I’ve had this key popping up in my registry now for some time. I have no idea what it is, if it might be some artifact of a registry bug or not… ???
It looks like no ‘language’ I’ve ever seen. Here is a sample:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count] "HRZR_PGYFRFFVBA"=hex:5b,8b,3d,0e,08,00,00,00 "HRZR_PGYPHNPbhag:pgbe"=hex:00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00 "HRZR_HVGBBYONE"=hex:08,00,00,00,5e,00,00,00,c0,06,c1,89,13,b2,c7,01 "HRZR_HVGBBYONE:0k4,702r"=hex:01,00,00,00,07,00,00,00,e0,62,ae,15,ea,a9,c7,01 "HRZR_HVGBBYONE:0k1,133"=hex:07,00,00,00,0f,00,00,00,70,fb,ea,bd,95,af,c7,01 "HRZR_HVGBBYONE:0k1,130"=hex:05,00,00,00,0f,00,00,00,a0,b6,d9,31,8a,ae,c7,01 "HRZR_HVGBBYONE:0k1,120"=hex:07,00,00,00,0e,00,00,00,30,e3,46,65,6b,b1,c7,01 "HRZR_HVGBBYONE:0k1,7011"=hex:08,00,00,00,1d,00,00,00,c0,06,c1,89,13,b2,c7,01 "HRZR_HVGBBYONE:0k4,7011"=hex:08,00,00,00,1d,00,00,00,c0,06,c1,89,13,b2,c7,01 "HRZR_HVGBBYONE:0k1,123"=hex:07,00,00,00,09,00,00,00,e0,ea,0c,74,95,af,c7,01[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist{75048700-EF1F-11D0-9888-006097DEACF9}]
“Version”=dword:00000003[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist{75048700-EF1F-11D0-9888-006097DEACF9}\Count]
“HRZR_PGYFRFFVBA”=hex:74,8b,3d,0e,08,00,00,00
“HRZR_PGYPHNPbhag:pgbe”=hex:00,00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACNGU”=hex:08,00,00,00,2e,01,00,00,60,68,a3,e6,13,b2,c7,01
“HRZR_EHACNGU:P:\JVAAG\flfgrz32\EHAQYY32.RKR”=hex:08,00,00,00,1c,00,00,00,
40,33,da,b5,12,b2,c7,01
“HRZR_EHACNGU:P:\Cebtenz Svyrf\Wnin\wer1.6.0_01\ova\whfpurq.rkr”=hex:01,
00,00,00,07,00,00,00,c0,90,a0,c8,9a,aa,c7,01
“HRZR_EHACNGU:Q:\NYJVYF~1\Ninfg4\nfuQvfc.rkr”=hex:08,00,00,00,16,00,00,00,
20,f0,69,b6,12,b2,c7,01
“HRZR_EHACNGU:Q:\Ncf\Erzvaq!\erzvaq.rkr”=hex:08,00,00,00,16,00,00,00,40,33,
4b,b8,12,b2,c7,01
“HRZR_EHACNGU:P:\Cebtenz Svyrf\Pbzzba Svyrf\VFCPBZC\VafgnyyFreivpr.rkr”=hex:08,
00,00,00,15,00,00,00,50,95,50,b9,12,b2,c7,01
“HRZR_EHACNGU:Q:\Ncf\SnkGnyx\ABU\SGAbuZTE.rkr”=hex:08,00,00,00,16,00,00,00,
30,2c,0a,bb,12,b2,c7,01
“HRZR_EHACNGU:Q:\Ncf\ZF Bssvpr\Bssvpr\ZFBSSVPR.RKR”=hex:08,00,00,00,17,00,
00,00,30,67,0f,bc,12,b2,c7,01
“HRZR_EHACNGU:P:\Cebtenz Svyrf\Vagrearg Rkcybere\Pbaarpgvba Jvmneq\vpjpbaa1.rkr”=hex:00,
00,00,00,06,00,00,00,e0,a2,c3,f3,e8,a9,c7,01
“HRZR_EHAPCY”=hex:05,00,00,00,0b,00,00,00,d0,ac,26,c4,89,ae,c7,01
“HRZR_EHAPCY:FLFQZ.PCY”=hex:05,00,00,00,06,00,00,00,d0,ac,26,c4,89,ae,c7,01
“HRZR_EHACVQY:%pfvqy2%\Fgneghc”=hex:05,00,00,00,08,00,00,00,90,81,f0,cb,28,ae,
c7,01
“HRZR_EHACVQY:%pfvqy2%\Frphevgl”=hex:07,00,00,00,06,00,00,00,e0,9a,76,4d,5a,
b1,c7,01
“HRZR_EHACVQY:%pfvqy2%\Pbzzhavpngvbaf”=hex:02,00,00,00,06,00,00,00,80,c1,f3,
26,3d,ac,c7,01
“HRZR_EHACVQY:%pfvqy2%\Npprffbevrf”=hex:05,00,00,00,06,00,00,00,00,9f,bb,9f,
92,ae,c7,01
“HRZR_EHACVQY:%pfvqy2%\Vagrearg Rkcybere.yax”=hex:00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00
“HRZR_EHACNGU:P:\JVAAG\Flfgrz32\argcyjvm.qyy”=hex:00,00,00,00,06,00,00,00,
d0,76,10,4c,e9,a9,c7,01
“HRZR_EHAPCY:"P:\JVAAG\flfgrz32\nccjvm.pcy",Nqq/Erzbir Cebtenzf”=hex:00,
00,00,00,06,00,00,00,50,33,78,61,e9,a9,c7,01
“HRZR_EHAPCY:"P:\JVAAG\flfgrz32\GJRNXHV.PCY",Gjrnx HV”=hex:00,00,00,00,06,
00,00,00,b0,57,86,79,e9,a9,c7,01
“HRZR_HVFPHG”=hex:08,00,00,00,12,00,00,00,30,7a,41,61,b0,b1,c7,01
“HRZR_EHACNGU:Q:\Nyjvy Fbsgjner\Ninfg4\nfuNinfg.rkr”=hex:08,00,00,00,06,00,
00,00,60,4a,67,7c,a6,b1,c7,01
“HRZR_EHACNGU:P:\JVAAG\flfgrz32\furyy32.qyy”=hex:04,00,00,00,07,00,00,00,90,
5e,26,55,f1,ad,c7,01
“HRZR_EHACNGU:P:\JVAAG\flfgrz32\abgrcnq.rkr”=hex:08,00,00,00,39,00,00,00,60,
68,a3,e6,13,b2,c7,01
“HRZR_EHACNGU:Q:\Ncf\Sversbk\Zbmvyyn Sversbk\sversbk.rkr”=hex:07,00,00,00,
15,00,00,00,50,ff,3f,f5,5f,b1,c7,01
“HRZR_HVDPHG”=hex:08,00,00,00,3b,00,00,00,e0,c2,4d,c2,12,b2,c7,01
“HRZR_EHACNGU:Q:\Ncf\Guhaqreoveq\guhaqreoveq.rkr”=hex:07,00,00,00,18,00,00,
00,b0,c8,e1,54,58,b1,c7,01
“HRZR_EHACNGU:P:\Cebtenz Svyrf\Argfpncr Vagrearg Freivpr\AFPyvrag.rkr”=hex:08,
00,00,00,19,00,00,00,f0,09,44,7c,b1,b1,c7,01
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf”=hex:01,00,00,00,02,00,
00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Fgneghc\Zvpebfbsg Bssvpr Fubegphg One.yax”=hex:05,00,
00,00,08,00,00,00,90,81,f0,cb,28,ae,c7,01
“HRZR_EHACNGU:Q:\Hgvyf\xrcnff\XrrCnff.rkr”=hex:05,00,00,00,08,00,00,00,40,
7e,da,e8,92,ae,c7,01
“HRZR_EHACNGU:P:\JVAAG\rkcybere.rkr”=hex:08,00,00,00,1a,00,00,00,40,30,cb,c2,
12,b2,c7,01
“HRZR_EHACNGU:P:\JVAAG\Flfgrz32\pnyp.rkr”=hex:01,00,00,00,06,00,00,00,60,23,
98,34,a5,aa,c7,01
“HRZR_EHACVQY:%pfvqy2%\Pbzzhavpngvbaf\SnkGnyx ZBU.yax”=hex:02,00,00,00,06,00,
00,00,80,c1,f3,26,3d,ac,c7,01
“HRZR_EHACVQY:%pfvqy2%\Npprffbevrf\Abgrcnq.yax”=hex:05,00,00,00,06,00,00,00,
20,0b,b7,9f,92,ae,c7,01
“HRZR_EHACVQY:%pfvqy2%\Npprffbevrf\Flfgrz Gbbyf\Fpurqhyrq Gnfxf.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Npprffbevrf\Flfgrz Gbbyf\Trggvat Fgnegrq.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax”=hex:01,00,
00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Fpurqhyrq Gnfxf.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Trggvat Fgnegrq.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Qvfx Qrsentzragre.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Punenpgre Znc.yax”=hex:01,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACVQY:%pfvqy2%\Hgvyvgvrf & Gbbyf\Flfgrz Gbbyf\Onpxhc.yax”=hex:01,00,
00,00,02,00,00,00,00,00,00,00,00,00,00,00
“HRZR_EHACNGU:Q:\NCF\SVERSBK\ZBMVYY~1\SVERSBK.RKR”=hex:01,00,00,00,06,00,
00,00,70,24,df,b0,a8,aa,c7,01
“HRZR_EHACVQY:%pfvqy2%\Pbzzhavpngvbaf\ZF Snk\Fraq Pbire Cntr Snk.yax”=hex:02,
00,00,00,02,00,00,00,00,00,00,00,00,00,00,00
This is just a snippet. They can become quite long. I’ve taken to exporting this ‘user assist’ key and then deleting it. It keeps popping back up, so something is ‘creating’ it as it goes.
Does it look familiar to the panel of experts here? ???