On Tue, 7/8/2025 3:49 PM, micky wrote:

Win11, but I'm sure this applies to win10 too.

I can't finish the thread about the company that wants to remote control
my computer, until I solve this problem.

Things went well last night. He was much more organized than the rest
of his company. He installed the software I couldn't install, and I'll
tell you how in a post in the existing thread, BUT

Shortly after he was done, I found that when I tried to run appwiz.cpl
or go to Contol Panel / Program and Features, instead it started and continues to start an alternate file manager, PowerDesk, PDExplo.exe.

And even though I had been to the RecycleBin once after he left and
restored 2 confidential files, when I closed the Bin and tried to go
there again, by Running shell:RecycleBinFolder or clicking on the
RecycleBin desktop icon, instead it started and continues to start, PDExplo.exe!!!

Sometimes it starts a new occurrence, up to 4 of them, and sometimes it doesn't. I don't know what other things there are that I haven't tried
that don't work.

I don't know what he could have done to cause these things but otoh I
dind't do anything out of the ordinary either and post hoc ergo propter
hoc.

I am using OpenShell to make my GUI like win7/8, and when I click Start
and right click Control Panel, the context menu for Control Panel starts
with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
Start, and Create Shortcut. I don't know when Powerdesk got added, yesterday or when I installed PowerDesk.

Where is the list of Context Menus???? Can I delete PowerDesk from
this list? Maybe that would help, although I don't see how since
appwiz.cpl itself doesn't work. And what about Recycle Bin. No
context menu is at all involved, nor is there one for
shell:RecycleBinFolder

Any other ideas?

Also, I had my webbrowser open and he closed each window separately,
instead of exiting the whole program. the Firefox setting is maximum of
5 recently closed windows so I lost one or two windows. I will go
through the history and probably find all the important tabs that were
in them (though the History doens't indicate which window a url was in)
, but I could have closed FF myself before he got there. I've changed
the maximum to 15.

https://www.asus.com/support/faq/1043917/

[Apps & features]
[Sort by] and select [Install date]
[Filter by] and select [All drives]

Which it is claimed, aligns the Apps in the order
they were installed in.

Otherwise, you would switch on Auditing, if you
wanted some sort of Audit Trail for a visitor.

Executable code does not need to be installed.
A portable version can be copied onto the machine
and used. a side effect, is such a software could
install services or make changes suited to the
conveniences it expects.

The problem with designing butterfly nets,
is you don't know what size of butterfly you have
invited into the house.

Paul

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: A noiseless patient Spider (3:633/280.2@fidonet)

On Tue, 7/8/2025 10:11 PM, micky wrote:

Ed, you are the person I know personally, not on the net, who afaik
knows more about this stuff than anyone else. If you have any insighte
or advice, remove NONONO if present and write me, or call me between
11AM and midnight any day.

This is also addressed to the very well informed members of win10 and
win11 newsgroups.

In alt.comp.os.windows-10, on Tue, 08 Jul 2025 15:49:10 -0400, micky <NONONOmisc07@fmguy.com> wrote:

Win11, but I'm sure this applies to win10 too.

I can't finish the thread about the company that wants to remote control
my computer, until I solve this problem.

Things went well last night. He was much more organized than the rest
of his company. He installed the software I couldn't install, and I'll
tell you how in a post in the existing thread, BUT

Shortly after he was done, I found that when I tried to run appwiz.cpl
or go to Contol Panel / Program and Features, instead it started and
continues to start an alternate file manager, PowerDesk, PDExplo.exe.

And even though I had been to the RecycleBin once after he left and
restored 2 confidential files, when I closed the Bin and tried to go
there again, by Running shell:RecycleBinFolder or clicking on the
RecycleBin desktop icon, instead it started and continues to start,
PDExplo.exe!!!

My debugging progress so far. Running Nir Sofer's RegScanner, I find in
the registry 179 occurrences of appwiz, 9 of which with Key Modified
Time (which means both *added* or modified, right?) of 3:08:20 PM today, which is just about when I tried to run appwiz (control panel Programs
and Features) and it didn't work.

The Data field says either Uninstall, Uninstall this program, Change,
Change the installation of this program, Repair, Repair the installation
of this program, Uninstall/Change, Uninstall or change this program, or Uninstall or change an application.

So I was suspicous that the program had been deleted. Using Everything,
I looked for it. And found 36 instances of appwiz, but only 14 that are appwiz.cpl. One of which is in sysWOW64, and 12 of which are in WinSxS, leaving only ONE that is in c:\Windows\System32.

Sorting by date, 6 of them have the same modified date and time,
yesterday at 3:37PM, over 4 hours before the remote control of my
computer. Is this just a coincidence? My problem started 3 hours before
he got involved, but the last registry changes happened 18 hours, 4
hours in usage time, after he disconnected?

One of the six is in sysWOW64, and 4 are in WinSxS, leaving only ONE
that is in c:\Windows\System32. I presume that's the one that gets
executed, not side-by-side or Wow. I have not yet investigated
RecycleBin, which was also hijacked, so to speak, and there may be other programs that are not working now, but with regard to appwiz, it seems
to me, the program was modified so much that it doesnt' work. It either explicitly refers calls to PDExplo.exe, or that is somehow the system
default when someething doesn't work. Yes, there is a setting in
PDWxplo (PowerDesk) called "Replace MS Explorer" and I have that
checked. Since two different programs appwiz and RecycleBin both end up there, maybe it's the default. Yes, I guess MS Explorer was the default
and PowerDesk is set to replace it. But reversing that would not bring
back appwiz or RecycleBin.

It seems to me I should find a good copy of appwiz and copy it in to System32. Is a copy good enough or does it need some sort of
installation? Is there anything in the registry about this? After all appwiz appears 179 times in my registry. Do any of those others have to
be changed, as installing them would change them.

The current System32 appwiz is 628KB.
6 of them are 74, 75 or 76KB
3 are 522KB, 1 is 523KB,
2 are 632KB, and 1 other is also 628KB
That's quite a range for the same file, and there is no reason to think
the 628K one is good. After all, it's not working.

I suppose the best place to get a replacemnt is my Macrium image. I have images from June 2, 18, 20, and 28th. The first and fourth are long and
the middle two are short. I won't take any more for fear of overlaying
all the good ones, right?

Is the Macrium Reflect image the best place to go? I don't know how to restore but if I can't understand web instructions, I'll post back.

And I'll try and find the same information about RecycleBin. "shell:RecycleBinFolder" does not sound like a command I'll find in the registry, and the Properties for the RecycleBin shortcut do not include
a targe or file name or really anything.

RegScanner has an advantage over Regedit in that "In addition to the
standard string search (Like in RegEdit), RegScanner can also find
Registry values by data length, value type (REG_SZ, REG_DWORD, and so
on), and by modified date of the key."

So I will scan for anything modified yesterday at 3:37 PM. ....There
were 126 registry items*** changed between 3 and 4PM yesterday. But I
must have done something wrong because none of those 126 were the ....
it's appwiz that got changed at 3:37, not the registry entry. So I was looking for the wrong time. I need a break. What say you guys about everything I've written except this last misguided paragraph.

***RegScanner insisted on at least one letter in the text search field
and I used "a". I can easily have missed entries that didn't have an a.
So forgetting I had done that is a second mistake I made. Since I'm
looking for whatever random program may have been screwed up at the same
time as appwiz, I don't know what letter to use and I don't know how to
avoid this problem except by doing one search for every lone letter and merging the 26 results. But maybe it won't come to that.

Am I proceeding in the right direction?

Sometimes it starts a new occurrence, up to 4 of them, and sometimes it
doesn't. I don't know what other things there are that I haven't tried
that don't work.

I don't know what he could have done to cause these things but otoh I
dind't do anything out of the ordinary either and post hoc ergo propter
hoc.

I am using OpenShell to make my GUI like win7/8, and when I click Start
and right click Control Panel, the context menu for Control Panel starts
with PowerDesk . Below a line are Open, Pin to Quick Access, Pin to
Start, and Create Shortcut. I don't know when Powerdesk got added,
yesterday or when I installed PowerDesk.

Where is the list of Context Menus???? Can I delete PowerDesk from
this list? Maybe that would help, although I don't see how since
appwiz.cpl itself doesn't work. And what about Recycle Bin. No
context menu is at all involved, nor is there one for
shell:RecycleBinFolder

Any other ideas?

PowerDesk Pro Explorer ("PDExplo.exe") is written by VCOM.
If you see a VCOM reference in Google, that would be their
main web site.

https://support.vcom.com/support/solutions/articles/1000234310-i-was-using-powerdesk-for-a-while-with-no-problem-but-now-when-i-try-to-start-it-it-crashes-i-get-a

C:\Progra~1\Ontrack\PowerDesk\pdexplo.exe

Which suggests the path is

C:\Program Files\Ontrack\PowerDesk\pdexplo.exe

Have a look around there, and then check your Apps list
and see if a dated entry is there, with a "Remove" or
"Uninstall" option.

The "shell:RecycleBinFolder" is a kind of URI, and taps
into the features of shell32 or whatever. For example

explorer.exe shell:RecycleBinFolder

would take you there.

It could be shell32.dll based, or something like ShellExperienceHost, but explorer.exe might be involved in processing the URI at some point.
Since the Recycle Bin contents are name-encoded to prevent collisions,
a listing created by the program in the example below (C++), might not
reveal the restore-path of the item. Maybe there's an extra
step to do that.

In any case, I would work on "seeing the pest to the door", and
properly uninstalling PowerDesk Pro, rather than playing at
whacking moles, one mole at a time. You should not try to treat
symptoms by leaving bandages all over the place. Work on the
disease, not the symptoms.

https://stackoverflow.com/questions/56528941/how-to-get-the-list-of-file-in-recycle-bin-by-using-c-sharp-console-application

Paul

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: A noiseless patient Spider (3:633/280.2@fidonet)

In alt.comp.os.windows-11, on Tue, 8 Jul 2025 23:22:49 -0400, Paul <nospam@needed.invalid> wrote:

Deleted a lot of my own stuff.

Where is the list of Context Menus???? Can I delete PowerDesk from
this list? Maybe that would help, although I don't see how since
appwiz.cpl itself doesn't work. And what about Recycle Bin. No
context menu is at all involved, nor is there one for
shell:RecycleBinFolder

Any other ideas?

PowerDesk Pro Explorer ("PDExplo.exe") is written by VCOM.
If you see a VCOM reference in Google, that would be their
main web site.

https://support.vcom.com/support/solutions/articles/1000234310-i-was-using-powerdesk-for-a-while-with-no-problem-but-now-when-i-try-to-start-it-it-crashes-i-get-a

I think PowerDesk is a great program, but not the version I bought 3 or
4 years ago.*** It had major problems and they gave me my money back.

I found a free version from 15 or more years ago and that's what I use.
It's had small problems in the last 36 hours but that is probably from
the bad KB update I write about in my other post in this thread. Prior
to that it was fine, except my verion is 16 bit or whatever, not 32 or
64 whatever they have now, so it doesn't find 64 bit files like HOSTS. I
would have to use File Explorer to find or edit that.

C:\Progra~1\Ontrack\PowerDesk\pdexplo.exe

Which suggests the path is

C:\Program Files\Ontrack\PowerDesk\pdexplo.exe

In my case it's C:\Programs\PowerDesk\pdexplo.exe

Have a look around there, and then check your Apps list
and see if a dated entry is there, with a "Remove" or
"Uninstall" option.

You want me to uninstall it, but what I read about the Windows update I installed on Tuesday makes me think that is the problem.

The "shell:RecycleBinFolder" is a kind of URI, and taps
into the features of shell32 or whatever. For example

explorer.exe shell:RecycleBinFolder

would take you there.

It could be shell32.dll based, or something like ShellExperienceHost, but >explorer.exe might be involved in processing the URI at some point.
Since the Recycle Bin contents are name-encoded to prevent collisions,
a listing created by the program in the example below (C++), might not
reveal the restore-path of the item. Maybe there's an extra
step to do that.

In any case, I would work on "seeing the pest to the door", and
properly uninstalling PowerDesk Pro, rather than playing at

If I uninstalled it, I would see File Explorer starting every time I
tried to use appwiz or RecycleBin. That's no better.

whacking moles, one mole at a time. You should not try to treat
symptoms by leaving bandages all over the place. Work on the
disease, not the symptoms.

https://stackoverflow.com/questions/56528941/how-to-get-the-list-of-file-in-recycle-bin-by-using-c-sharp-console-application

Interesting, and complicated. If MS doesn't come up with a better
KB-thing, I'll reread this url.

Paul

*** Also, I'm mad at VCOM because I bought 2 programs from them and the
backup program deleted and lost a gig of my files. (I didn't update it
before running it, but I had just gottten it.) The other was multiboot
and it was almost impossible to use and I found out that other multiboot programs are easy, but by then I was worn out. I haven't multibeet
since. These were the only two programs I ever bought that didn't live
up to their claims, and both were from VCOM.


--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: Tweaknews (3:633/280.2@fidonet)

In alt.comp.os.windows-10, on Wed, 9 Jul 2025 08:07:21 +0100, Andy Burns <usenet@andyburns.uk> wrote:

micky wrote:

In my follow-up post, I found out that appwiz.cpl was updated
yesterday, July 7 at about 3:30 PM. Is it normal for appwiz.cpl to have
a date other than when windows was installed

Yes, from updates.

This Win11 machine was flattened and re-installed on 19th June (I know
from the date when my C:\Users\%whatever% folder was created)

My personal user folder is date 7/8/2025 at 2:31PM, but is that th etime
the folder was created, or the time the most recent file in it was
updated? Four NTUSER.DAT files have that same update date/time

searching the whole of C: drive for appwiz.cpl

I see several of them dated 19th June (the day that windows was installed)

I also see several of them dated 27th June, I didn't get any Windows
updates on that day, but I did get KB5060829 on the 28th, the date of
that update is the 26th

But it didn't cause you any problems???


--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: Tweaknews (3:633/280.2@fidonet)

J. P. Gilliver <G6JPG@255soft.uk> wrote:

On 2025/7/10 10:6:29, Andy Burns wrote:
[]

files/folders have multiple datestamps, if you view properties, you see the created timestamp rather than modified

When I look at properties, I see three dates, for Created, Modified, and Accessed. And not infrequently, those dates are impossible based on my normal interpretation of those three words. For example, I just pulled
them up for a file, and they're

Created: 2025-May-26, 12:20:30
Modified: 2023-May-6, 02:11:59
Accessed: 2025-June-14, 18:57:41

in other words, it's saying I created the file after I modified it (or modified it before I created it, take your pick). [And I'm pretty sure I never accessed it last month, either.]

(The file is DesktopOK_2023-05-06_2-11-40_1366x768.dok, which suggests that's when I created - not modified! - it, though that wouldn't have
been on this computer; so the "Created" date _might_ be correct.)

Your scenario happens if you *copy* an existing file. I.e the
*original* file has Created: on or before 2023-May-6, but the *copy* of
the file was created on 2025-May-26.

Just as a test, I copied (with File Explorer Copy/Paste) a file which
was Created/Modified/Accessed at 10:46.

The copy has Created/Accessed at 14:39 (now), but Modified is still
10:46.

Because the file was copied, Accessed of the original file is now also
14:39 (can't copy a file without accessing it).

N.B. There are some tools which can set/reset certain timestamps after
the fact, but a simple copy will do what I desrcibed.

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: NOYB (3:633/280.2@fidonet)

:
On 11 Jul 2025 12:47:31 GMT
Frank Slootweg <this@ddress.is.invalid> wrote:

J. P. Gilliver <G6JPG@255soft.uk> wrote:

On 2025/7/10 10:6:29, Andy Burns wrote:
[]

files/folders have multiple datestamps, if you view properties, you see the created timestamp rather than modified

When I look at properties, I see three dates, for Created, Modified, and Accessed. And not infrequently, those dates are impossible based on my normal interpretation of those three words. For example, I just pulled them up for a file, and they're

Created: 2025-May-26, 12:20:30
Modified: 2023-May-6, 02:11:59
Accessed: 2025-June-14, 18:57:41

in other words, it's saying I created the file after I modified it (or modified it before I created it, take your pick). [And I'm pretty sure I never accessed it last month, either.]

(The file is DesktopOK_2023-05-06_2-11-40_1366x768.dok, which suggests that's when I created - not modified! - it, though that wouldn't have
been on this computer; so the "Created" date _might_ be correct.)

Your scenario happens if you *copy* an existing file. I.e the
*original* file has Created: on or before 2023-May-6, but the *copy* of
the file was created on 2025-May-26.

Just as a test, I copied (with File Explorer Copy/Paste) a file which
was Created/Modified/Accessed at 10:46.

The copy has Created/Accessed at 14:39 (now), but Modified is still
10:46.

Because the file was copied, Accessed of the original file is now also 14:39 (can't copy a file without accessing it).

N.B. There are some tools which can set/reset certain timestamps after
the fact, but a simple copy will do what I desrcibed.

I have 'Attribute Changer' by Romain Petges:

https://www.petges.lu
(Mine is an older vn: 6.0a)


Xposted to acf,acow-10,acow-11

--
Bah, and indeed Humbug.

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: Dis (3:633/280.2@fidonet)

micky <NONONOmisc07@fmguy.com> wrote:

In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:

N.B. There are some tools which can set/reset certain timestamps after
the fact, but a simple copy will do what I desrcibed.

I had failed to set the time in my camera (before I had a phone which
took pictures) and after the pictures were taken and on the PC, I tried
to reset the dates to be correct, and I made a real mess of it. I
should have made a written plan before I started. And maybe the
software was not obvious either -- let's blame that too. Don't remember
what it was but it was free and simple and small, and I guess it
required me to do to the thinking.

You're talking about the 'Date taken' attribute of a *picture*. But
that is an (EXIF) attribute *in* the file, not the Created/Modified/
Accessed attributes *of* the file (*any* file), which are being
discussed in this part of the thread.

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: NOYB (3:633/280.2@fidonet)

In alt.comp.os.windows-10, on 12 Jul 2025 13:08:45 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:

micky <NONONOmisc07@fmguy.com> wrote:

In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

N.B. There are some tools which can set/reset certain timestamps after
the fact, but a simple copy will do what I desrcibed.

I had failed to set the time in my camera (before I had a phone which
took pictures) and after the pictures were taken and on the PC, I tried
to reset the dates to be correct, and I made a real mess of it. I
should have made a written plan before I started. And maybe the
software was not obvious either -- let's blame that too. Don't remember
what it was but it was free and simple and small, and I guess it
required me to do to the thinking.

You're talking about the 'Date taken' attribute of a *picture*. But
that is an (EXIF) attribute *in* the file, not the Created/Modified/
Accessed attributes *of* the file (*any* file), which are being
discussed in this part of the thread.

You're right. I forgot that it was Exif. But isn't that the date that
shows in a file manager

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: Tweaknews (3:633/280.2@fidonet)

On Tue, 7/15/2025 7:30 PM, micky wrote:

In alt.comp.os.windows-10, on 12 Jul 2025 13:08:45 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:

micky <NONONOmisc07@fmguy.com> wrote:

In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

N.B. There are some tools which can set/reset certain timestamps after >>>> the fact, but a simple copy will do what I desrcibed.

I had failed to set the time in my camera (before I had a phone which
took pictures) and after the pictures were taken and on the PC, I tried
to reset the dates to be correct, and I made a real mess of it. I
should have made a written plan before I started. And maybe the
software was not obvious either -- let's blame that too. Don't remember >>> what it was but it was free and simple and small, and I guess it
required me to do to the thinking.

You're talking about the 'Date taken' attribute of a *picture*. But
that is an (EXIF) attribute *in* the file, not the Created/Modified/
Accessed attributes *of* the file (*any* file), which are being
discussed in this part of the thread.

You're right. I forgot that it was Exif. But isn't that the date that
shows in a file manager

If you do Properties : Details on an image file

Origin

Date taken 4/2/2022 <=== An EXIF date (from inside the camera)

Near the bottom is the "File" section, containing file system metadata

File

Date created
Date modified

There can be more EXIF properties, than the Properties dialog lists.
But the Search Indexer is more likely to index via the listed properties,
than by any property the computer is ignoring.

*******

And you have to be "smarter than the average bear", to get this stuff to work. I have to look up the correct spelling for the "search" box property.
That's the AQS keyword.

https://learn.microsoft.com/en-us/windows/win32/lwef/-search-2x-wds-aqsreference

Property AQS keyword Example

Date taken datetaken datetaken:yesterday

If I do this, and I haven't used the SearchIndexer properly to index my
images in advance, this search takes forever (each file must be examined
for EXIF data).

datetaken:>2021

Some of the search fields in the past, popped up a calendar input
interface, for selecting a date. The "datetaken" on Windows 11 is not
doing that for me. That is why I had to pick a lame example like ">2021" .

Paul




--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: A noiseless patient Spider (3:633/280.2@fidonet)

micky <NONONOmisc07@fmguy.com> wrote:

In alt.comp.os.windows-10, on 12 Jul 2025 13:08:45 GMT, Frank Slootweg <this@ddress.is.invalid> wrote:

micky <NONONOmisc07@fmguy.com> wrote:

In alt.comp.os.windows-11, on 11 Jul 2025 12:47:31 GMT, Frank Slootweg
<this@ddress.is.invalid> wrote:

N.B. There are some tools which can set/reset certain timestamps after >> >the fact, but a simple copy will do what I desrcibed.

I had failed to set the time in my camera (before I had a phone which
took pictures) and after the pictures were taken and on the PC, I tried
to reset the dates to be correct, and I made a real mess of it. I
should have made a written plan before I started. And maybe the
software was not obvious either -- let's blame that too. Don't remember >> what it was but it was free and simple and small, and I guess it
required me to do to the thinking.

You're talking about the 'Date taken' attribute of a *picture*. But
that is an (EXIF) attribute *in* the file, not the Created/Modified/ >Accessed attributes *of* the file (*any* file), which are being
discussed in this part of the thread.

You're right. I forgot that it was Exif. But isn't that the date that
shows in a file manager

Paul already mentioned that 'Date taken' can be shown in the
Properties of a file (Properties -> 'Details' tab).

It can also be shown in a File Explorer (View ->) 'Details' file list,
by selecting the 'Date taken' attribute in the column headers. I.e.
right click on the Name/Date/Type/Size/Tags bar and select 'Date taken'
from the list.

--- MBSE BBS v1.1.1 (Linux-x86_64)
* Origin: NOYB (3:633/280.2@fidonet)