UserAssistView

From aldeid
Jump to: navigation, search

Description

UserAssistView decrypts and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist keys in the Registry. The UserAssist key contains information about the exe files and links that are opened frequently.

Installation

Command Line options

/stext <Filename>
Save the list of UserAssist items into a regular text file.
/stab <Filename>
Save the list of UserAssist items into a tab-delimited text file.
/scomma <Filename>
Save the list of UserAssist items into a comma-delimited text file.
/stabular <Filename>
Save the list of UserAssist items into a tabular text file.
/shtml <Filename>
Save the list of UserAssist items into HTML file (Horizontal).
/sverhtml <Filename>
Save the list of UserAssist items into HTML file (Vertical).
/sxml <Filename>
Save the list of UserAssist items to XML file.

Examples

GUI

Userassistview.png

CLI

C:\>userassistview.exe /stext c:\userassist.txt
C:\>more userassist.txt
==================================================
Item Name         : UEME_CTLSESSION
Index             : 0
Count             : 98
Modified Time     :
ClassID           : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================

==================================================
Item Name         : UEME_CTLCUACount:ctor
Index             : 1
Count             : 2
Modified Time     :
ClassID           : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================

==================================================
Item Name         : UEME_UITOOLBAR
Index             : 2
Count             : 83
Modified Time     : 06/04/2013 17:19:27
ClassID           : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================

==================================================
Item Name         : UEME_UITOOLBAR:0x1,124
Index             : 3
Count             : 7
Modified Time     : 14/02/2012 16:05:05
ClassID           : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================
[REMOVED]

Comments

blog comments powered by Disqus