Re: Purpose of "UserAssist" registry keys?

Message has been deleted

bumtracks

unread,

Mar 29, 2005, 4:59:25 PM3/29/05

to

maybe its one of these... (spyware)
http://securityresponse.symantec.com/avcenter/venc/data/adware.ziocom.html
http://hr.trendmicro-europe.com/enterprise/security_info/ve_detail.php?VName=SPYW_CNSMIN.A

"Sammy" <no...@no-where.com> wrote in message
news:9628E6FEB...@130.133.1.4...
> What is the purpose of the "UserAssist" registry keys?
>
> Can I delete them?
>
> From time to time my XP system (SP1) accesses most of the subkeys in
> User Assist and this makes me wait as the system goes very slow.

Keith Miller

unread,

Mar 29, 2005, 6:03:50 PM3/29/05

to

It keeps track of program usage for the frequently used programs on the start menu (the ones below items that are pinned.

Keith

Wesley Vogel

unread,

Mar 29, 2005, 9:02:39 PM3/29/05

to

MRU-Blaster will empty these...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAss
ist\{5E6AB780-7743-11CF-A12B-00AA004AE837}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAss
ist\{75048700-EF1F-11D0-9888-006097DEACF9}

Also the related HKEY_USERS keys.

MRU-Blaster
http://www.javacoolsoftware.com/mrublaster.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:9628E6FEB...@130.133.1.4,
Sammy <no...@no-where.com> hunted and pecked:

Kelly

unread,

Mar 30, 2005, 2:12:45 AM3/30/05

to

Hi Wes,

MRU lists only interest paranoid and cosmetic users. <w> There is no
systematic gain from clearing them.

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

"Wesley Vogel" <123WVo...@comcast.net> wrote in message
news:O1h%23KyMNF...@TK2MSFTNGP10.phx.gbl...

Keith Miller

unread,

Mar 30, 2005, 4:13:54 AM3/30/05

to

Just because you're paranoid doesn't mean they're not out to get you!!! :)

Keith

"Kelly" <ke...@mvps.org> wrote in message news:OQrzkgPN...@TK2MSFTNGP10.phx.gbl...

Wesley Vogel

unread,

Mar 30, 2005, 10:10:30 AM3/30/05

to

Yeah. <LOL>

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:ON4qNjQN...@TK2MSFTNGP09.phx.gbl,
Keith Miller <k.mil...@verizon.net> hunted and pecked:

Message has been deleted

Kelly

unread,

Mar 31, 2005, 2:04:54 AM3/31/05

to

Am assuming you meant to say, Just because you are NOT paranoid.......? :o)

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

"Keith Miller" <k.mil...@verizon.net> wrote in message
news:ON4qNjQN...@TK2MSFTNGP09.phx.gbl...

Kelly

unread,

Mar 31, 2005, 3:08:48 AM3/31/05

to

Great work on your part, Sammy. Wes should be along to assist you soon.

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

"Sammy" <no...@no-where.com> wrote in message

news:9629E019...@130.133.1.4...
> On Wed 30 Mar 2005 03:02:39, Wesley Vogel wrote:
> <news:O1h#KyMNFH...@TK2MSFTNGP10.phx.gbl>

>
>> MRU-Blaster will empty these...
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
>> rer\UserAss ist\{5E6AB780-7743-11CF-A12B-00AA004AE837}
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
>> rer\UserAss ist\{75048700-EF1F-11D0-9888-006097DEACF9}
>>
>> Also the related HKEY_USERS keys.
>>
>> MRU-Blaster
>> http://www.javacoolsoftware.com/mrublaster.html
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>
>

> I actually like to keep MRU info because MRU info helps me easily
> return to previous work. So instead of using a tool like MRU-Blaster
> would it be alright if I just deleted the entries in the two keys you
> mentioned?
>
> But are they the right keys because I notice that:
>
> {5E6AB780-7743-11CF-A12B-00AA004AE837} is for Microsoft's Internet
> toolbar
>
> and {75048700-EF1F-11D0-9888-006097DEACF9} is for Active Desktop.

Wesley Vogel

unread,

Mar 31, 2005, 10:11:09 AM3/31/05

to

Sammy,

HKEY_CLASSES_ROOT\CLSID\{5E6AB780-7743-11CF-A12B-00AA004AE837}
(Default)
REG_SZ
Microsoft Internet Toolbar

HKEY_CLASSES_ROOT\CLSID\{75048700-EF1F-11D0-9888-006097DEACF9}
(Default)
REG_SZ
ActiveDesktop

Deleting the entries should certainly be alright. As with all MRU keys they
will just fill up again. Some programmer at MS must've had too much time on
their hands. The entries in those two keys seem to be encrypted using
ROT13.

ROT13 shifts letters forward thirteen spaces in the alphabet. (a becomes n,
etc.) ROT13 ("ROTate by 13 places", sometimes hyphenated ROT-13, or
lowercase rot13) is a simple Caesar cipher. In cryptography, a Caesar
cipher, also known as a Caesar shift cipher or shift cipher, is one of the
simplest and most well-known classical encryption techniques. The method is
named after Julius Caesar, who used it to communicate with his generals.

Mine were cleaned out yesterday. This morning
...UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
had four entries.
...UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
had thirteen entries.

One entry in ...UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\
HRZR_EHACNGU:P:\JVAQBJF\Flfgrz32\JFpevcg.rkr

Just for fun I decoded it, using my Captain Midnight Secret Decoder Ring.
;-)

UEME_RUNPATH:C:\WINDOWS\System32\WScript.exe

Maybe I have too much time on my hands. :-) Time to go to work.

Of course after I decoded that one entry I found this site...

ROT-13 Converter
http://personal-computer-tutor.com/rot13.htm

These may be of interest...

http://www.velasco.com.br/explorer_spy.txt

http://www.winguides.com/forums/showflat.php?Cat=&Board=brdQuestions&Number=69404&page=1&view=collapsed&sb=9&part

http://rixstep.com/1/20041029,00.html

http://personal-computer-tutor.com/abc3/v29/vic29.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:9629E019...@130.133.1.4,

Sammy <no...@no-where.com> hunted and pecked:

> On Wed 30 Mar 2005 03:02:39, Wesley Vogel wrote:
> <news:O1h#KyMNFH...@TK2MSFTNGP10.phx.gbl>
>

>> MRU-Blaster will empty these...
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
>> rer\UserAss ist\{5E6AB780-7743-11CF-A12B-00AA004AE837}
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
>> rer\UserAss ist\{75048700-EF1F-11D0-9888-006097DEACF9}
>>
>> Also the related HKEY_USERS keys.
>>
>> MRU-Blaster
>> http://www.javacoolsoftware.com/mrublaster.html
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>
>