JeremyNicoll

Double-clicked .txt files sometimes don't open in text editor

Recommended Posts

XP Pro SP3  -  I don't know if this is an EAM or OA issue, sorry.  I installed both of those a couple of days ago.

 

Normally if I double-click a .txt file in Windows Explorer, it either opens in the already-running text editor, or starts the text editor up from scratch.  I also have an explicit WE context menu entry "Edit with Kedit" (along with similar 'Edit with Notepad', 'Edit with ...' options so I can explicitly open a file in the editor of my choice).  I'm finding that intermittently neither a double-click of a file nor an explicit choice of 'Edit with Kedit' will open such a file.  If I wait a few seconds and try again, sometimes it works....   Also a QuickLaunch button I have that launches a specific day-today notes .txt file is only intermittently working.

 

I've been using Kedit (a programmers' text editor based on IBM's Xedit mainframe editor) for years and never had this problem before.    Normally if, for example, one tries to edit a file that's locked by another app, Kedit will produce a suitable error message.  I don't know how Windows tells apps that they might want to load a file - is there a msg passed around apps that might wish to respond to a txt file and only if no app does, then the app is started?  It makes me wonder if such a message is being swallowed up by EAM or OA.

 

There's nothing that I can see in the EAM logs (in the db3 file) or the OA plain text firewall log.

 

I've noticed that if Kedit is running but doesn't have focus then when I double-click a .txt file in WE, the editor window does get focus even though it doesn't then open the file.  If - say - it couldn't access the file because at that instance EAM had it open, I would expect to see a 'file in use by another app' message from Kedit.

 

I thought that File Guard might be the problem.  I have it activated, set to "Additionally scan files when created or modified", and a few (very few) experiments suggest that whether or not "Only scan files with the following extensions" is selected makes a difference - txt files seem to open more reliably if "Only scan" is selected.   But not completely reliably.  But ".TXT" is in the list of files that will be scanned whether or not that option is selected so this can't be the reason... 

 

I tried turning FileGuard off.  Sometimes I can edit files and sometimes I cannot.

 

 

Share this post


Link to post
Share on other sites

I said "nothing in the OA plain text firewall log" ... and that's true.  But I just found loads of entries in the OA History (of alerts and actions) many of which mentionKedit, eg:

 

Program Guard: kernel event,12/03/2013 16:49:53,None,"OADriver: SendMessage, 2180 -> 440, Msg: 49413/c105 - Deny (watched)",2180 - KEDITW32.exe 440 - csrss.exe
Program Guard: kernel event,12/03/2013 16:45:56,None,"OADriver: PostMessage, 2828 -> 4044, Msg: 2034/7f2 - Deny (watched)",2828 - KEDITW32.exe 4044 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:45:42,None,"OADriver: PostMessage, 4084 -> 4044, Msg: 2034/7f2 - Deny (watched)",4044 - KEDITW32.exe 4084 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:45:33,None,"OADriver: PostMessage, 2264 -> 4044, Msg: 2034/7f2 - Deny (watched)",2264 - KEDITW32.exe 4044 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:43:41,None,"OADriver: SendMessage, 764 -> 440, Msg: 49413/c105 - Deny (watched)",440 - csrss.exe 764 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:43:24,None,"OADriver: SendMessage, 1940 -> 440, Msg: 49413/c105 - Deny (watched)",1940 - rundll32.exe 440 - csrss.exe
Program Guard: kernel event,12/03/2013 16:30:37,None,"OADriver: SendMessage, 2556 -> 440, Msg: 49413/c105 - Deny (watched)",2556 - KEDITW32.exe 440 - csrss.exe
Program Guard: kernel event,12/03/2013 16:20:46,None,"OADriver: PostMessage, 2648 -> 3572, Msg: 2034/7f2 - Deny (watched)",2648 - KEDITW32.exe 3572 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:20:43,None,"OADriver: PostMessage, 3432 -> 3572, Msg: 2034/7f2 - Deny (watched)",3432 - KEDITW32.exe 3572 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:20:37,None,"OADriver: PostMessage, 3068 -> 3572, Msg: 2034/7f2 - Deny (watched)",3068 - KEDITW32.exe 3572 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:20:07,None,"OADriver: PostMessage, 2088 -> 436, Msg: 2034/7f2 - Deny (watched)",2088 - KEDITW32.exe 436 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:19:53,None,"OADriver: PostMessage, 112 -> 436, Msg: 2034/7f2 - Deny (watched)",112 - KEDITW32.exe 436 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:19:51,None,"OADriver: PostMessage, 2408 -> 436, Msg: 2034/7f2 - Deny (watched)",2408 - KEDITW32.exe 436 - KEDITW32.exe
Program Guard: kernel event,12/03/2013 16:19:45,None,"OADriver: SendMessage, 436 -> 440, Msg: 49413/c105 - Deny (watched)",436 - KEDITW32.exe 440 - csrss.exe

 

I don't know how, or if, these relate to the behaviour I've seen.  It's sad too that none of this gets written to the FWnnnnnnnnnn.log file. 

 

In ProgramGuard, KEDITW32.EXE is Allowed, Trusted, Normal.   I'm not clear what it is that the history records say is being denied.  Even in the list of specific permissions etc for KEDITW32.EXE everything is either Allowed, or set to Ask.  I'm not being asked anything.

Share this post


Link to post
Share on other sites

Please try opening Online Armor, going to Programs in the list on the left, and make sure that KEDITW32.exe is added to the list as Trusted. You will need to right-click in the list to add something to it manually, and if you want to check the list and confirm that it is Trusted you will need to uncheck the option to "Hide trusted".

Share this post


Link to post
Share on other sites

You're right, I guess I overlooked that. ;)

We'll probably need some logs to see what the problem is. Please open Online Armor, go to Options in the menu on the left, click the little check box to enable debug mode, restart your computer, and then try reproducing your problem with opening text files. After that, please ZIP your entire logs folder (normally C:\Program Files\Online Armor\Logs), upload it to a website such as DepositFiles/BayFiles/etc (which one you use is up to you), and then copy and paste the link to download the file into a reply (or you can send it to me in a Private Message if you don't want the link posted publicly on the forums). Note that, if you don't have a utility such as 7-Zip, WinZip, or WinRar that you can ZIP files and folders by right-clicking on them, going to Send To, and clicking on Compressed (zipped) Folder.

Share this post


Link to post
Share on other sites

OK, I've changed the setting and am just shutting the machine down.  But it's time for bed, so it'll be at least 10-12 hours before I try to recreate the problem...  Thanks for your help.

Share this post


Link to post
Share on other sites

Sorry .... I've not yet had time to create the logs - hopefully tomorrow.

Not a problem. ;)

Share this post


Link to post
Share on other sites

I had a possibly related issue today with another program - something called DesktopOK - which I use to save desktop icon layouts so they can be restored to the same arrangement.  Some installers ruin desktop layouts and it's handy to be able to reset it.  

 

DesktopOK was listed in OA's Programs list as "Allow" but Trust was unknown.  When I started DesktopOK I got three OA alerts asking for various permissions which in each case I said "Allow" to, but didn't choose "Trust".  The app then presented its GUI.  When I clicked the 'Save' button (to save icon layouts) the app hung and had to be ended from task manager.  OA's History showed another instance of OA denying an attempt of one process sending a message to another, this time DesktopOK -> explorer.  

Share this post


Link to post
Share on other sites

It's possible that you have need to add the DesktopOK software's folder in Program Files to the exclusions list in Online Armor. You will find the exclusions list under Options, on the Exclusions tab. Just add the entire folder to the list, and make sure that Online Armor is set to exclude all subfolders and files as well.

Share this post


Link to post
Share on other sites

Did the March logs help?  Sometimes I have to double-click a file as many as 5 or 6 times before the app that's meant to load it will respond.  It's a nuisance.

Share this post


Link to post
Share on other sites

I'm confused. I don't have a private message from you on the 16th of March, the last one I have from you was sent on May 26th and last replied to on May 28th, and I cannot find in my history of sent messages an e-mail to Andrey on March 18th or a message to him over Skype... I find this even more odd since I normally would send the logs before replying and saying that I had sent them...

Do you still have a copy of the private message you sent me with the logs? I'll resend them and see if Andrey received them the first time.

Share this post


Link to post
Share on other sites

OK, I just sent Andrey the links via Skype. He'll take a look at them as soon as he can. ;)

Share this post


Link to post
Share on other sites

Andrey mentioned that it doesn't make sense that kedit should be trying to access csrss.exe (you may have to ask the guys who made kedit why it's doing that). The only recommendation he made was adding exclusions to Online Armor fro kedit, and see if that resolves the issue.

Share this post


Link to post
Share on other sites

I'll ask mansfield about csrss.exe

 

I added kedit to OA's exclusions yesterday on one machine, and first impressions is that it may have helped.  But I just added it on this machine; when eg I select 4 text files in a windows explorer window then r-click and choose open in kedit, two of the files did open ok.  OA's logs shows more messages being denied:

Share this post


Link to post
Share on other sites

I've also read, see: http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/csrssexe/26bba20c-2691-4d42-bec4-637436c53c4f

 that it's used for parts of "the 16-bit virtual MS-DOS environment.".   Kedit's a program that's been around for a LONG time, and I do note that the version I use runs from a program: C:\Program Files\~M-folder\MansfieldSoftware\KEDITW16\Keditw32.exe   - I wonder if the "KEDITW16" part of that implies code running in some sort of 16-bit mode?

Share this post


Link to post
Share on other sites

I've also just tried selecting four files and r-clicking the group and choosing Edit with Notepad.  The four files all did open in notepad ok.. but here's the really odd thing about thta - OA is again recording messages being denied, between Notepad and csrss.exe:

Share this post


Link to post
Share on other sites

Oh - the "Edit with Notepad" context menu is something I defined under key

 

HKEY_CLASSES_ROOT\*\shell\Edit with Notepad\command    as    notepad.exe "%1"

Share this post


Link to post
Share on other sites

I have to confess that the "16" in "\KEDITW16" is irrelevant.  It's my fault and only means I'd installed Kedit V1.6.

 

Mansfield Software have replied about the csrss.exe issue saying:

 

I'm not really familiar with CSRSS - it is certainly nothing that KEDIT knowingly makes use of, although Windows may make use of it behind the scenes when handling API calls that KEDIT makes. (Versions of KEDIT up through 1.6 - never tested 1.6.1 - would work OK on Windows 98 and Windows ME, which based on the Wikipedia article about CSRSS did not even include CSRSS.)

 

 

They also commented on message-passing:

 

You are right that when KEDIT starts up, it normally looks around to see if another copy is already running and if so passes control to that copy of KEDIT. The newly-started instance of KEDIT uses the Windows PostMessage API to send a message to the existing instance of KEDIT. (Command line and directory are passed to the existing instance of KEDIT by using GlobalAddAtom to create an global atom table entries holding this info; the indices of these two global atom table entries are passed to the previously existing instance via the WPARAM and LPARAM parameters of the PostMessage API.)

Share this post


Link to post
Share on other sites

I've also read, see: http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/csrssexe/26bba20c-2691-4d42-bec4-637436c53c4f

 that it's used for parts of "the 16-bit virtual MS-DOS environment.".   Kedit's a program that's been around for a LONG time, and I do note that the version I use runs from a program: C:\Program Files\~M-folder\MansfieldSoftware\KEDITW16\Keditw32.exe   - I wonder if the "KEDITW16" part of that implies code running in some sort of 16-bit mode?

The explanation at that link says "Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS", but I don't see any mention in the article of non-Microsoft applications directly accessing CSRSS.

I'll see if Andrey has some more input on this, and we'll go from there. ;)

Share this post


Link to post
Share on other sites

Andrey wants me to do some testing of this, and see if we can determine what's going on. I'll let you know if we find anything. ;)

Share this post


Link to post
Share on other sites

I haven't been able to replicate any issues with Kedit. Here's what I did to test:

  • I downloaded the Kedit 1.6.1 demo from the following website:

    http://www.kedit.com/
  • I installed Kedit on Windows XP Service Pack 3 (nothing except Windows updates and drivers were installed prior to installing Kedit).
  • I set Windows to always open Text Documents with KEDITW32.exe by right-clicking on a Text Document, selecting Properties, and clicking the button to change what program to open Text Documents with.
  • I double-clicked on a Text Document to verify that it opened it Kedit.
  • I installed Online Armor Premium with default settings, and allowed to to restart the computer when done.
  • I allowed the Learning Mode to finish before I tried to launch any programs.
  • Once Learning Mode was done, I double-clicked on a Text Document to open it in Kedit, and when Online Armor notified me about it I selected to trust KEDITW32.exe and clicked OK.
  • I tried double-clicking on a couple of Text Documents after that, and there were no notifications and no more entries in Online Armor's History regarding Kedit.
Please let me know if you had done anything differently. I'm going to restore to my Base snapshot, reinstall Kedit, then install Emsisoft Anti-Malware before installing Online Armor to see if that makes any difference.

Share this post


Link to post
Share on other sites

I was also unable to reproduce it with Emsisoft Anti-Malware installed.

Do you have beta versions of either Emsisoft Anti-Malware or Online Armor installed?

Share this post


Link to post
Share on other sites

Hi.  Thank-you for all the effort you're making.   OA is 6.0.0.1736 without betas enabled; EAM is 8.0.0.10 without betas enabled.

 

Kedit is a hugely configurable beast.  Normally I ran it in "instance single" mode , that is the app would try to ensure only one version was active (by passing messages about new edit activity to an existing running copy), and that's the problem scenario.  The vendor has suggested a workaround "set instance multiple" which allows many instances of the app to run.  This is much less convenient as I get zillions of edit windows all over the screen but at least an edit window does open reliably when I click on a file.

 

In your test version, issue the command "q instance" from the command line; I expect it will say "instance single" as I think that's the default.  If by any chance you've somehow got 'multiple' set, change it with "set instance single".  That config value gets saved in the registry (which is unusual for the app) so the app can access it when starting an instance.

 

In your experiments, are you repeatedly trying to edit multiple files - either by selecting multiples in an Windows Explorer window, right-clicking and choosing the default 'Edit' option or an explicit "Edit with Kedit" which you'd need to define with

 

   HKEY_CLASSES_ROOT\*\shell\Edit with Kedit\command

       (Default)   REG_SZ   "C:\Program Files\~M-folder\MansfieldSoftware\KEDITW16\KEDITW32.exe" "%1"

 

 

... or by double-clicking files when your single instance of kedit is already running (so it will add another file to its 'ring' of active files - not a tabbed interface but broadly equivalent), or by right-clicking and choosing 'Edit with Kedit' those separate files...  (If an instance of kedit has more than one file in its ring of files, the "Files=n" count in the statusline at the foot of the screen will show that - though you won't necessarlily have a statusline yet, we'll come to that).  Also there will be two toolbar icons with clockwise and anti-clockwise square rings of arrows un-greyed, enabling one to travel back & forth around the ring of files.  Also "q ring" will list the files currently loaded.

 

 

Kedit will look in a specific directory for macros (scripted commands), and in particular for a file called winprof.kex which will (if set up to do so) be executed at the startup of the kedit app, or possibly at the start of every edit of every file (which is what I have, so that changes I make in winprof.kex take immediate effect on files I next edit). Commands issued in winprof can affect the whole application 'ie be global', or be set per-file being edited, or per-view of any files being edited.  I'll attach my copy of winprof.kex so you can have the same setup active.  On second thoughts, as winprof calls some other macros and refers to other definition files I'll attack a zipped copy of the essential ones.

 

So what do you do with these?

 

Clearly kedit need to be told where to look for macros - a command issued from winprof.kex is no use, because it won't find winprof.kex unless it looks in the right place...  I have an option set  "set macropath jn_ked_macs"   and have defined JN_KED_MACS   in control panel - system - advanced - environment variables to point at the folder in which I keep kedit macros.  Unlike most 'set thing' commands which can just be issued from the commandline, this option needs set within the app and then the app needs to be told to write that option (only) to the registry.  So...   start kedit, select Option - Set Command....  then set Category to Macro; highlight the macropath item in the list of items underneath that.   Choose environment variable and define the name of the one you want to use for your macros folder.   Finally click 'Save Setting'.   Shut kedit, reopen it and check via "q macropath" in the commandline that the right option is being used.

 

Put all the files that I'll attach (in a few minutes) in your macros directory.

Share this post


Link to post
Share on other sites

I hope you read this first...   I think you can ignore the stuff I posted above.   I installed the demo version.  It demonstrates teh problem too.

 

Specifically, what I did was:

  - backed up my existing install, exported the registry keys that describe my app, renamed the folder my real version is in

     and renamed the registry key hierarchy that my real version uses

  - ran installer for demo version and accepted all defaults

  - ran demo version from Start - Programs shortcut and checked I really was using V1.6.1 - yes

  - initial experiments to have the demo open files faield for me, until I found

    HKEY_CLASSES_ROOT\Applications\KEDITW32.exe\shell\open\command

    which still pointed at the sidelined executable - changed that to point at the demo one.

 

Now I can edit a specific file with the demo app ok; used Open With to set the demo version as the app of choice for

both .txt and .txtplain files - it works fine for single files I double-click.

 

I then selected a pair of .txt files in WE, r-clicked the slection and chose "Open".  Only one file opened and OA's log said:

 

Created:      08/07/2013 13:27:10
Summary:      Program Guard: kernel event
Description:  OADriver: PostMessage, 152 -> 640, Msg: 2034/7f2 - Deny (watched)
Event type:   Kernel event(26)
Event action: None(1)
Processes:
  PID:     152    Name: KEDITW32.exe
  PID:     640    Name: KEDITW32.exe

 

I tehn shut kedit and tried fairly rapidly double-clicking a whole set of individual .txt files one after another.

The first time, I clciked 6 of them, and 1 faield to load.

 

I did this again with 12 files - 8 loaded and OA reported 4 kernel events.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.