AppWiz.cpl is also an interesting one as one can also supply additional commandline options to support other facility, such as add/remove Windows components. A complete command line looks something like this:
"C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\shell32.dll,Control_RunDLLAsUser "C:\WINDOWS\system32\appwiz.cpl",Add or Remove Programs
Obviously the cpl files were not corrupted. So I was intrigued and determine to find out why.
I decided to use ProcMon to monitor the operations on the faulty machine, in particular, on the launch operation of Rundll32.exe by Explorer.exe. At the same time, I used the same program to monitor the operations on a machine that was working properly. Then I could find out the reason by patiently comparing the two log file entries.
In the captured log file, I jumped to the "Process Create" entry of Explorer which was responsible for launching the Rundll32.exe process as my starting point. The properties, in particular the command line for Rundll32.exe, immediately gave me the clue. On the faulty machine, there was no command line argument to Rundll32.exe and that explained why double-clicking on a control panel applet did nothing except launching Rundll32.exe and then it immediately terminated itself as nothing to do.
Looking back up the operations sequence, the next clue to look for was the exefile's open command as this was the operation that composed the command line argument to launch an executable such as Rundll32.exe.
This is specified in:
HKCR\exefile\shell\open\command\(Default)
On the working machine, the value was:
"%1" %*But on the faulty one, it had this:
"%1"
The absence of %*, which meant to append the rest of the command line arguments, explained why the faulty machine did not launch the correct control panel applet as it failed to include any command line argument after the first one, which was Rundll32.exe.
Appending the %* to the exefile's open command fixed the problem.
No comments:
Post a Comment