eneam
mboxviewer writes to the registry incorrectly
Currently instead of just creating a registry key at Computer\HKEY_CLASSES_ROOT\.mbox, mboxviewer writes an additional key at Computer\HKEY_CLASSES_ROOT\[] which serves no discernible purpose:
As far as I know MBox Viewer doesn't write anything to registry under HKEY_CLASSES_ROOT. I searched the code and didn't find anything that would result in writing to HKEY_CLASSES_ROOT. There was request to enhance MBox Viewer to register itself as default application for .mbox class but I decided not to support such capability. Instead , user is free to make such register using standard Windows features. See #48
I checked my registry on my development machine Windows 10 and other machine Windows 11. I use both to run MBox Viewer except that on Windows 10 I tried to set MBox Viewer as default application for .mbox files. On development machine I tried Thunderbird. On development machine I see what you see but not on Windows 11 machine.
I believe somebody or some application other than MBox Viewer made the entries but I have no clear answer at this point. I will try to figure it out but also have question to you. Do or did you run mail viewers other than MBox Viewer on your machine ?
Mbox Viewer was the only one I've ever run on this machine (or any machine). And i downloaded it directly from this github releases page. Also this is a fresh windows install, only a few weeks old.
Thanks for update. Browsing registry I see a lot of xx_auto_file values, md_auto_file, tlog_auto_file, temp_auto_file, etc. Not sure who creates auto_file values and what they mean. I was browsing web but didn't find anything helpful. Unfortunately I don't have "virgin" Windows box and I am not sure how to resolve the issue. I let you know if I make progress on this issue. Thanks for raising the issue.
I think this might be the issue: https://security.stackexchange.com/questions/37437/unknown-asian-chinese-registry-keys
Windows registry keys are suppoeod to be written in UTF-16 LE. If ANSI strings are passed to the Windows Unicode API, it can result in registry key names containing mangled strings and like in this case ☐.
It is possible but it is difficult to prove who is doing that unless registry read/write history recording is enabled as suggested in
https://morgantechspace.com/2015/01/how-to-track-registry-changes-in-windows.html
All I know that MBox Viewer is not directly writing anything to HKEY_CLASSES_ROOT
Right now I am working to support the Arabic language. It is not simple because Arabic is the right-to-left reading language. In the meantime I will rename [] entry in HKEY_CLASSES_ROOT and HKEY_CURRENT_USER and see whether these entries reappear on my Windows 10 machine. As I mentioned, I don't see these entries under Windows 11.
I just tried to rename [] entries and I could not. When I rename [] under HKEY_CLASSES_ROOT I can't rename [] under HKEY_CURRENT_USER and vice versa. It complains that related "registry" file doesn't exists anymore. I renamed [].save back to original []. I may just remove [] under HKEY_CLASSES_ROOT and see what happens. I didn't decided yet.
I refreshed my registry understanding. I renamed [] to [].save under HKEY_CURRENT_USER and the [] key was removed from HKEY_CLASSES_ROOT automatically after I refreshed the view. I will monitor HKEY_CURRENT_USER to see whether the [] key reappears.