• appwiz and RecycleBin have been hijacked by PDExplo.exe

    From micky@21:1/5 to All on Tue Jul 8 15:49:10 2025
    XPost: alt.comp.os.windows-11

    Win11, but I'm sure this applies to win10 too.

    I can't finish the thread about the company that wants to remote control
    my computer, until I solve this problem.

    Things went well last night. He was much more organized than the rest
    of his company. He installed the software I couldn't install, and I'll
    tell you how in a post in the existing thread, BUT

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and
    continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    And even though I had been to the RecycleBin once after he left and
    restored 2 confidential files, when I closed the Bin and tried to go
    there again, by Running shell:RecycleBinFolder or clicking on the
    RecycleBin desktop icon, instead it started and continues to start, PDExplo.exe!!!

    Sometimes it starts a new occurrence, up to 4 of them, and sometimes it doesn't. I don't know what other things there are that I haven't tried
    that don't work.

    I don't know what he could have done to cause these things but otoh I
    dind't do anything out of the ordinary either and post hoc ergo propter
    hoc.

    I am using OpenShell to make my GUI like win7/8, and when I click Start
    and right click Control Panel, the context menu for Control Panel starts
    with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
    Start, and Create Shortcut. I don't know when Powerdesk got added,
    yesterday or when I installed PowerDesk.

    Where is the list of Context Menus???? Can I delete PowerDesk from
    this list? Maybe that would help, although I don't see how since
    appwiz.cpl itself doesn't work. And what about Recycle Bin. No
    context menu is at all involved, nor is there one for
    shell:RecycleBinFolder

    Any other ideas?


    Also, I had my webbrowser open and he closed each window separately,
    instead of exiting the whole program. the Firefox setting is maximum of
    5 recently closed windows so I lost one or two windows. I will go
    through the history and probably find all the important tabs that were
    in them (though the History doens't indicate which window a url was in)
    , but I could have closed FF myself before he got there. I've changed
    the maximum to 15.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to NONONOmisc07@fmguy.com on Tue Jul 8 22:11:33 2025
    XPost: alt.comp.os.windows-11

    Ed, you are the person I know personally, not on the net, who afaik
    knows more about this stuff than anyone else. If you have any insighte
    or advice, remove NONONO if present and write me, or call me between
    11AM and midnight any day.

    This is also addressed to the very well informed members of win10 and
    win11 newsgroups.

    In alt.comp.os.windows-10, on Tue, 08 Jul 2025 15:49:10 -0400, micky <NONONOmisc07@fmguy.com> wrote:

    Win11, but I'm sure this applies to win10 too.

    I can't finish the thread about the company that wants to remote control
    my computer, until I solve this problem.

    Things went well last night. He was much more organized than the rest
    of his company. He installed the software I couldn't install, and I'll
    tell you how in a post in the existing thread, BUT

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and >continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    And even though I had been to the RecycleBin once after he left and
    restored 2 confidential files, when I closed the Bin and tried to go
    there again, by Running shell:RecycleBinFolder or clicking on the
    RecycleBin desktop icon, instead it started and continues to start, >PDExplo.exe!!!

    My debugging progress so far. Running Nir Sofer's RegScanner, I find in
    the registry 179 occurrences of appwiz, 9 of which with Key Modified
    Time (which means both *added* or modified, right?) of 3:08:20 PM today,
    which is just about when I tried to run appwiz (control panel Programs
    and Features) and it didn't work.

    The Data field says either Uninstall, Uninstall this program, Change,
    Change the installation of this program, Repair, Repair the installation
    of this program, Uninstall/Change, Uninstall or change this program, or Uninstall or change an application.

    So I was suspicous that the program had been deleted. Using Everything,
    I looked for it. And found 36 instances of appwiz, but only 14 that are appwiz.cpl. One of which is in sysWOW64, and 12 of which are in WinSxS, leaving only ONE that is in c:\Windows\System32.

    Sorting by date, 6 of them have the same modified date and time,
    yesterday at 3:37PM, over 4 hours before the remote control of my
    computer. Is this just a coincidence? My problem started 3 hours before
    he got involved, but the last registry changes happened 18 hours, 4
    hours in usage time, after he disconnected?

    One of the six is in sysWOW64, and 4 are in WinSxS, leaving only ONE
    that is in c:\Windows\System32. I presume that's the one that gets
    executed, not side-by-side or Wow. I have not yet investigated
    RecycleBin, which was also hijacked, so to speak, and there may be other programs that are not working now, but with regard to appwiz, it seems
    to me, the program was modified so much that it doesnt' work. It either explicitly refers calls to PDExplo.exe, or that is somehow the system
    default when someething doesn't work. Yes, there is a setting in
    PDWxplo (PowerDesk) called "Replace MS Explorer" and I have that
    checked. Since two different programs appwiz and RecycleBin both end up
    there, maybe it's the default. Yes, I guess MS Explorer was the default
    and PowerDesk is set to replace it. But reversing that would not bring
    back appwiz or RecycleBin.

    It seems to me I should find a good copy of appwiz and copy it in to
    System32. Is a copy good enough or does it need some sort of
    installation? Is there anything in the registry about this? After all
    appwiz appears 179 times in my registry. Do any of those others have to
    be changed, as installing them would change them.

    The current System32 appwiz is 628KB.
    6 of them are 74, 75 or 76KB
    3 are 522KB, 1 is 523KB,
    2 are 632KB, and 1 other is also 628KB
    That's quite a range for the same file, and there is no reason to think
    the 628K one is good. After all, it's not working.

    I suppose the best place to get a replacemnt is my Macrium image. I have
    images from June 2, 18, 20, and 28th. The first and fourth are long and
    the middle two are short. I won't take any more for fear of overlaying
    all the good ones, right?

    Is the Macrium Reflect image the best place to go? I don't know how to restore but if I can't understand web instructions, I'll post back.

    And I'll try and find the same information about RecycleBin. "shell:RecycleBinFolder" does not sound like a command I'll find in the registry, and the Properties for the RecycleBin shortcut do not include
    a targe or file name or really anything.

    RegScanner has an advantage over Regedit in that "In addition to the
    standard string search (Like in RegEdit), RegScanner can also find
    Registry values by data length, value type (REG_SZ, REG_DWORD, and so
    on), and by modified date of the key."

    So I will scan for anything modified yesterday at 3:37 PM. ....There
    were 126 registry items*** changed between 3 and 4PM yesterday. But I
    must have done something wrong because none of those 126 were the ....
    it's appwiz that got changed at 3:37, not the registry entry. So I was
    looking for the wrong time. I need a break. What say you guys about everything I've written except this last misguided paragraph.

    ***RegScanner insisted on at least one letter in the text search field
    and I used "a". I can easily have missed entries that didn't have an a.
    So forgetting I had done that is a second mistake I made. Since I'm
    looking for whatever random program may have been screwed up at the same
    time as appwiz, I don't know what letter to use and I don't know how to
    avoid this problem except by doing one search for every lone letter and
    merging the 26 results. But maybe it won't come to that.

    Am I proceeding in the right direction?

    Sometimes it starts a new occurrence, up to 4 of them, and sometimes it >doesn't. I don't know what other things there are that I haven't tried
    that don't work.

    I don't know what he could have done to cause these things but otoh I
    dind't do anything out of the ordinary either and post hoc ergo propter
    hoc.

    I am using OpenShell to make my GUI like win7/8, and when I click Start
    and right click Control Panel, the context menu for Control Panel starts
    with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
    Start, and Create Shortcut. I don't know when Powerdesk got added, >yesterday or when I installed PowerDesk.

    Where is the list of Context Menus???? Can I delete PowerDesk from
    this list? Maybe that would help, although I don't see how since
    appwiz.cpl itself doesn't work. And what about Recycle Bin. No
    context menu is at all involved, nor is there one for
    shell:RecycleBinFolder

    Any other ideas?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to micky on Tue Jul 8 22:50:16 2025
    XPost: alt.comp.os.windows-11

    On Tue, 7/8/2025 3:49 PM, micky wrote:
    Win11, but I'm sure this applies to win10 too.

    I can't finish the thread about the company that wants to remote control
    my computer, until I solve this problem.

    Things went well last night. He was much more organized than the rest
    of his company. He installed the software I couldn't install, and I'll
    tell you how in a post in the existing thread, BUT

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    And even though I had been to the RecycleBin once after he left and
    restored 2 confidential files, when I closed the Bin and tried to go
    there again, by Running shell:RecycleBinFolder or clicking on the
    RecycleBin desktop icon, instead it started and continues to start, PDExplo.exe!!!

    Sometimes it starts a new occurrence, up to 4 of them, and sometimes it doesn't. I don't know what other things there are that I haven't tried
    that don't work.

    I don't know what he could have done to cause these things but otoh I
    dind't do anything out of the ordinary either and post hoc ergo propter
    hoc.

    I am using OpenShell to make my GUI like win7/8, and when I click Start
    and right click Control Panel, the context menu for Control Panel starts
    with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
    Start, and Create Shortcut. I don't know when Powerdesk got added, yesterday or when I installed PowerDesk.

    Where is the list of Context Menus???? Can I delete PowerDesk from
    this list? Maybe that would help, although I don't see how since
    appwiz.cpl itself doesn't work. And what about Recycle Bin. No
    context menu is at all involved, nor is there one for
    shell:RecycleBinFolder

    Any other ideas?


    Also, I had my webbrowser open and he closed each window separately,
    instead of exiting the whole program. the Firefox setting is maximum of
    5 recently closed windows so I lost one or two windows. I will go
    through the history and probably find all the important tabs that were
    in them (though the History doens't indicate which window a url was in)
    , but I could have closed FF myself before he got there. I've changed
    the maximum to 15.



    https://www.asus.com/support/faq/1043917/

    [Apps & features]
    [Sort by] and select [Install date]
    [Filter by] and select [All drives]

    Which it is claimed, aligns the Apps in the order
    they were installed in.

    Otherwise, you would switch on Auditing, if you
    wanted some sort of Audit Trail for a visitor.

    Executable code does not need to be installed.
    A portable version can be copied onto the machine
    and used. a side effect, is such a software could
    install services or make changes suited to the
    conveniences it expects.

    The problem with designing butterfly nets,
    is you don't know what size of butterfly you have
    invited into the house.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to micky on Tue Jul 8 23:22:49 2025
    XPost: alt.comp.os.windows-11

    On Tue, 7/8/2025 10:11 PM, micky wrote:
    Ed, you are the person I know personally, not on the net, who afaik
    knows more about this stuff than anyone else. If you have any insighte
    or advice, remove NONONO if present and write me, or call me between
    11AM and midnight any day.

    This is also addressed to the very well informed members of win10 and
    win11 newsgroups.

    In alt.comp.os.windows-10, on Tue, 08 Jul 2025 15:49:10 -0400, micky <NONONOmisc07@fmguy.com> wrote:

    Win11, but I'm sure this applies to win10 too.

    I can't finish the thread about the company that wants to remote control
    my computer, until I solve this problem.

    Things went well last night. He was much more organized than the rest
    of his company. He installed the software I couldn't install, and I'll
    tell you how in a post in the existing thread, BUT

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and
    continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    And even though I had been to the RecycleBin once after he left and
    restored 2 confidential files, when I closed the Bin and tried to go
    there again, by Running shell:RecycleBinFolder or clicking on the
    RecycleBin desktop icon, instead it started and continues to start,
    PDExplo.exe!!!

    My debugging progress so far. Running Nir Sofer's RegScanner, I find in
    the registry 179 occurrences of appwiz, 9 of which with Key Modified
    Time (which means both *added* or modified, right?) of 3:08:20 PM today, which is just about when I tried to run appwiz (control panel Programs
    and Features) and it didn't work.

    The Data field says either Uninstall, Uninstall this program, Change,
    Change the installation of this program, Repair, Repair the installation
    of this program, Uninstall/Change, Uninstall or change this program, or Uninstall or change an application.

    So I was suspicous that the program had been deleted. Using Everything,
    I looked for it. And found 36 instances of appwiz, but only 14 that are appwiz.cpl. One of which is in sysWOW64, and 12 of which are in WinSxS, leaving only ONE that is in c:\Windows\System32.

    Sorting by date, 6 of them have the same modified date and time,
    yesterday at 3:37PM, over 4 hours before the remote control of my
    computer. Is this just a coincidence? My problem started 3 hours before
    he got involved, but the last registry changes happened 18 hours, 4
    hours in usage time, after he disconnected?

    One of the six is in sysWOW64, and 4 are in WinSxS, leaving only ONE
    that is in c:\Windows\System32. I presume that's the one that gets
    executed, not side-by-side or Wow. I have not yet investigated
    RecycleBin, which was also hijacked, so to speak, and there may be other programs that are not working now, but with regard to appwiz, it seems
    to me, the program was modified so much that it doesnt' work. It either explicitly refers calls to PDExplo.exe, or that is somehow the system
    default when someething doesn't work. Yes, there is a setting in
    PDWxplo (PowerDesk) called "Replace MS Explorer" and I have that
    checked. Since two different programs appwiz and RecycleBin both end up there, maybe it's the default. Yes, I guess MS Explorer was the default
    and PowerDesk is set to replace it. But reversing that would not bring
    back appwiz or RecycleBin.

    It seems to me I should find a good copy of appwiz and copy it in to System32. Is a copy good enough or does it need some sort of
    installation? Is there anything in the registry about this? After all appwiz appears 179 times in my registry. Do any of those others have to
    be changed, as installing them would change them.

    The current System32 appwiz is 628KB.
    6 of them are 74, 75 or 76KB
    3 are 522KB, 1 is 523KB,
    2 are 632KB, and 1 other is also 628KB
    That's quite a range for the same file, and there is no reason to think
    the 628K one is good. After all, it's not working.

    I suppose the best place to get a replacemnt is my Macrium image. I have images from June 2, 18, 20, and 28th. The first and fourth are long and
    the middle two are short. I won't take any more for fear of overlaying
    all the good ones, right?

    Is the Macrium Reflect image the best place to go? I don't know how to restore but if I can't understand web instructions, I'll post back.

    And I'll try and find the same information about RecycleBin. "shell:RecycleBinFolder" does not sound like a command I'll find in the registry, and the Properties for the RecycleBin shortcut do not include
    a targe or file name or really anything.

    RegScanner has an advantage over Regedit in that "In addition to the
    standard string search (Like in RegEdit), RegScanner can also find
    Registry values by data length, value type (REG_SZ, REG_DWORD, and so
    on), and by modified date of the key."

    So I will scan for anything modified yesterday at 3:37 PM. ....There
    were 126 registry items*** changed between 3 and 4PM yesterday. But I
    must have done something wrong because none of those 126 were the ....
    it's appwiz that got changed at 3:37, not the registry entry. So I was looking for the wrong time. I need a break. What say you guys about everything I've written except this last misguided paragraph.

    ***RegScanner insisted on at least one letter in the text search field
    and I used "a". I can easily have missed entries that didn't have an a.
    So forgetting I had done that is a second mistake I made. Since I'm
    looking for whatever random program may have been screwed up at the same
    time as appwiz, I don't know what letter to use and I don't know how to
    avoid this problem except by doing one search for every lone letter and merging the 26 results. But maybe it won't come to that.

    Am I proceeding in the right direction?

    Sometimes it starts a new occurrence, up to 4 of them, and sometimes it
    doesn't. I don't know what other things there are that I haven't tried
    that don't work.

    I don't know what he could have done to cause these things but otoh I
    dind't do anything out of the ordinary either and post hoc ergo propter
    hoc.

    I am using OpenShell to make my GUI like win7/8, and when I click Start
    and right click Control Panel, the context menu for Control Panel starts
    with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
    Start, and Create Shortcut. I don't know when Powerdesk got added,
    yesterday or when I installed PowerDesk.

    Where is the list of Context Menus???? Can I delete PowerDesk from
    this list? Maybe that would help, although I don't see how since
    appwiz.cpl itself doesn't work. And what about Recycle Bin. No
    context menu is at all involved, nor is there one for
    shell:RecycleBinFolder

    Any other ideas?

    PowerDesk Pro Explorer ("PDExplo.exe") is written by VCOM.
    If you see a VCOM reference in Google, that would be their
    main web site.

    https://support.vcom.com/support/solutions/articles/1000234310-i-was-using-powerdesk-for-a-while-with-no-problem-but-now-when-i-try-to-start-it-it-crashes-i-get-a

    C:\Progra~1\Ontrack\PowerDesk\pdexplo.exe

    Which suggests the path is

    C:\Program Files\Ontrack\PowerDesk\pdexplo.exe

    Have a look around there, and then check your Apps list
    and see if a dated entry is there, with a "Remove" or
    "Uninstall" option.

    The "shell:RecycleBinFolder" is a kind of URI, and taps
    into the features of shell32 or whatever. For example

    explorer.exe shell:RecycleBinFolder

    would take you there.

    It could be shell32.dll based, or something like ShellExperienceHost, but explorer.exe might be involved in processing the URI at some point.
    Since the Recycle Bin contents are name-encoded to prevent collisions,
    a listing created by the program in the example below (C++), might not
    reveal the restore-path of the item. Maybe there's an extra
    step to do that.

    In any case, I would work on "seeing the pest to the door", and
    properly uninstalling PowerDesk Pro, rather than playing at
    whacking moles, one mole at a time. You should not try to treat
    symptoms by leaving bandages all over the place. Work on the
    disease, not the symptoms.

    https://stackoverflow.com/questions/56528941/how-to-get-the-list-of-file-in-recycle-bin-by-using-c-sharp-console-application

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to micky on Wed Jul 9 06:12:18 2025
    XPost: alt.comp.os.windows-11

    micky wrote:

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    Is your day-to-day account an admin, or a standard account?

    Have you got a(nother) admin account you could try logging-on as, to see
    if appwiz works?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to nospam@needed.invalid on Wed Jul 9 02:11:03 2025
    XPost: alt.comp.os.windows-11

    In alt.comp.os.windows-11, on Tue, 8 Jul 2025 23:22:49 -0400, Paul <nospam@needed.invalid> wrote:

    Deleted a lot of my own stuff.

    Where is the list of Context Menus???? Can I delete PowerDesk from
    this list? Maybe that would help, although I don't see how since
    appwiz.cpl itself doesn't work. And what about Recycle Bin. No
    context menu is at all involved, nor is there one for
    shell:RecycleBinFolder

    Any other ideas?

    PowerDesk Pro Explorer ("PDExplo.exe") is written by VCOM.
    If you see a VCOM reference in Google, that would be their
    main web site.

    https://support.vcom.com/support/solutions/articles/1000234310-i-was-using-powerdesk-for-a-while-with-no-problem-but-now-when-i-try-to-start-it-it-crashes-i-get-a

    I think PowerDesk is a great program, but not the version I bought 3 or
    4 years ago.*** It had major problems and they gave me my money back.

    I found a free version from 15 or more years ago and that's what I use.
    It's had small problems in the last 36 hours but that is probably from
    the bad KB update I write about in my other post in this thread. Prior
    to that it was fine, except my verion is 16 bit or whatever, not 32 or
    64 whatever they have now, so it doesn't find 64 bit files like HOSTS. I
    would have to use File Explorer to find or edit that.

    C:\Progra~1\Ontrack\PowerDesk\pdexplo.exe

    Which suggests the path is

    C:\Program Files\Ontrack\PowerDesk\pdexplo.exe

    In my case it's C:\Programs\PowerDesk\pdexplo.exe

    Have a look around there, and then check your Apps list
    and see if a dated entry is there, with a "Remove" or
    "Uninstall" option.

    You want me to uninstall it, but what I read about the Windows update I installed on Tuesday makes me think that is the problem.

    The "shell:RecycleBinFolder" is a kind of URI, and taps
    into the features of shell32 or whatever. For example

    explorer.exe shell:RecycleBinFolder

    would take you there.

    It could be shell32.dll based, or something like ShellExperienceHost, but >explorer.exe might be involved in processing the URI at some point.
    Since the Recycle Bin contents are name-encoded to prevent collisions,
    a listing created by the program in the example below (C++), might not
    reveal the restore-path of the item. Maybe there's an extra
    step to do that.

    In any case, I would work on "seeing the pest to the door", and
    properly uninstalling PowerDesk Pro, rather than playing at

    If I uninstalled it, I would see File Explorer starting every time I
    tried to use appwiz or RecycleBin. That's no better.

    whacking moles, one mole at a time. You should not try to treat
    symptoms by leaving bandages all over the place. Work on the
    disease, not the symptoms.

    https://stackoverflow.com/questions/56528941/how-to-get-the-list-of-file-in-recycle-bin-by-using-c-sharp-console-application

    Interesting, and complicated. If MS doesn't come up with a better
    KB-thing, I'll reread this url.

    Paul

    *** Also, I'm mad at VCOM because I bought 2 programs from them and the
    backup program deleted and lost a gig of my files. (I didn't update it
    before running it, but I had just gottten it.) The other was multiboot
    and it was almost impossible to use and I found out that other multiboot programs are easy, but by then I was worn out. I haven't multibeet
    since. These were the only two programs I ever bought that didn't live
    up to their claims, and both were from VCOM.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to usenet@andyburns.uk on Wed Jul 9 02:19:28 2025
    XPost: alt.comp.os.windows-11

    In alt.comp.os.windows-10, on Wed, 9 Jul 2025 06:12:18 +0100, Andy Burns <usenet@andyburns.uk> wrote:

    micky wrote:

    Shortly after he was done, I found that when I tried to run appwiz.cpl
    or go to Contol Panel / Program and Features, instead it started and
    continues to start an alternate file manager, PowerDesk, PDExplo.exe.

    Is your day-to-day account an admin, or a standard account?

    Admin.

    Have you got a(nother) admin account you could try logging-on as, to see
    if appwiz works?

    No. In my follow-up post, I found out that appwiz.cpl was updated
    yesterday, July 7 at about 3:30 PM. Is it normal for appwiz.cpl to have
    a date other than when windows was installed, or earlier? Oh, yeah, of
    course. That reminds me, when was my last Windows update? Oh, yeah, it
    was that same day, July 7. I tried to get ready for the Remote Guy by
    being fully updated, by installing "2025-06 Cumulative Update Preview
    for Windows 11 Version 24H2 for x64-based Systems (KB5060829),
    Successfully installed on 7/7/2025".

    So that's what changed appwiz and probably RecycleBin. Surely I'm not
    the only one.

    Aha, link provided but I'll quote anything important, or even
    unimportant. https://www.windowslatest.com/2025/07/03/microsoft-confirms-windows-11-kb5060829-issues-but-you-can-safely-ignore-it/
    "Microsoft confirms Windows 11 KB5060829 issues, but you can safely
    ignore it" Ignore the updates or ignore the problems? ;-)
    In addition to the Alt + Tab cursor lag bug spotted by Windows Latest, Microsoft now says the optional patch causes Windows Firewall-related
    warnings in the Event Viewer. But don’t worry, you can safely ignore the errors. As first spotted by Windows Latest, Microsoft has quietly
    updated its support document on July 2 to acknowledge false Windows
    Firewall warnings.

    As per Microsoft, if you’re affected, you’ll see an event with 2042 in
    Windows Firewall With Advanced Security. The event points to a “Config
    Read Failed” warning and a “More data is available” message, but it
    doesn’t impact the system or the firewall in any manner.

    Microsoft says the Windows Firewall warning doesn’t go away if you
    restart the PC, and continues to appear in the event viewer. Microsoft
    urges you to stay calm as it doesn’t loosen your system security
    mechanisms, and it is a harmless error code that shouldn’t be there.

    Yeah, but I've lost access to the Recycle bin. That's not harmless.
    But I'll try to stay calm.

    According to Microsoft, these false warnings or errors are a result of
    an experimental feature that was added to Windows 11 24H2 via KB5060829,
    but Microsoft has nothing to share about that feature.

    So they are experimenting on us, like lab rats!

    Microsoft is working on a fix that will stop the system from throwing unnecessary event viewer errors and should hopefully appear with this
    July 2025 Patch Tuesday update.

    If you want a quick resolution, removing the June optional update from
    the Settings app can help you. Open Settings > Windows Update > Update
    History > Uninstall updates, locate KB5060829 and click Uninstall next
    to it. Then, restart your PC, and recheck the Event Viewer for any 2402 entries.

    It's 1:30 AM but tomorrow I may try this. (but read further). I
    did need to use both appwiz and RecycleBin, to investigate why he could
    install the software but not me, but I'm losing interest in that and may
    just wait until MS fixes what went wrong and sends another update. Is
    that guaranteed not to happen before Patch Tuesday, almost 7 days from
    now?


    Microsoft has not acknowledged Alt + Tab issues yet.

    My alt-tab seems to be working fine. I've used it all night.

    The last few updates have wrecked some third-party apps’ functionality
    in Windows 11 24H2 and are yet to be mitigated. Be it the Dirac Audio
    issue or the conflict with other apps, the problems aren’t stopping.

    However, most of these issues are fixable with a developer-side update
    that is unfortunately taking longer than ever. As usual, until the devs
    roll out a patch, PC with these apps cannot update to 24H2.

    Unless you already have!

    So it was only barely related to the Remote Guy, because I would
    not have checked Updates and installed this if he weren't expected.
    Another case where post hoc ergo propter hoc requires you to know what
    the first hoc really was.

    Also www.youtube.com/watch?v=bXVZvfWVbQg
    Major Windows Update Problem With KB5060829
    23,966 views Jul 7, 2025

    Almost 24,000 views in a day and a half!! People must pay attention
    to this guy: Britec09 876K subscribers. Wow. So it couldbe 35
    times as many if we wait a few days.

    Britec says:
    Don't install KB5060829 if you value your time. I lost taskbar and could
    not get it back. So I uninstalled update and ended up with grey screen
    of death. Spent whole day fixing the boot loop nightmare. Thanks
    Microsoft for forcing another bug ridden windows update.

    So I guess uninstalling it might be worse. I don't want a GSOD. Britec doesn't have any comments. At least my Taskbar is unchanged. So far,
    I've read or watched two webpages and no one is complaining about
    anything I'm complaining about, and I'm not complaing about anything
    they are. Go figure.

    He's in a loop, he uninstalls the update and restarts and immediately it schedules the same update for the next restart, which I infer he cannot
    yet stop. I thought MS figured out how to do this long ago. He's
    going to stop the windows update Service and then delte the update
    itself, in order to stop it from updatign. I'm only 2:40 into a 13
    minute video, but I'll post this now and watch the rest tomorrow.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to micky on Wed Jul 9 08:07:21 2025
    XPost: alt.comp.os.windows-11

    micky wrote:

    In my follow-up post, I found out that appwiz.cpl was updated
    yesterday, July 7 at about 3:30 PM. Is it normal for appwiz.cpl to have
    a date other than when windows was installed

    Yes, from updates.

    This Win11 machine was flattened and re-installed on 19th June (I know
    from the date when my C:\Users\%whatever% folder was created)

    searching the whole of C: drive for appwiz.cpl

    I see several of them dated 19th June (the day that windows was installed)

    I also see several of them dated 27th June, I didn't get any Windows
    updates on that day, but I did get KB5060829 on the 28th, the date of
    that update is the 26th

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to usenet@andyburns.uk on Wed Jul 9 22:10:35 2025
    XPost: alt.comp.os.windows-11

    In alt.comp.os.windows-10, on Wed, 9 Jul 2025 08:07:21 +0100, Andy Burns <usenet@andyburns.uk> wrote:

    micky wrote:

    In my follow-up post, I found out that appwiz.cpl was updated
    yesterday, July 7 at about 3:30 PM. Is it normal for appwiz.cpl to have
    a date other than when windows was installed

    Yes, from updates.

    This Win11 machine was flattened and re-installed on 19th June (I know
    from the date when my C:\Users\%whatever% folder was created)

    My personal user folder is date 7/8/2025 at 2:31PM, but is that th etime
    the folder was created, or the time the most recent file in it was
    updated? Four NTUSER.DAT files have that same update date/time

    searching the whole of C: drive for appwiz.cpl

    I see several of them dated 19th June (the day that windows was installed)

    I also see several of them dated 27th June, I didn't get any Windows
    updates on that day, but I did get KB5060829 on the 28th, the date of
    that update is the 26th

    But it didn't cause you any problems???


    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to micky on Thu Jul 10 10:06:29 2025
    XPost: alt.comp.os.windows-11

    micky wrote:

    My personal user folder is date 7/8/2025 at 2:31PM, but is that th etime
    the folder was created, or the time the most recent file in it was
    updated?

    files/folders have multiple datestamps, if you view properties, you see
    the created timestamp rather than modified

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andy Burns@21:1/5 to micky on Thu Jul 10 10:07:26 2025
    XPost: alt.comp.os.windows-11

    micky wrote:

    But it didn't cause you any problems???

    no, it opens the apps list fine,but I don't have pdexplo

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to Burns on Thu Jul 10 12:31:20 2025
    XPost: alt.comp.os.windows-11

    So Ed, the problem is solved. Even though I had made no changes to
    powerdesk, the cumulative update on Tuesday seems to have given it
    priority over the two other programs (and maybe others), but
    uninstalling fixed it and reinstalling it didn't break it.

    Details follow.

    In alt.comp.os.windows-10, on Thu, 10 Jul 2025 10:06:29 +0100, Andy
    Burns <usenet@andyburns.uk> wrote:

    micky wrote:

    My personal user folder is date 7/8/2025 at 2:31PM, but is that th etime
    the folder was created, or the time the most recent file in it was
    updated?

    files/folders have multiple datestamps, if you view properties, you see
    the created timestamp rather than modified

    Oh, yeah. The creation date is June 23.

    I don't know why that date... There were Cumulative Updates on June 20
    and June 26, but nothing on June 23,

    It's pretty amazing to me that not just files get replaced but
    directories get replaced and reloaded, even "my own" user directories.
    Would that not mean if I were to save something of my own in one of
    those directories, it would get deleted and lost during a system update?
    As to the bigger problem, I was waiting for another Windows update and KB5062553 25-06 Cumulative Update for Windows 11 came yesterday, just
    two days after I noticed and installed he previous one. I installed it
    today but it had no effect on my appwiz or RecycleBin. So I unchecked
    he box in PowerDesk, pdexp.exe, that said Replace MS Explorer and that
    had no effect. So I uninstalled PowerDesk and appwiz etc. worked fine
    again.

    So PowerDesk really did hijack those two functions even though it just
    sat there. I'm sure it was the Cumulative Update I installed on Tuesday
    that did it. Although I can't figure out how it did it.

    I had to reset all the PowerDesk settings. Some programs save that
    stuff, right?, for when you reinstall, but maybe this one does not
    because it was a free version of something they also sold.

    Anticipating this, I tried to find and save the settings. There is an
    ini file but it only has 3 lines in it, the usage count (to know when to
    nag me to buy a copy), the Date, and the SplashDate. The new
    installation doesn't have SplashDate, and all the dates are 32 coded
    alphabetic characters, which is a lot more than the 8 numbers it takes
    to give a date. I don't know why they encode the dates anyhow.

    BTW, the copyright on this free version 5 is 2002, but it's free
    forever, if anyone wants me to send them a copy. IIRC correctly it was written by another company that VCOM bought. OTOH, currently their
    page for PowerDesk https://www.vcom.com/power-desk-pro , just says for
    Win 7, 8, and 10. So no one is updating it for 11, and the copy I bought
    and returned for 10 had 2 big flaws. OTOH, v.5 had no flaws in 10, and
    and so far, none in 11,

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From J. P. Gilliver@21:1/5 to Andy Burns on Thu Jul 10 21:02:56 2025
    XPost: alt.comp.os.windows-11

    On 2025/7/10 10:6:29, Andy Burns wrote:
    []

    files/folders have multiple datestamps, if you view properties, you see
    the created timestamp rather than modified

    When I look at properties, I see three dates, for Created, Modified, and Accessed. And not infrequently, those dates are impossible based on my
    normal interpretation of those three words. For example, I just pulled
    them up for a file, and they're

    Created: 2025-May-26, 12:20:30
    Modified: 2023-May-6, 02:11:59
    Accessed: 2025-June-14, 18:57:41

    in other words, it's saying I created the file after I modified it (or
    modified it before I created it, take your pick). [And I'm pretty sure I
    never accessed it last month, either.]

    (The file is DesktopOK_2023-05-06_2-11-40_1366x768.dok, which suggests
    that's when I created - not modified! - it, though that wouldn't have
    been on this computer; so the "Created" date _might_ be correct.)
    --
    J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

    An act like Morecambe and Wise happens once in a lifetime. Why did it
    have to happen in mine?
    - Bernie Winters quoted by Barry Cryer, RT 2013/11/30-12/6

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Frank Slootweg@21:1/5 to J. P. Gilliver on Fri Jul 11 12:47:31 2025
    XPost: alt.comp.os.windows-11

    J. P. Gilliver <G6JPG@255soft.uk> wrote:
    On 2025/7/10 10:6:29, Andy Burns wrote:
    []

    files/folders have multiple datestamps, if you view properties, you see
    the created timestamp rather than modified

    When I look at properties, I see three dates, for Created, Modified, and Accessed. And not infrequently, those dates are impossible based on my
    normal interpretation of those three words. For example, I just pulled
    them up for a file, and they're

    Created: 2025-May-26, 12:20:30
    Modified: 2023-May-6, 02:11:59
    Accessed: 2025-June-14, 18:57:41

    in other words, it's saying I created the file after I modified it (or modified it before I created it, take your pick). [And I'm pretty sure I never accessed it last month, either.]

    (The file is DesktopOK_2023-05-06_2-11-40_1366x768.dok, which suggests
    that's when I created - not modified! - it, though that wouldn't have
    been on this computer; so the "Created" date _might_ be correct.)

    Your scenario happens if you *copy* an existing file. I.e the
    *original* file has Created: on or before 2023-May-6, but the *copy* of
    the file was created on 2025-May-26.

    Just as a test, I copied (with File Explorer Copy/Paste) a file which
    was Created/Modified/Accessed at 10:46.

    The copy has Created/Accessed at 14:39 (now), but Modified is still
    10:46.

    Because the file was copied, Accessed of the original file is now also
    14:39 (can't copy a file without accessing it).

    N.B. There are some tools which can set/reset certain timestamps after
    the fact, but a simple copy will do what I desrcibed.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kerr-Mudd, John@21:1/5 to Frank Slootweg on Fri Jul 11 14:05:58 2025
    XPost: alt.comp.os.windows-11, alt.comp.freeware

    On 11 Jul 2025 12:47:31 GMT
    Frank Slootweg <this@ddress.is.invalid> wrote:

    J. P. Gilliver <G6JPG@255soft.uk> wrote:
    On 2025/7/10 10:6:29, Andy Burns wrote:
    []

    files/folders have multiple datestamps, if you view properties, you see the created timestamp rather than modified

    When I look at properties, I see three dates, for Created, Modified, and Accessed. And not infrequently, those dates are impossible based on my normal interpretation of those three words. For example, I just pulled
    them up for a file, and they're

    Created: 2025-May-26, 12:20:30
    Modified: 2023-May-6, 02:11:59
    Accessed: 2025-June-14, 18:57:41

    in other words, it's saying I created the file after I modified it (or modified it before I created it, take your pick). [And I'm pretty sure I never accessed it last month, either.]

    (The file is DesktopOK_2023-05-06_2-11-40_1366x768.dok, which suggests that's when I created - not modified! - it, though that wouldn't have
    been on this computer; so the "Created" date _might_ be correct.)

    Your scenario happens if you *copy* an existing file. I.e the
    *original* file has Created: on or before 2023-May-6, but the *copy* of
    the file was created on 2025-May-26.

    Just as a test, I copied (with File Explorer Copy/Paste) a file which
    was Created/Modified/Accessed at 10:46.

    The copy has Created/Accessed at 14:39 (now), but Modified is still
    10:46.

    Because the file was copied, Accessed of the original file is now also 14:39 (can't copy a file without accessing it).

    N.B. There are some tools which can set/reset certain timestamps after
    the fact, but a simple copy will do what I desrcibed.

    I have 'Attribute Changer' by Romain Petges:

    https://www.petges.lu
    (Mine is an older vn: 6.0a)


    Xposted to acf,acow-10,acow-11

    --
    Bah, and indeed Humbug.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From J. P. Gilliver@21:1/5 to John on Fri Jul 11 16:24:27 2025
    XPost: alt.comp.os.windows-11, alt.comp.freeware

    On 2025/7/11 14:5:58, Kerr-Mudd, John wrote:
    On 11 Jul 2025 12:47:31 GMT
    Frank Slootweg <this@ddress.is.invalid> wrote:

    J. P. Gilliver <G6JPG@255soft.uk> wrote:

    []

    Created: 2025-May-26, 12:20:30
    Modified: 2023-May-6, 02:11:59
    Accessed: 2025-June-14, 18:57:41

    in other words, it's saying I created the file after I modified it (or
    modified it before I created it, take your pick). [And I'm pretty sure I >>> never accessed it last month, either.]

    []

    Your scenario happens if you *copy* an existing file. I.e the
    *original* file has Created: on or before 2023-May-6, but the *copy* of
    the file was created on 2025-May-26.

    Hm. I see where you're going. I still think modified-before-created
    looks odd, but I suppose it actually could be more useful the way it is.

    []

    N.B. There are some tools which can set/reset certain timestamps after
    the fact, but a simple copy will do what I desrcibed.

    I have 'Attribute Changer' by Romain Petges:

    https://www.petges.lu
    (Mine is an older vn: 6.0a)


    Xposted to acf,acow-10,acow-11


    I have https://www.nirsoft.net/utils/bulk_file_changer.html .--
    J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

    ... behaving morally does not require religious adherence.
    - The Right Rev Nigel McCulloch\Bishop of Manchester (Radio Times, 24-30 September 2011

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From micky@21:1/5 to this@ddress.is.invalid on Fri Jul 11 21:34:56 2025
    XPost: alt.comp.os.windows-11

    In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:



    N.B. There are some tools which can set/reset certain timestamps after
    the fact, but a simple copy will do what I desrcibed.

    I had failed to set the time in my camera (before I had a phone which
    took pictures) and after the pictures were taken and on the PC, I tried
    to reset the dates to be correct, and I made a real mess of it. I
    should have made a written plan before I started. And maybe the
    software was not obvious either -- let's blame that too. Don't remember
    what it was but it was free and simple and small, and I guess it
    required me to do to the thinking.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Frank Slootweg@21:1/5 to micky on Sat Jul 12 13:08:45 2025
    XPost: alt.comp.os.windows-11

    micky <NONONOmisc07@fmguy.com> wrote:
    In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:



    N.B. There are some tools which can set/reset certain timestamps after
    the fact, but a simple copy will do what I desrcibed.

    I had failed to set the time in my camera (before I had a phone which
    took pictures) and after the pictures were taken and on the PC, I tried
    to reset the dates to be correct, and I made a real mess of it. I
    should have made a written plan before I started. And maybe the
    software was not obvious either -- let's blame that too. Don't remember
    what it was but it was free and simple and small, and I guess it
    required me to do to the thinking.

    You're talking about the 'Date taken' attribute of a *picture*. But
    that is an (EXIF) attribute *in* the file, not the Created/Modified/
    Accessed attributes *of* the file (*any* file), which are being
    discussed in this part of the thread.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From J. P. Gilliver@21:1/5 to Frank Slootweg on Sat Jul 12 15:02:18 2025
    XPost: alt.comp.os.windows-11

    On 2025/7/12 14:8:45, Frank Slootweg wrote:
    micky <NONONOmisc07@fmguy.com> wrote:
    In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg
    <this@ddress.is.invalid> wrote:



    N.B. There are some tools which can set/reset certain timestamps after >>> the fact, but a simple copy will do what I desrcibed.

    I had failed to set the time in my camera (before I had a phone which
    took pictures) and after the pictures were taken and on the PC, I tried
    to reset the dates to be correct, and I made a real mess of it. I
    should have made a written plan before I started. And maybe the
    software was not obvious either -- let's blame that too. Don't remember
    what it was but it was free and simple and small, and I guess it
    required me to do to the thinking.

    You're talking about the 'Date taken' attribute of a *picture*. But
    that is an (EXIF) attribute *in* the file, not the Created/Modified/
    Accessed attributes *of* the file (*any* file), which are being
    discussed in this part of the thread.

    True: the EXIF data is _inside_ the file (though at least one of the created/modified/accessed dates _of_ the file will be the same, when it
    was created by the camera).

    One date-changing utility I used recently had _four_ lines it offered to
    let you change - the fourth one being the EXIF. It also let you change
    for each one the date and the time; this was handy for me, as I had a
    block of photos (it let me change several files at a time) where the
    times were right (a spread, as taken at different times) but the date
    was wrong, as I'd set the wrong date but the right time when setting the camera's clock. (Probably switched the month and day.) I'm irritated
    now, as it _isn't_ BulkFileChanger, and that was useful. (It let you
    change the "real" dates as well as the EXIF one.) Any idea what it was?
    (I'm puzzled, as I can't find it in my downloads, at least not by any recognisable name.)

    --
    J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

    "The right to be heard does not include the right to be taken
    seriously." - Hubert H. Humphrey

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)