy
| context menu.

His query was whether he can edit the context
menu in the Registry. Yes, he can. But it's complicated.
He may have options if the entry is under the shell key.
If it's under ShellEx (appearing on the menu under a
horizontal line) then that's a context menu handler,
which is a shell extension DLL that gets loaded. If there's
any control over that it will be in program settings. But
it's unlikely that such a setting would be provided.

So... figuring out where it's coming from would be the
first step. It's likely that David just has a different version
from yours, without an icon. But it's worthwhile knowing
the basics of how this works. (I've been finding that I need
to clean up a lot of junk in Win10, which can have very
long context menus, full of stuff I don't want.)
Newyana2
2024-03-29 17:08:24 UTC
Permalink
Expanding on that a bit, I just tested icon settings for
Shell keys. It works in 7 and 10, but not XP.

Say you have a menu like so:

Open
Edit
View
Open With Notepad
Open With...
_____________________
Add to PeaZip
Add to 7-Zip

Open with Notepad is a custom Shell menu and may
have an icon in Win7+. Any EXE file or ICO file may be
assigned. Presumably an EXE would use the format
"C:\something.exe,0" where 0 is the numeric offset of
the desired icon. If you just use "C:\something.exe" then
icon 0 is implied.

The Zip entries refer to shell extensions. I doubt they
can have icons, but I couldn't test it because I have no
shell extensions on my context menu.

A Shell menu item will look like so:

HKCR\*\Shell\

KEY: Open with Notepad
DEFAULT VALUE: "Open with Notepad"
STRING VALUE: "Icon" DATA: "C:\Icons\oldNotepad.ico"

KEY: Command
DEFAULT VALUE: "C:\Windows\notepad.exe %1"


A ShellEx entry will usually look like so:

HKCR\ShellEx\ContextMenuHandlers\

KEY: 7ZIPOps
DEFAULT VALUE: "{ABCDEF12-1234-1234-1234-1234567890AB}"

One could try adding an Icon value under the GUID. It may not
work, but one could try it. Another option would be to
remove the ShellEx entry, making that menu item disappear.
Then add a custom Shell entry. For example, there might be
a commandline for AVG, like:
""C:\Program Files\AVG\avg.exe /scan" %1"

So then you'd have something like so:

HKCR\*\Shell\

KEY: Scan with AVG
DEFAULT VALUE: "Scan with AVG"
STRING VALUE: "Icon" DATA: "C:\Program Files\AVG\avg.exe,3"

KEY: Command
DEFAULT VALUE: ""C:\Program Files\AVG\avg.exe /scan" %1"
Paul
2024-03-29 21:48:34 UTC
Permalink
Post by Newyana2
Expanding on that a bit, I just tested icon settings for
Shell keys. It works in 7 and 10, but not XP.
Open
Edit
View
Open With Notepad
Open With...
_____________________
Add to PeaZip
Add to 7-Zip
Open with Notepad is a custom Shell menu and may
have an icon in Win7+. Any EXE file or ICO file may be
assigned. Presumably an EXE would use the format
"C:\something.exe,0" where 0 is the numeric offset of
the desired icon. If you just use "C:\something.exe" then
icon 0 is implied.
The Zip entries refer to shell extensions. I doubt they
can have icons, but I couldn't test it because I have no
shell extensions on my context menu.
HKCR\*\Shell\
KEY: Open with Notepad
DEFAULT VALUE: "Open with Notepad"
STRING VALUE: "Icon" DATA: "C:\Icons\oldNotepad.ico"
KEY: Command
DEFAULT VALUE: "C:\Windows\notepad.exe %1"
HKCR\ShellEx\ContextMenuHandlers\
KEY: 7ZIPOps
DEFAULT VALUE: "{ABCDEF12-1234-1234-1234-1234567890AB}"
One could try adding an Icon value under the GUID. It may not
work, but one could try it. Another option would be to
remove the ShellEx entry, making that menu item disappear.
Then add a custom Shell entry. For example, there might be
""C:\Program Files\AVG\avg.exe /scan" %1"
HKCR\*\Shell\
KEY: Scan with AVG
DEFAULT VALUE: "Scan with AVG"
STRING VALUE: "Icon" DATA: "C:\Program Files\AVG\avg.exe,3"
KEY: Command
DEFAULT VALUE: ""C:\Program Files\AVG\avg.exe /scan" %1"
I tried a ProcMon, and I can't even see the context menu dynamically
loading an icon when the context menu pops up. Neither can I see
ashshell.dll loading at the time the context menu appears. It must
already be loaded into something.

David has been to the AVG tech support. And multiple threads like
this are not helping anyone. No one in their tech support knows
how to do more than "read off their card". I get the general
impression there is damage to the OS, which is why the suggestion
to "uninstall, clean, reinstall" will not achieve anything. I would
be the first to suggest that if there were *any* happy customers
in the support forum.

https://support.avg.com/answers?id=9060N000000gdI1QAI

ShellExView from Nirsoft allowed me to open the data handler
in my Windows registry for AVG's entry in context menus.

The data handler registry entry contains a pointer to ashShell.dll,
which does not contain the AVG icon.

I can find suggestions, that on Win7, there could be an interaction
between some change to the Aero setting or a theme selection or
the use of ClassicShell or the like, and whether some (but not all)
of the icons appear.

But I don't know exactly what kind of trace it's going to take,
to find an icon actually loading.

In my Procmon trace, I can see a burst of iconcache.db activity
right around the time in question, but that could be related
to some desktop icons repainting or something.

Walking through the registry has revealed no trace (ProcMon has "Jump To"
which will jump you from a registry event to the Regedit screen and
opens the registry item for you). Some threads found in Google, make
reference to icon extraction from AVGUI.exe , but the software has
likely changed since the discussion threads in question. And in my trace,
AVGUI.exe starts running, presumably as part of my "scan this" selection from
the right-click Context Menu. There's no icon activity.

If you look inside ashshell.dll with a hex editor, it "appears" to have
a preference stored "somewhere" which makes reference to a preference
for an icon (the preferences are stored in a "namespace" and then we
don't know if or when the namespace is dereferenced -- it could be in
memory or it could be a reference to the Registry). I can find "some"
preferences stored in a registry section, but not particularly a
convincing correlation and certainly not the named preference. Initially,
it looked like ashshell.dll was packed, but the exposed text strings
say it isn't packed. I don't know what the short burble near
offset zero is all about.

"The work of a thousand developers"

It might be easier to work on restoring an icon for some other
less-noteworthy program that isn't rendering. One that isn't
defensively designed.

Paul
Newyana2
2024-03-30 03:29:09 UTC
Permalink
"Paul" <***@needed.invalid> wrote

| "The work of a thousand developers"
|
| It might be easier to work on restoring an icon for some other
| less-noteworthy program that isn't rendering. One that isn't
| defensively designed.
|

I haven't used AV much over the years. I just
managed to remove the Windows Defender shell
extension from my Win10 context menus. :)

I seem to also remember a lot of corruption, like
various AV companies buying each other? There was
a recent story about Avast selling personal data:

https://www.bleepingcomputer.com/news/security/ftc-to-ban-avast-from-selling-browsing-data-for-advertising-purposes/

And this is not new. There's this from 4 years ago:

https://www.vice.com/en/article/qjdkq7/avast-antivirus-sells-user-browsing-data-investigation

And Avast owns AVG. I'm surprised that anyone still uses
this crap. It's bloated, sleazy and outdated. But I suppose
we can't just fault sleazy AV companies. They're sleazy
because no one wants to pay for the product
J. P. Gilliver
2024-03-30 08:30:09 UTC
Permalink
In message <uu80uf$pcls$***@dont-email.me> at Fri, 29 Mar 2024 23:29:09,
Newyana2 <***@invalid.nospam> writes
[]
Post by Newyana2
And Avast owns AVG. I'm surprised that anyone still uses
this crap. It's bloated, sleazy and outdated. But I suppose
we can't just fault sleazy AV companies. They're sleazy
because no one wants to pay for the product
Each to his own; I find AVG (I only use the free version) handy, e. g.
for a quick scan of newly-downloaded things, and it tells me whenever
something tries to go online (and I can choose block once, block always,
allow once, or allow always); OK, the occasional popups are mildly
irritating, but are at an acceptable to me level given I'm getting it
free.

There is a setting - albeit very buried, and it _may_ reset
occasionally! - that reduces the number of such popups, and/or
suppresses certain ones completely.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

"I'm not against women. Not often enough, anyway." - Groucho Marx
Newyana2
2024-03-30 12:53:41 UTC
Permalink
"J. P. Gilliver" <***@255soft.uk> wrote

| >
| and it tells me whenever
| something tries to go online (and I can choose block once, block always,
| allow once, or allow always

To my mind that's part of the problem. AV wants to be a firewall.
Firewalls want to be AV. It ends up very bloated. I've occasionally
downloaded a scanner for one-time use, but the whole approach
is pretty much outdated at this point. 0-days have become the
typical method of attack. No virus signatures for those. Also, "social
engineering". When you get attacked by an ad at the NYTimes
or a convincing scam email, it's not easy to avoid being fooled.

AV was a clever approach 20+ years ago. Remember that? Virus
signatures would come out once a month, typically about 1 MB.
Viruses were scripts written by wiseguys as practical jokes. For
example, "Melissa", written by a dumb office worker in .DOC script,
who was unaware that DOC files embed the author's personal info.
And at the time no one knew enough to disable MSOffice scripting.
So Melissa was a minor disaster across US businesses.

Last I saw, virus definitions were more like 300MB at intervals
during the day! And malware authors are people like the US NSA,
NSO in Israel, or state-run hacking operations in China. The entire
Earth's population has an opportunity to shear the wealthy sheep
of the first world, using tools built by the most brilliant and well
funded computer experts in the world. Hospitals with IT staff are
being compromised. United Health reportedly just paid $2 billion to
ransomware hackers, who then two-timed them, while poor people
have been unable to get prescriptions filled.
Linux software is being infected at the source.
Meanwhile people are banking and shopping online, letting script run
in their browser. What's wrong with this picture? (Speaking of which,
yesterday I saw where Google is warning that all Chrome users
should update NOW. They wouldn't explain the problem, but said
that malware can attack via webpage popups.)

I once ran MalwareBytes and it told me that I had 10 things to
fix. Among other things it wanted to "fix" a number of my custom
Registry settings and delete my boot manager EXE. It even had
an official virus species name for the boot manager. It didn't
say something like, "We're not sure about this one. You should
scan it with real AV." No. It said "This is Black.Plague.Blah.Blah.123.1.
Make for the exits!"

In retrospect I feel lucky that I didn't screw anything up running
Norton System Works on Win98. That picture of a doctor in a white
coat, and all the fancy listings of things fixed, made me feel like I'd
sent Win98 in for a day of beauty.

Of course I don't think AV is useless. But I do think it's limited,
bloated, and that people trust it too much.
J. P. Gilliver
2024-03-30 16:18:33 UTC
Permalink
Post by Newyana2
| >
| and it tells me whenever
| something tries to go online (and I can choose block once, block always,
| allow once, or allow always
To my mind that's part of the problem. AV wants to be a firewall.
Firewalls want to be AV. It ends up very bloated. I've occasionally
I've never got the thing that comes with 7 - whose icon is a bit of
castle wall - to work; I get a message saying something like "see your
administrator" whenever I start. (Since that's only every 2-4 weeks or
so, I'm not bothered.) Is that a firewall? So, I'm quite happy for AVG
to do it.
Post by Newyana2
downloaded a scanner for one-time use, but the whole approach
is pretty much outdated at this point. 0-days have become the
Unless the thing you want to scan is bigger than the scanner, I think
I'd probably _up_load it to one of the free online scanners, rather than
doing a one-time download.
Post by Newyana2
typical method of attack. No virus signatures for those. Also, "social
engineering". When you get attacked by an ad at the NYTimes
or a convincing scam email, it's not easy to avoid being fooled.
I haven't been yet. Famous last words I know, but I _think_ I'd
recognise one - and I have two system images (more against hardware
failure). And, how many of them work on 7 anyway.
Post by Newyana2
AV was a clever approach 20+ years ago. Remember that? Virus
signatures would come out once a month, typically about 1 MB.
Viruses were scripts written by wiseguys as practical jokes. For
I remember - even had a copy once (to inflict on colleagues) - from DOS
days, one which caused all the characters in your character-mode screen
to gradually fall into a heap at the bottom of the screen, in the manner
of some viruses seen in dramas at the time; restore just involved the
right key combination. (IIRR, it was one of the few things that ever
used the scroll lock key!) Yes, viruses were once mostly just jokes.
[]
Post by Newyana2
Last I saw, virus definitions were more like 300MB at intervals
Yes, I remember seeing that they were multiple times a day; not sure if
free AVG is that busy. Just looking - hmm, it says "Last updated: a
minute ago", so maybe it is. I'm extremely unaware of it interfering
with my use of the computer, though.
[]
Post by Newyana2
Linux software is being infected at the source.
Yes, people who believe that's immune are naïve. Even MacOS, I'm sure,
has some.
Post by Newyana2
Meanwhile people are banking and shopping online, letting script run
I've never got into online banking: I started telephone banking with one
of the first companies to offer it in the UK, as it seemed a good idea,
and my banking needs have never been such that I've felt the need to go
for more. I do buy on ebay, granted; I haven't got into grocery shopping
online, though could - at present, the fortnightly shop gets me out of
the house so I'll keep at it!
Post by Newyana2
in their browser. What's wrong with this picture? (Speaking of which,
yesterday I saw where Google is warning that all Chrome users
should update NOW. They wouldn't explain the problem, but said
that malware can attack via webpage popups.)
Hmm. I have the last Chrome that runs on 7-32, and haven't had any such
warnings. I'm sure I'm therefore vulnerable.
Post by Newyana2
I once ran MalwareBytes and it told me that I had 10 things to
fix. Among other things it wanted to "fix" a number of my custom
Registry settings and delete my boot manager EXE. It even had
an official virus species name for the boot manager. It didn't
say something like, "We're not sure about this one. You should
scan it with real AV." No. It said "This is Black.Plague.Blah.Blah.123.1.
Make for the exits!"
Yes, AVG regularly tells me I'm being slowed down by various things, and
a few things are risks. I ignore it; since one of the things that it
tells me are slowing me down are excessive junk files, and it's been a
_long_ time since excess files on the disc had any (discernible, anyway)
effect on the speed of the computer, I'm not impressed. (Of course, it's
telling me about these "problems" to get me to buy it: there's usually a
"fix them" button, which - after a few more clicks, if I bother clicking
it - tells me how much it's going to cost me.)
Post by Newyana2
In retrospect I feel lucky that I didn't screw anything up running
Norton System Works on Win98. That picture of a doctor in a white
coat, and all the fancy listings of things fixed, made me feel like I'd
sent Win98 in for a day of beauty.
Yes, I'm very wary of any automatic "fix", "tweak", "tidy", or "clean
up" type utilities, as they're very keen to change settings, some of
which I've deliberately set - not infrequently so long ago that I can't
_remember_ why I did, but nearly always for a good reason, so I don't
want them unset. Such utilities are keen to go ahead, often without
asking (or I think logging), so I treat them with great suspicion.
(Unless I know the author, but can't remember the last time I used
anything where I did. I think it might have been from Tony Helenius.)
Post by Newyana2
Of course I don't think AV is useless. But I do think it's limited,
bloated, and that people trust it too much.
Agreed on all four counts. I don't trust it _too much_ - see above - but
its firewall function is useful, as is its scanner.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

you can't blame boomers for everything. - Joe Queenan, RT 2023/6/24-30
Newyana2
2024-03-30 17:38:37 UTC
Permalink
"J. P. Gilliver" <***@255soft.uk> wrote

| I've never got the thing that comes with 7 - whose icon is a bit of
| castle wall - to work; I get a message saying something like "see your
| administrator" whenever I start.

That doesn't ring a bell. I don't know what it might be.
I have Private Firewall on 7. But recently I discovered
SimpleWall while setting up Win10. I like it very much.
It's a frontend to Windows firewall API, Windows
Filtering Platform. I don't know anything about that, but
SW is basic an does exactly what I want: Block all incoming,
and ask me when anything wants to go out. It seems to
filter EVERYTHING, without making exceptions for Windows
spyware, updating, etc.

| Unless the thing you want to scan is bigger than the scanner, I think
| I'd probably _up_load it to one of the free online scanners, rather than
| doing a one-time download.
|
I don't scan one thing. It's more like once in a great while
I get nervous and decide to do a system checkup for good
measure.
J. P. Gilliver
2024-03-30 19:47:20 UTC
Permalink
Post by Newyana2
| I've never got the thing that comes with 7 - whose icon is a bit of
| castle wall - to work; I get a message saying something like "see your
| administrator" whenever I start.
That doesn't ring a bell. I don't know what it might be.
Windows Defender maybe?
Post by Newyana2
I have Private Firewall on 7. But recently I discovered
SimpleWall while setting up Win10. I like it very much.
It's a frontend to Windows firewall API, Windows
Filtering Platform. I don't know anything about that, but
SW is basic an does exactly what I want: Block all incoming,
and ask me when anything wants to go out. It seems to
filter EVERYTHING, without making exceptions for Windows
spyware, updating, etc.
I had (under XP, possibly even earlier) a firewall I liked; I've
forgotten what it was called.
Post by Newyana2
| Unless the thing you want to scan is bigger than the scanner, I think
| I'd probably _up_load it to one of the free online scanners, rather than
| doing a one-time download.
|
I don't scan one thing. It's more like once in a great while
I get nervous and decide to do a system checkup for good
measure.
Gotcha.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

Electricians do it 'till it Hz.
Kerr-Mudd, John
2024-03-30 21:36:10 UTC
Permalink
On Sat, 30 Mar 2024 19:47:20 +0000
Post by J. P. Gilliver
Post by Newyana2
| I've never got the thing that comes with 7 - whose icon is a bit of
| castle wall - to work; I get a message saying something like "see your
| administrator" whenever I start.
That doesn't ring a bell. I don't know what it might be.
Windows Defender maybe?
Post by Newyana2
I have Private Firewall on 7. But recently I discovered
SimpleWall while setting up Win10. I like it very much.
It's a frontend to Windows firewall API, Windows
Filtering Platform. I don't know anything about that, but
SW is basic an does exactly what I want: Block all incoming,
and ask me when anything wants to go out. It seems to
filter EVERYTHING, without making exceptions for Windows
spyware, updating, etc.
I had (under XP, possibly even earlier) a firewall I liked; I've
forgotten what it was called.
Kerio? - KPF
- I'm still using it (on an XP box)
Post by J. P. Gilliver
Post by Newyana2
| Unless the thing you want to scan is bigger than the scanner, I think
| I'd probably _up_load it to one of the free online scanners, rather than
| doing a one-time download.
|
I don't scan one thing. It's more like once in a great while
I get nervous and decide to do a system checkup for good
measure.
Gotcha.
--
Electricians do it 'till it Hz.
--
Bah, and indeed Humbug.
J. P. Gilliver
2024-03-30 21:59:13 UTC
Permalink
Post by Kerr-Mudd, John
On Sat, 30 Mar 2024 19:47:20 +0000
Post by J. P. Gilliver
Post by Newyana2
| I've never got the thing that comes with 7 - whose icon is a bit of
| castle wall - to work; I get a message saying something like "see your
| administrator" whenever I start.
That doesn't ring a bell. I don't know what it might be.
Windows Defender maybe?
Post by Newyana2
I have Private Firewall on 7. But recently I discovered
SimpleWall while setting up Win10. I like it very much.
It's a frontend to Windows firewall API, Windows
Filtering Platform. I don't know anything about that, but
SW is basic an does exactly what I want: Block all incoming,
and ask me when anything wants to go out. It seems to
filter EVERYTHING, without making exceptions for Windows
spyware, updating, etc.
I had (under XP, possibly even earlier) a firewall I liked; I've
forgotten what it was called.
Kerio? - KPF
- I'm still using it (on an XP box)
[]
Yes! That's the one. IIRR, one had to stop at something like version
2.1.3, as that was sleek and self-contained, but later versions - I
forget what, but inferior. Can't remember if I tried it on 7. (Maybe
the good version wouldn't work.)
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)***@T+H+Sh0!:`)DNAf

It's quickly getting to a place where privacy will be cause for suspicion.
- Mayayana in alt.windows7.general, 2018-11-6.
Newyana2
2024-03-30 13:16:56 UTC
Permalink
"Paul" <***@needed.invalid> wrote
|
| I tried a ProcMon, and I can't even see the context menu dynamically
| loading an icon when the context menu pops up. Neither can I see
| ashshell.dll loading at the time the context menu appears. It must
| already be loaded into something.
|

As you probably know, a shell extension is an in-process
DLL run by Explorer. There's an API for it. Once you set
up the required Registry settings, Explorer will load your DLL
and provide access to its operations. So I'm guessing that any
action under ProcMon would be showing up as part of Explorer
generating the context menu. And there's an icon cache... So
any old context menu popping up during the day may be
working off Explorer's data cached in RAM, no?

I don't know. But a Shell entry, bypassing the shell extension,
with commandline, might be a cleaner way to do the job,
anyway. Then one can do as one likes, getting a chartreuse
skull and crossbones to show up on the context menu. :)

| David has been to the AVG tech support. And multiple threads like
| this are not helping anyone. No one in their tech support knows
| how to do more than "read off their card". I get the general
| impression there is damage to the OS, which is why the suggestion
| to "uninstall, clean, reinstall" will not achieve anything. I would
| be the first to suggest that if there were *any* happy customers
| in the support forum.
|
| https://support.avg.com/answers?id=9060N000000gdI1QAI
|

That exchange is more informative than David's post here.
I know what you mean about "reading off the card". I see
that a lot with Microsoft web forums. I have a problem. I do
a search. I find a relevant post. The official MS expert, sporting
official mickey mouse MS titles and certifications, tells
the poor person to run in safe mode, uninstall, reinstall, disable
extensions... a half day's worth of "ruling out" techniques. By
the end of it there's no actual answer to the question. Just
lots of polite posts: "Dear customer, thank you so much for
giving us a printout of your hardware specs. That will help. Now,
please try rebooting in safe mode and let us know what happens."
Paul
2024-04-02 04:04:23 UTC
Permalink
Post by David E. Ross
Is there a file or registry entry where I can edit the context menu I
see when right-clicking on a file or folder?
I have AVG AntiVirus Free installed. When I right-click on a file or
folder, the context menu shows "Scan selected items for viruses" but
without any icon. That means I have to read the text for each context
item to locate AVG's link. I want to edit the item to show AVG's icon,
which would speed my ability to locate that link.
The documentation on the web, shows one way to load a Shell Extension.
The procedure is relatively verbose. A person can see the registry
preference pointing to an icon source. Such a procedure makes
it possible for the (power) user to interact, and replace the icon
if damaged or incorrect.

What I'm finding though, is from a trace perspective, I'm not finding
that same "nice" procedure for AVG. There seems to be more than one
way to support a ShellEx.

AVG seems to have a shell extension (ashshell). You would think it would be
loaded into Explorer, but doing the trace, I can't really be
sure who it is loading into. There is also a "server" which AVG might
rendezvous with.

Now, what's interesting in your situation, is I did a Boot Trace
using Process Monitor. I had to select an older version, to try
to get procmon23.dll hidden injection to load. And I could hardly
tell what was alternately blocking it and allowing it to inject.
It's not necessarily AVG, and seems to be some patching some
twit did at Microsoft (without that individual alerting the
people who support Sysinternals ProcMon). At one time, doing
a Boot Trace actually worked well enough, anyone could use it.
It's a bit twitchy now and... annoying.

In any case, I got a trace. At 32 seconds into the Boot Trace,
I can see ashshell.dll load, and the CLSID is labeled as belonging
to the AVG shell extension.

Right before ashshell.dll starts to load (readfile, in chunks), there
is access to iconcache.db . Each OS has a slightly different design.
Windows 7 has a single file. Later OSes have a file-per-icon-size,
which is both nice and nasty. Nice, in that you would expect for
a ShellEx, a "certain size" of icon would be desired, and then
seeing it read that icon-size-file would help prove it was
fetching a context menu icon. Nasty, in that when you need to
rebuild your iconcache, you have to be careful what you delete.

We don't have that in this case. There is a tool which can
read iconcache.db , but it is a paid tool.

Summary: I think your issue is tied to iconcache.db .
There are procedures for "rebuilding" the iconcache.db.
Doing this requires a backup of C: first, because this
activity can end badly (one dude managed to bust his boot!).
In any case, your missing icon may actually be "living"
in an ever-so-slightly damaged iconcache.db . Without a utility
to reliably read iconcache.db , we cannot compare my working
iconcache.db, to your file.

The iconcache.db has a size which is defined by a registry setting.
If the actual collection of icons on your machine was too big,
the iconcache may need to be expanded.

[Picture] Original GIF file around 1,095,678 bytes

Loading Image...

[Picture] The CLSID in the trace, around the interesting bit, Regedit entry is here

Loading Image...

click Download Original, if you cannot view the image as you would like.

Paul

Loading...