?
Solved

What is ...\Explorer\UserAssist\...  Registry Key?

Posted on 2002-06-20
10
Medium Priority
?
2,731 Views
Last Modified: 2013-12-28
Hi, I found this key in my registry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

It contains approx. 700 fields all similar as the two below:

HRZR_EHACVQY:%pfvqy6%\Ba Yvar Ersrerapr\Serrolgr'f Thvqr gb Serr Bayvar Ersrerapr.hey

or

HRZR_EHAJZPZQ:0k2,2006

Any idea what this is about?  I'm running Win98se.
cj
0
Comment
Question by:czechmate
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +2
10 Comments
 
LVL 59

Accepted Solution

by:
LeeTutor earned 300 total points
ID: 7097517
Here are the two most comprehensible web sites mentioning this Registry key that I've found (using the search engine Google.com).  The second one is from the "cached" pages stored currently at Google.  Neither is all that clear.  On the second one, I did try the link to the German ZDnet page it mentioned, but the page location had changed.

http://www.swynk.com/trent/Articles/NoControlPanel.asp

http://216.239.35.100/search?q=cache:T92chgbLPrEC:the-it-mercenary.com/forums/Windows98/posts/1015.html+Explorer%5CUserAssist&hl=en&ie=UTF8

0
 
LVL 41

Expert Comment

by:stevenlewis
ID: 7097530
also try spybot
http://www.net-integration.net/spybot/spybotsd.html
it will check for spyware
0
ATEN's HDBaseT Presentation at InfoComm 2017

Hear ATEN Product Manager YT Liang review HDBaseT technology, highlighting ATEN’s latest solutions as they relate to real-world applications during her presentation at the HDBaseT booth at InfoComm 2017.

 
LVL 41

Expert Comment

by:stevenlewis
ID: 7097535
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 7097541
Steve, I believe those keys in the Win98 registry are all legitimate ones, not having to do with spyware, etc.  (My seach turned up some of your same sites.)  I have looked in my Win98se registry and I have the same keys.  Take a look at my second link.
0
 
LVL 1

Author Comment

by:czechmate
ID: 7099597
Thanks guys for all the links.  I have visited some of
them before I've come here (in fact I'm here 'cause ain't
nothing worthwhile on Google:)

I think LeeTutor is right in saying the keys in question
are legitimate.    On the second LeeTutor's link somebody
says it is encrypted history of program activity.  Well it
is posible but it certainly is not an authoritative
statement.  It is the only piece of info that is actually
relevant to my question.  

Thanks for advice on Trojan  removals etc, I have all that
including Adaware.

The Question remains: what is the key "..\userassist\count" about or what purpose does it serve?
0
 
LVL 9

Expert Comment

by:MrBillisMe
ID: 7099978
It is similar to some Japanese character entries, do you use foreign lanuage character sets?
0
 
LVL 1

Author Comment

by:czechmate
ID: 7101125
Hi guys, here's some feedback.
No, these are not Japanese characters MrBillisMe, even
though they definitely look like it:))  Thanks to the second link in LeeTutor comment I eventually figured out
at least some of it.

The entries are encrypted with ROT13 algorithm. That ROT13
exists I only found after I cracked it already.  This is
not bragging, it just shows you how simple the algo is.  
You simply add 13 to each character in A..Z range and if
it spills out you continue at the beginning.
Anyway today I was given a link where you can
encode/decode the stuff.

http://members.tripod.com/~BraunzGuy/rot13.htm


Then I decrypted contents of ..\count key and it is some
kind of history of Favorites menu and aparently other
customized menus.  Here's couple of examples:

Sample 1
Original entry:
HRZR_EHACVQY:%pfvqy6%\Yvaxf\paa\PAAsa - gur svanapvny
argjbex.hey

Plain text:
UEME_RUNPIDL:%CSIDL6%\LINKS\CNN\CNNFN - THE FINANCIAL
NETWORK.URL

Sample 2
HRZR_EHAJZPZQ:0k2,7041

UEME_RUNWMCMD:0X2,7041

I still don't know what the purpose of these keys is.  Are
they used when a menu item is activated?  On the other
hand I have entries there that have been long time removed
from my menus.  So, does anybody have a test rig on which
to try delete the whole thing? :))

cj
0
 
LVL 2

Expert Comment

by:Griffon
ID: 7103438
Ok I found the actual reg key here .. not sure exactly what it does but here it is.

http://www.leu.bw.schule.de/allg/son/dreamw4/dreamw4.reg.txt

So my guess based on that is that it is associated with dreamweaver 4 if you use that then there u go.

As for trying to delete it all you need to do if you choose to do this is create a backup of the registry and then delete the files .. if it messes things up then restore the registry and you will be back where you were before.

I hope that having an idea exactly where the registry key is from is of some help :)


0
 
LVL 1

Author Comment

by:czechmate
ID: 7104774
Griffon thanks for your contribution.  I do not use Dreamweaver, dreamweaver is just one of the apps that are using the key.  As I wrote above it is some kind of repository of links and commands, for what I don't know.  Anyway I think I leave it as it is, the points go to Lee Tutor he put me on the right track.
Thanks guys,
cj
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
This article helps those who get the 0xc004d307 error when trying to rearm (reset the license) Office 2013 in a Virtual Desktop Infrastructure (VDI) and/or those trying to prep the master image for Microsoft Key Management (KMS) activation. (i.e.- C…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question