On Thu, 16 Jun 2005 20:07:01 -0700, "Juliette"
For some odd reason now, everything on my desktop, and inside of my folders,
pictures with the extension of JPG and so forth are not able to be saved
unless i type in the extension also. I have no clue what could have triggered
such an error, and I have no clue how to fix it. If I go and try to rename a
file in my Pictures folder, for example, I can't rename it unless i type it
as...."image.jpg"....I can't just save it as plain old, "image" - what the
heck is going on? Does anyone know what happened or how to fix this? It's
driving me insane.
Well, there are always supposed to be appropriate file name
extensions; perhaps the system was adding them on your behalf?
The file name extension is the first cue to the OS as what is to be
done with the file. Once code chews on the file, it may veer off in a
different direction based on what it finds inside the file, but it's
the file name extension that generally gets the ball rolling.
It's important to see file name extensions, because they tell you
something about the risk level that the file presents to the system.
High-risk files will run as raw code, and can do anything; .exe, .com,
..scr, .cpl, .cmd are supposed to be code and will run as such, whereas
..bat and .pif are not supposed to be code but will run as such if they
contain raw code, once the OS chews on them.
Other high-risk files run as higher-level interpreted languages, which
can escalate to raw code power easily enough. These include .bas,
..bat (by design), all the script file extensions such as .vbs, .js,
..wsh etc., .hta, and a number of "data" file types that can contain
auto-running code; .doc, .xls, .htm, .html, .htt, .dot, .pps etc.
Then there are other high-risk types such as .rtf, which can carry
Word macros, .shs and .shb scrap files, .reg that merge straight into
the registry and can be used for attacks, etc.
So you want to see that a file is the type its expected to be. If
someone sends you a "data" file called ReadMe.doc.EXE, you want to see
that .EXE so you know it's likely to be higher-risk than expected, and
you want to kick the sender's ass for sending raw code pretending to
be safe(ish) "data". If you just saw ReadMe.doc, you'd have clicked.
Then again, some file name extensions are often hidden anyway, no
matter whether you set Windows Explorer to hide or reveal extensions.
Some of the most dangerous file types have both always-hidden
extensions *and* the ability to set their own icons (so as to look
like any "safe" file type they want to pretrend to be); .lnk and .pif
come to mind. A .lnk file is a shortcut that points to some file or
object on the system, and can pass parameters to it. A .pif is
supposed to be the same for DOS program files, but in a stunning bit
of cluelessness, Windows will recognise and run raw code within a
..pif, so the risk level is as high as it is for .EXE
Finally, due to defective code that fails to properly check material
before using it, some of the safest file types (.jpg, .ico, .cur) can
actually run as raw code, on an un(der)patched system.
So... be careful what you wish for. I'd say, learn your extensions
and use them explicitly.
------------------------ ---- --- -- - - - -
Forget
http://cquirke.blogspot.com and check out a
better one at
http://topicdrift.blogspot.com instead!
