Purpose of "UserAssist" registry keys?

[Sammy]

What is the purpose of the "UserAssist" registry keys?

Can I delete them?

From time to time my XP system (SP1) accesses most of the subkeys in
User Assist and this makes me wait as the system goes very slow.

 

[bumtracks]

maybe its one of these... (spyware)
http://securityresponse.symantec.com/avcenter/venc/data/adware.ziocom.html
http://hr.trendmicro-europe.com/enterprise/security_info/ve_detail.php?VName=SPYW_CNSMIN.A

 

[Keith Miller]

It keeps track of program usage for the frequently used programs on the start menu (the ones below items that are pinned.

Keith

 

[Wesley Vogel]

MRU-Blaster will empty these...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAss
ist\{5E6AB780-7743-11CF-A12B-00AA004AE837}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAss
ist\{75048700-EF1F-11D0-9888-006097DEACF9}

Also the related HKEY_USERS keys.

MRU-Blaster
http://www.javacoolsoftware.com/mrublaster.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Kelly]

Hi Wes,

MRU lists only interest paranoid and cosmetic users. <w> There is no
systematic gain from clearing them.

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Keith Miller]

Just because you're paranoid doesn't mean they're not out to get you!!!

Keith

 

[Wesley Vogel]

Yeah. <LOL>

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Sammy]

On Wed 30 Mar 2005 03:02:39, Wesley Vogel wrote:

MRU-Blaster will empty these...

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
rer\UserAss ist\{5E6AB780-7743-11CF-A12B-00AA004AE837}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explo
rer\UserAss ist\{75048700-EF1F-11D0-9888-006097DEACF9}

Also the related HKEY_USERS keys.

MRU-Blaster
http://www.javacoolsoftware.com/mrublaster.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

I actually like to keep MRU info because MRU info helps me easily
return to previous work. So instead of using a tool like MRU-Blaster
would it be alright if I just deleted the entries in the two keys you
mentioned?

But are they the right keys because I notice that:

{5E6AB780-7743-11CF-A12B-00AA004AE837} is for Microsoft's Internet
toolbar

and {75048700-EF1F-11D0-9888-006097DEACF9} is for Active Desktop.

 

[Kelly]

Am assuming you meant to say, Just because you are NOT paranoid.......? )

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com


Just because you're paranoid doesn't mean they're not out to get you!!!

Keith

 

[Kelly]

Great work on your part, Sammy. Wes should be along to assist you soon.

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Wesley Vogel]

Sammy,

HKEY_CLASSES_ROOT\CLSID\{5E6AB780-7743-11CF-A12B-00AA004AE837}
(Default)
REG_SZ
Microsoft Internet Toolbar

HKEY_CLASSES_ROOT\CLSID\{75048700-EF1F-11D0-9888-006097DEACF9}
(Default)
REG_SZ
ActiveDesktop

Deleting the entries should certainly be alright. As with all MRU keys they
will just fill up again. Some programmer at MS must've had too much time on
their hands. The entries in those two keys seem to be encrypted using
ROT13.

ROT13 shifts letters forward thirteen spaces in the alphabet. (a becomes n,
etc.) ROT13 ("ROTate by 13 places", sometimes hyphenated ROT-13, or
lowercase rot13) is a simple Caesar cipher. In cryptography, a Caesar
cipher, also known as a Caesar shift cipher or shift cipher, is one of the
simplest and most well-known classical encryption techniques. The method is
named after Julius Caesar, who used it to communicate with his generals.

Mine were cleaned out yesterday. This morning
....UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
had four entries.
....UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
had thirteen entries.

One entry in ...UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\
HRZR_EHACNGU:\JVAQBJF\Flfgrz32\JFpevcg.rkr

Just for fun I decoded it, using my Captain Midnight Secret Decoder Ring.
;-)

UEME_RUNPATH:C:\WINDOWS\System32\WScript.exe

Maybe I have too much time on my hands. Time to go to work.

Of course after I decoded that one entry I found this site...

ROT-13 Converter
http://personal-computer-tutor.com/rot13.htm

These may be of interest...

http://www.velasco.com.br/explorer_spy.txt

http://www.winguides.com/forums/sho...&Number=69404&page=1&view=collapsed&sb=9&part

http://rixstep.com/1/20041029,00.html

http://personal-computer-tutor.com/abc3/v29/vic29.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In