UserAssistView
Jump to navigation
Jump to search
Description
UserAssistView decrypts and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist keys in the Registry. The UserAssist key contains information about the exe files and links that are opened frequently.
Installation
- Download UserAssistView here: http://www.nirsoft.net/utils/userassistview.zip
- Uncompress the zip archive
- Run the executable either from Command Line (CLI) or from the GUI.
Command Line options
- /stext <Filename>
- Save the list of UserAssist items into a regular text file.
- /stab <Filename>
- Save the list of UserAssist items into a tab-delimited text file.
- /scomma <Filename>
- Save the list of UserAssist items into a comma-delimited text file.
- /stabular <Filename>
- Save the list of UserAssist items into a tabular text file.
- /shtml <Filename>
- Save the list of UserAssist items into HTML file (Horizontal).
- /sverhtml <Filename>
- Save the list of UserAssist items into HTML file (Vertical).
- /sxml <Filename>
- Save the list of UserAssist items to XML file.
Examples
GUI
CLI
C:\>userassistview.exe /stext c:\userassist.txt
C:\>more userassist.txt
==================================================
Item Name : UEME_CTLSESSION
Index : 0
Count : 98
Modified Time :
ClassID : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================
==================================================
Item Name : UEME_CTLCUACount:ctor
Index : 1
Count : 2
Modified Time :
ClassID : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================
==================================================
Item Name : UEME_UITOOLBAR
Index : 2
Count : 83
Modified Time : 06/04/2013 17:19:27
ClassID : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================
==================================================
Item Name : UEME_UITOOLBAR:0x1,124
Index : 3
Count : 7
Modified Time : 14/02/2012 16:05:05
ClassID : {5E6AB780-7743-11CF-A12B-00AA004AE837}
==================================================
[REMOVED]