Windows 2000 PC's losing file associations

File extensions A-F are gone from folder file associations.  The ones that remain don't work anyway.  So basically all file associations are lost or become ineffective.  This is true for any user that logs in including local admin.

No applications have been installed and it does not appear to be a user instigated problem (users are in different departments and areas and they are generally well behaved).

The only way we can fix without re-imaging is to perform a Windows 2000 install repair, delete the original user profile and let the system create a new profile.  Of course, we then need to install all sorts of Windows updates.  The whole process is very time consuming.

1) Export the "HKEY_LOCAL_MACHINE\SOFTWARE\Classes" registry from a corrupted machine, as backup (This is all of the computer's file associations). Call it "FILEASSOCBKUP.REG" (Or whatever you want)

2) Do the same for another machine that has all of the correct file associations. Call it "GOODFILEASSOC.REG"


3) Import the "GOODFILEASSOC.REG" registry into the "Corrupted" computer.

4) Reboot.

This should fix most, if not all, of it as long as any added applications are accounted for.

As always, try this on a test box first.

Mirfster.

You may also need to do this for the "HKEY_CLASSES_ROOT".

Mirfster.

The suggested fix gets the user working until we can replace, reimage, or reinstall W2k on the PC.  However, it is a partial fix and doesn't identify the root cause of the problem.  

It's been a few weeks since the original posting and the problem continues to slowly occur (1 or 2 a day) throughout the company.  We haven't found any common thread that can tie these occurrences together.

Are there any common details that we can use to tie this to a particular source?

Like:

1)  On the machines this is happening to, do they have anything different than other non affected machines?

2)  Any new software recently deployed company wide?

3)  Any change in AntiVirus software?

Mirfster.

We can't identify any common thread other than it only happens on Windows 2000 amchines.  NT is unaffected.

No new apps being pushed out, no change in antivirus (we use Sophos).  It occurs in different departments, different locations throughout the building.  The problem can manifest itself during the middle of the day while the user is logged in or at login.

This is the most obscure problem I've ever encountered.

I am having the same probem. About 3 weeks it struck, again, 4 2000 servers and about 5 2000 workstations.
If it is not a virus - what then? A malicious user?
Any more suggestions?

wldesilv

It's still happening to us on gradual basis (one or two PC's every two weeks).  Please describe your environment, perhaps we can find a common thread.  Is it all Win2k, or do you have Novell/Linux/Unix products as well?  What antivirus?  Do you use Windows update?  Automated or manual?

Luckily, the problem hasn't struck our Win2k servers yet.

HB

You guys gave me a hint where to look! And, now I know how to solve this problem.
We are strictly a Microsoft enterprise wide corporation. No open source here!
First, I have a standby server that I just rebuilt because of this problem.
A Dell 6300 - Dual processor - 1GMEM - 170GBHDD Two partitions -
Raid 5 - Perc 2/i. WIN2000 Server - srvpack4 - Norton Corp Anti-Virus7.5 - All Microsoft updates are current.
Apps currently installed - Acrobat Reader 5.0 - Norton pcAnywhere 10.5 ( updated ) - Winzip7.0.

On the failed server the same config, plus many more apps. This is Process Control server.
The only thing that the failed server would respond to is Ctrl-Alt-Del, which I could bring up Taskman.exe. Explorer was not
running could not even begin to use Event Viewer, except remotely.
But I could execute regedit.exe, regedt32.exe, and get to the command prompt.
I did a cd to C:\Program Files\Common Files\Microsoft Shared\MSInfo and attempted to execute MSInfo32.exe.
The popup error box informed me that MMCNDMGR.DLL was not registered.
I then kicked off regedit and went searching for MMCNDMGR.DLL on the standby server. And found it in
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID - this key is loaded! I compared it to the key on the bad server.
And, wow, what a difference! On the bad server, there were only 2 entries!

Following the steps above, I created the exact same scenario - on the standby server - blank desktop, only responding
to Ctrl-Alt-Del and Taskman. I then Imported the good key to the standby server and rebooted. And lo and behold
everything was back to normal!
I then dug out my old copy of "Advanced Techical Reference - Windows NT Server 4.0", by John Enck, published by Que
Press; and reviewed the settings for Auditing Registry Entries. Which I have installed in Group Policies on our Active Directory.

Now, I believe that I have a malicious user. And, I am going to get him!

Thanks, again!