Freeware utility manages shell extensions

Most shell extensions are useful and benign, but it's possible to add a malicious shell extension on your system. ShellExView displays the details of shell extensions installed on your computer, and allows you to easily disable and enable each shell extension.

Shell extensions are add-ins for Windows, which are usually installed by a host application and do things like create right-click context menus in Explorer for a program. Benign shell extensions are useful, but it's entirely possible to craft a malicious shell extension or, more commonly, to have one go bad after a program is damaged or uninstalled incorrectly. A mangled shell extension can cause everything from Explorer crashing on...

a right-click to random application exits.

ShellExView is a NirSoft utility designed to help a user or administrator get a handle -- pun not intended -- on shell extensions. It requires no installer, so it can be unpacked directly from its .zip file and run anywhere, or you can install on and run it from a USB flash drive. When run, it presents a detailed manifest of every shell extension it detects in the host system, along with what type of handler it is (i.e., context menu, property sheet, drag-and-drop handler and so on). Many shell extensions also include a brief description of the handler's function.

Double-clicking on a shell extension gives you a complete manifest of all its properties in one window, with each field broken out into a separate text field for easy marking and copying. If you select a shell extension and press F2, RegEdit opens up at the spot in the Registry where that shell handler has been registered. (This helps you determine if the corresponding CLSID entry in the registry is indeed valid or not.)

ShellExView also makes it easier to single out problem shell extensions in other ways. By default, any non-Microsoft shell extensions are tagged in pink. Sort on the "Company" column to quickly see shell extensions by creator, which can usually flush out any extensions without a digital signature (i.e., possibly bogus). The program also has column displays for file extensions (if any) are handled by a given extension; if you know that right-clicking on a certain kind of file is problematic, you can use this to filter likely suspects.




This was first published in September 2005

Dig Deeper on Windows Server Virtualization and Microsoft Hyper-V






Forgot Password?


Your password has been sent to: