Jump to content

EVERY HTTP LINK now opens with the default browser

Ambassador

By Ambassador
in Windows XP

 Share

Recommended Posts

Ambassador

Ambassador

Posted
Posted (edited)

Today I opened the Microsoft Update start menu shortcut since I hadn't updated Windows in awhile. To my surprise, a blank Internet Explorer window opened, and my default browser (Opera 10.10) opened, with the Microsoft Update link somehow being redirected to it.

I then tried opening the Microsoft link using the Internet Explorer Open dialog (File->Open). Again, the link redirected to Opera.

Very interested now, I tried opening the link through the Windows Explorer address bar, thinking it would redirect to an IE session. Instead, the link, once again, opened Opera. Even the Internet Explorer address bar was opening links in Opera.

So somehow I have made Opera truly the default browser :P. Which is pretty cool, though I am confused.

Has anybody else encountered this behaviour?

Edited by Ambassador
Link to comment
Share on other sites

Ambassador

Ambassador

Posted
  • Author
Posted (edited)

Tell us more about the XP install.

Default install?

Did you do something odd?

- Standard Windows XP SP3 install (no slipstream, no HFSLIP) with Windows Messenger/Netmeeting removed after install (yuck) with commands rather than manual deletion

- Office 2003 with Word, Excel, Powerpoint, and 2007 compatibility pack (Outlook updates are offered for no reason but ignored)

- All necessary hotfixes up to today installed

- Recently installed/uninstalled Internet Explorer collection for testing a site; this installation left some IE7/IE8 folders on my computer (don't know about registry modifications)

- Recently installed Minimalist Explorer Breadcrumbs

- Ran VBS script to re-enable Notepad toolbar

- Ran REG script to disable "web check" of file associations

- Opera 10.10 was always opening Internet Shortcuts properly (I've had trouble with this in the past)

- IE6 has been giving this error of late when attempting to Print or Print Preview.

- A few other minor registry tweaks (ThrobOff)

- Add NirSoft IE tweaks (IETestMode)

Do you want to see any specific parts of my registry?

EDIT: The reason why I bolded that part is because when Windows Explorer redirects the links to Opera, the redirections looks very consistent in relation to how links are redirected with IE7/IE8 installed.

Edited by Ambassador
Link to comment
Share on other sites
cluberti

cluberti

Posted
Posted

Can you get a process monitor log of it occurring? It sounds like the CLSIDs that normally point to IE for html document handling have been changed, but there are a ton of them - figuring out which is usually easier just by looking at a procmon and watching the registry activity as you click a link.

Link to comment
Share on other sites
Ambassador

Ambassador

Posted
  • Author
Posted (edited)

Can you get a process monitor log of it occurring? It sounds like the CLSIDs that normally point to IE for html document handling have been changed, but there are a ton of them - figuring out which is usually easier just by looking at a procmon and watching the registry activity as you click a link.

Gotcha. I ran Process Explorer and I believe it did record the occurrence. However, I cannot discern what it actually that process and what is not. Even within the second when the process occured there are still about 1500 log entries. Is there any way, besides excluding not relevant applications (which I have already done), to refine the results further?

EDIT: I'm not ignoring you FDV. I was writing a post the same time you posted. :P

Edited by Ambassador
Link to comment
Share on other sites
Ambassador

Ambassador

Posted
  • Author
Posted

Ok, the registry entries in the article from "[HKEY_CLASSES_ROOT\CLSID\{01E04581-4EEE-11d0-BFE9-00AA005B4383}]" to "[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]" appear to be identical. "[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExpView]" does not exist in my registry, but I think that is because of the differences between Windows 98 and XP. However, I did notice that in [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] that there a few IE7/IE8 entries, the ones I can easily recognize being "ITBar7Height" and "ITBar7Layout". Some of the CLSID entries present in that key may also be from IE7/IE8, but I'm not sure.

Link to comment
Share on other sites
cluberti

cluberti

Posted
Posted

No, CSV doesn't save a lot of info (just what you can see in the UI). I want access to things like the stack, command lines, loaded modules, etc - those are only saved in the PML format. You might just have to re-run the test and re-save the file is all.

Link to comment
Share on other sites
cluberti

cluberti

Posted
Posted

Ok, the registry entries in the article from "[HKEY_CLASSES_ROOT\CLSID\{01E04581-4EEE-11d0-BFE9-00AA005B4383}]" to "[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]" appear to be identical. "[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExpView]" does not exist in my registry, but I think that is because of the differences between Windows 98 and XP. However, I did notice that in [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] that there a few IE7/IE8 entries, the ones I can easily recognize being "ITBar7Height" and "ITBar7Layout". Some of the CLSID entries present in that key may also be from IE7/IE8, but I'm not sure.

I can tell you none of these reg values has anything to do with the issue, and procmon confirms it. It appears it's simply looking up and using the registered http handler:

Date & Time:	6/11/2010 8:36:00 AM
Event Class:	Registry
Operation:	RegQueryValue
Result:	SUCCESS
Path:	HKCR\HTTP\shell\open\command\(Default)
TID:	2936
Duration:	0.0000101
Type:	REG_SZ
Length:	70
Data:	"C:\Program Files\Opera\opera.exe"

Date & Time:	6/11/2010 8:36:03 AM
Event Class:	Registry
Operation:	RegQueryValue
Result:	SUCCESS
Path:	HKCR\HTTP\shell\(Default)
TID:	1232
Duration:	0.0000103
Type:	REG_SZ
Length:	10
Data:	open

Date & Time:	6/11/2010 8:36:03 AM
Event Class:	Registry
Operation:	RegQueryValue
Result:	SUCCESS
Path:	HKCR\HTTP\shell\open\ddeexec\(Default)
TID:	1232
Duration:	0.0000098
Type:	REG_SZ
Length:	10
Data:	"%1"

Date & Time:	6/11/2010 8:36:03 AM
Event Class:	Registry
Operation:	RegQueryValue
Result:	SUCCESS
Path:	HKCR\HTTP\shell\open\ddeexec\Application\(Default)
TID:	1232
Duration:	0.0000075
Type:	REG_SZ
Length:	12
Data:	Opera

Date & Time:	6/11/2010 8:36:03 AM
Event Class:	Registry
Operation:	RegQueryValue
Result:	SUCCESS
Path:	HKCR\HTTP\shell\open\ddeexec\Topic\(Default)
TID:	1232
Duration:	0.0000112
Type:	REG_SZ
Length:	24
Data:	WWW_OpenURL

Your registry says that Opera is the default handler for the HTTP protocol and shell links, so... Opera opens.

Link to comment
Share on other sites
Ambassador

Ambassador

Posted
  • Author
Posted (edited)
Your registry says that Opera is the default handler for the HTTP protocol and shell links, so... Opera opens.

Out of curiosity then, how is the registry setup up that allows HTTP links to be pass through to IE 7/IE 8 when those versions are installed?

I have a really strong feeling that this is related to running IE7/IE8 as part of the Internet Explorer Collection install. The "redirection" behaviour is almost identical to a previous experience I had using a Windows XP computer with IE7. I was testing using the IE6 gui that is copied to C:\WINDOWS\ie7, and every time I entered an address it would open IE 7, similarly to when I type an address into IE6 and Opera opens.

I'm hoping I'll be able to keep this tweak for future Windows installs, so I would definitely like to find the cause.

Or is it as easy as modifying file type associations?

Edited by Ambassador
Link to comment
Share on other sites
cluberti

cluberti

Posted
Posted

OK, couple of things:

Out of curiosity then, how is the registry setup up that allows HTTP links to be pass through to IE 7/IE 8 when those versions are installed?
Probably points to the locations of IE7 or IE8 wherever they were installed. Shell handlers are pretty basic - they usually have a path, a ddeexec handler (if they take ddeexec calls from the shell), and sometimes a CLSID or AppID if they're COM objects.
I have a really strong feeling that this is related to running IE7/IE8 as part of the Internet Explorer Collection install. The "redirection" behaviour is almost identical to a previous experience I had using a Windows XP computer with IE7. I was testing using the IE6 gui that is copied to C:\WINDOWS\ie7, and every time I entered an address it would open IE 7, similarly to when I type an address into IE6 and Opera opens.
This is part of the reason Microsoft doesn't support multiple versions of IE on a machine - they can all handle the dde open call, so what is here matters quite a bit. Also, C:\Windows\IE7 is supposed to be the IE6 backup when IE7 is installed - running IE6 from here gives you a mix of IE6 binaries and IE7 .dll files from system32 (IE is not a self-contained application). This is the other reason multiple IE versions aren't supported - you don't always have *only* IE6 (or IE7, or IE8) binaries loaded, even though it might appear to be working properly.
I'm hoping I'll be able to keep this tweak for future Windows installs, so I would definitely like to find the cause.

Or is it as easy as modifying file type associations?

You should be able to look at these locations for a working install with the version of IE you want to use (fire up a VM if necessary), and just copy the values from those locations. Again, if you want to see what it's doing, run procmon, watch registry access, and set a filter on "path / contains / http". That should be sufficient if you want to see it happen.
Link to comment
Share on other sites
fdv

fdv

Posted
Posted (edited)

Maybe I'm confused Cluberti, but... I set up a VM, set my http reg key to Opera (default http handler) JUST like in the log, and I cannot get Opera to launch within Windows Explorer.

So, if Ambassador navigated to the HKCR CLSID key and looked for "opera.exe" in all of the subkeys, that wouldn't tell us anything?

Edited by fdv
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...