About this tag
The UserAssist key in the Windows registry tracks recently accessed files and programs for the Start Menu's Most Frequently Used list. Entries under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist store binary data that includes paths to executables and folders, often encoded with ROT13 obfuscation. Users may find references to drives or files that no longer exist, which is normal behavior as the registry retains historical usage data even after files are deleted or moved. These entries are not inherently suspicious and are part of Windows' standard user activity logging. The UserAssist key is commonly examined in forensic investigations to determine program execution history.
  1. MrLH

    Windows 7 Question about entries in registry

    I don't usually mess with the registry but occasionally manually edit to make small changes. Anyhow, I was doing a search for a particular key and I came across what appears to be references to drives and folders/files that do not exist on my computer. There are a lot of them actually spread...
    • MrLH
    • Thread
    • binaries drive references file path maintenance registry security space exploration system files userassist windows 7
    • Replies: 2
    • Forum: Windows Help and Support