How to intercept Windows' "open URL insystem default browser" functionality

Question

Hello, I need to know where/how Windows stores the command that passes the URL clicked in a non-browser program (i.e. Thunderbird) and launches it in the systems default browser.

I need that information to write a script that allows me to have a browser running in a secure sand boxed virtual machine, but still retain the functionality of automatically opening hyperlinks from non-browser programs(i.e. email client on my HOST OS) in the browser of my choosing inside my virtual machine guest OS(xp).

Does anyone know? I'm running Windows Server 2008 R2 if it matters. But I assume most versions of Windows starting with XP, do it the same way.

Thanks

Edit: I found this MS kb article

HKEY_CLASSES_ROOT\http\shell\open\command HKEY_CLASSES_ROOT\http\shell\open\ddeexec

I changed those keys to point to my script, but Firefox on my Host OS still launches, but then complains it is no longer the default browser.

So there must be other registry keys it falls back to besides these.

Answer 1

To open URL in default browser, programs just calls

ShellExecute(0, NULL, "http://...", NULL, NULL, 0)