Here is a link to software called WRA (Windows Registry Analyzer ). Its non invasive and exported registry files (NTUSER.DAT's etc) can be imported in. It can access some of the more interesting areas of the registry - UserAssist, SteamMRU, ShellBags, etc. It translates some of the encrypted entries and provides a report facility. Free for private and commercial use. A nice useful little program.
Also on the site is the PDF which accompanies the product. It details the research work I carried out into the areas mentioned in your post. The PDF contains many screenshots to help users replicate their own findings.
The PDF can be downloaded from:
If anyone needs any help on interpretations of output my email address is on the last page of the PDF.
Allan S Hay
That's a good program. I put it to work right off today. Good work on that one.
Hi Allan, how are you? I hope you didn't mind me posting the link? I thought it was just too good a progam to not mention. Welcome to the board by the way.
P.S. That pdf is excellent
I want to download it.. but the requested file WRA.zip is no longer availabe there.. If some one is having it please send me.. 😕
I've tried downloading the PDF file but the link does not work.
Does anyone have a copy ?
This is also exactly what I was looking for (and what eventually lead me to this forum via multiple Google searches).
I've found v1.5.1 via more Google searches here
It appears the latest version, v1.5.2, fixed some bugs and would be useful to get ahold of. (It also appears that people have been hunting for the latest version for awhile.
I'm also very interested in this PDF that was linked above. I'd be happy to mirror the files for everyone if someone has a copy they are willing to share. Thanks for your time.
I've emailed the author in hopes of getting some more answers. I'll certainly share any news.
I made be wrong but I actually think the rights of this software have been purchased by a well known FC software company.
DOH! Well, at least I have v1.5.1. Thanks for the info. If someone does happen to come across v1.5.2 (last freeware version as it may be), I'd greatly appreciate the help. No response from the author.
It's odd - the website says nothing about it and all the other programs have working download links. Certainly something up with that program itself. I've certainly not given up - someone else has completed it and I will find them. 8)
It looks like Paraben has released their $129 version of WRA. I have version 1.5.2 of WRA and am willing to mirror it provided that their isn't anything illegal about doing it. I don't have the PDF, but would like a copy so if anyone can send it, I will mirror it also. As you can see from the screenshot below, its license states "Free to use for both private and commercial users."
Ok, it's been awhile since I checked this thread, but I'm still interested in v1.5.2! ) If you could email it to me, I'd greatly appreciate it. Best one would be exploit_AT_guidoz.DOT.com