Access 2007 Registry Entry

[Stewart Berman]

Windows XP Pro SP3
All versions of Office Pro from 2000 through 2007 were installed in order.

I was in the process of adding some right click context items to .accdb files. Before I modified
the registry I went to backup the keys that would be affected. I noticed what appeared to a garbage
(or at least very strange) entry under the ...\shell\New\Command key. The Default entry looks right
but what is the command entry for?

[HKEY_CLASSES_ROOT\Access.Application.12\shell\New\command]
@="\"C:\\Program Files\\Microsoft Office\\Office12\\MSACCESS.EXE\" /NOSTARTUP /n \"%1\""
"command"=hex(7):77,00,5f,00,31,00,5e,00,56,00,56,00,21,00,21,00,21,00,21,00,\
21,00,21,00,21,00,21,00,21,00,4d,00,4b,00,4b,00,53,00,6b,00,41,00,43,00,43,\
00,45,00,53,00,53,00,46,00,69,00,6c,00,65,00,73,00,3e,00,74,00,57,00,7b,00,\
7e,00,24,00,34,00,51,00,5d,00,63,00,40,00,6a,00,6b,00,4f,00,29,00,41,00,78,\
00,61,00,54,00,4f,00,35,00,20,00,2f,00,4e,00,4f,00,53,00,54,00,41,00,52,00,\
54,00,55,00,50,00,20,00,2f,00,6e,00,20,00,22,00,25,00,31,00,22,00,00,00,76,\
00,55,00,70,00,41,00,56,00,51,00,28,00,38,00,41,00,24,00,21,00,21,00,21,00,\
21,00,21,00,4d,00,4b,00,4b,00,53,00,6b,00,41,00,43,00,43,00,45,00,53,00,53,\
00,46,00,69,00,6c,00,65,00,73,00,3e,00,74,00,57,00,7b,00,7e,00,24,00,34,00,\
51,00,5d,00,63,00,40,00,6a,00,6b,00,4f,00,29,00,41,00,78,00,61,00,54,00,4f,\
00,35,00,20,00,2f,00,4e,00,4f,00,53,00,54,00,41,00,52,00,54,00,55,00,50,00,\
20,00,2f,00,6e,00,20,00,22,00,25,00,31,00,22,00,00,00,00,00

This is a MULTI_SZ and, when viewed as text looks like:
w_1^VV!!!!!!!!!MKKSkACCESSFiles>tW{~$4Q]c@jkO)AxaTO5 /NOSTARTUP /n "%1"
vUpAVQ(8A$!!!!!MKKSkACCESSFiles>tW{~$4Q]c@jkO)AxaTO5 /NOSTARTUP /n "%1"

I don't think it was caused by the multiple versions of Access on the system as (1) 2007 was the
last installed and (2) the key is under [HKEY_CLASSES_ROOT\Access.Application.12.

So what created it and why?

 

[Arvin Meyer [MVP]]

It appears to be a shortcut to start a database which may be in the system
root. I'm not sure what the /n switch is doing because that's not a standard
command line switch that I have a record of. See if you can find it in your
help files.

Lastly, it is definitely running some code, which is everything after the
"command"=

Now it could be innocent, i.e. a database installed by a program, which
you've put on your machine. I'd search your hard drive for everything with
any Access extension.

 

[Tony Toews [MVP]]

This is a MULTI_SZ and, when viewed as text looks like:
w_1^VV!!!!!!!!!MKKSkACCESSFiles>tW{~$4Q]c@jkO)AxaTO5 /NOSTARTUP /n "%1"
vUpAVQ(8A$!!!!!MKKSkACCESSFiles>tW{~$4Q]c@jkO)AxaTO5 /NOSTARTUP /n "%1"

Mine has
w_1^VV!!!!!!!!!MKKSkACCESSFiles>tW{~$4Q]c@jkO)AxaTO5 /NOSTARTUP /n
"%1"
so it's the same first half but not the part starting with vUpAVQ(8A$

I don't think it was caused by the multiple versions of Access on the system as (1) 2007 was the
last installed and (2) the key is under [HKEY_CLASSES_ROOT\Access.Application.12.

I agree that it's not caused by multiple versions as mine is in a
Virtual PC clean fully patched Windows XP system to which I just
installed Access 2007 yesterday for testing purposes.

The *only* other software installed on that PC is anti virus
software., Virtual PC Virtual Machine Additions and WinDirStat.

Tony