Bugtraq mailing list archives

Re: long filename issue in Win9x


From: Phaedrus <phaedrus-securityfocus () lycanon org>
Date: Wed, 18 Jul 2001 11:44:22 -0700

"R v. Dijk" <rd.engind () preciamolen nl> wrote:

RvD> try this :

RvD> make a 'PROGRAM.EXE' executable in your C:\, and reboot windows. 99% chance
RvD> it will start up something like this
RvD> "C:\PROGRAM files\Internet Explorer\blah blah /systray"

RvD> Now PROGRAM will be invoked, with then rest as a parameter list. This caused
RvD> me a headache, because I didn't know where to start

Better yet, create a batch file containing the following four lines,
and save it as "C:\Program.bat":

@echo Incorrect program launch detected!
@echo Incorrect command line:
@echo C:\Program %1 %2 %3 %4 %5 %6 %7 %8 %9
@pause

If this batch file gets launched on your system at startup time, it's
because of an installer bug in a program installed on the system.  On
a Win98/WinME system, you should be able to use msconfig's Startup tab
to find and disable the offending program.

The cause of this bug:  As Windows users are probably aware, there are
several mechanisms that can be used to launch a program at startup:
most notably, the Startup program group, a 'run=' directive in the
WIN.INI file, and the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and
RunOnce keys in the registry.  With any of these mechanisms, if the
pathname of the program being run contains any spaces, the full
pathname must be in quotes.  To be on the safe side, many installers
always put the pathname in quotes; this is fine too.  For example,
this would correctly launch the fictitious FooNet in /monitor mode at
startup time:

"C:\Program Files\FooNet\FooNet.exe" /monitor

If the installer program forgets to include the quotes, like this:

C:\Program Files\FooNet\FooNet.exe /monitor

then Windows will see the space in "Program Files" as a command line
delimiter; it will try to launch "C:\Program", and tell it to open
"Files\FooNet\Foonet.exe /monitor".  In the extremely likely event
that you don't have anything named "C:\Program" on your system, you'll
get a rather puzzling "Can't run C:\Program.exe" error dialog from
Windows.  If you install the "C:\Program.bat" batch file mentioned
earlier, you'll instead see:

Incorrect program launch detected!
Invalid command line:
C:\Program Files\FooNet\Foonet.exe /monitor
Press any key to continue...

Now, if you're a technically savvy user, you can use msconfig to
figure out exactly where this incorrect command line is being stored
(in the Startup group, the registry or WIN.INI), and use the
appropriate tool to fix the problem.  If you're not quite this
technically savvy, you can simply uninstall FooNet and mercilessly
harass its manufacturer for a bug fix.


Current thread: