Comments on: UserAssist

By: Didier Stevens

Didier Stevens — Thu, 23 Oct 2008 17:55:56 +0000

I have no definite explanation for the session value.
I’ve not observed an increase of this value for every logon, but I’ve observed increments with 1 about every 24 hours, when the machine was on. Not exactly 24 hours, but a bit longer, and the variance looked random.

By: Paul Smith

Paul Smith — Thu, 23 Oct 2008 12:42:20 +0000

Thank you for your tool - I am looking for an explanation for “session” Is this an incremental # for every logon/boot. Am I correct that this session number only identifies the last session an application was accessed and need to use restore points to obtain if the application was used on a specific day - Thank you! - Paul

By: Nobuyuki Hirato

Nobuyuki Hirato — Fri, 08 Aug 2008 11:13:44 +0000

OK. I’ll inform you when I find out something further.
Thank you.

By: Didier Stevens

Didier Stevens — Thu, 07 Aug 2008 16:18:30 +0000

That’s normal. I did some testing with favorites, but couldn’t reproduce the -3 counter.

If you find more info, please let me know.

By: Nobuyuki Hirato

Nobuyuki Hirato — Wed, 06 Aug 2008 02:53:03 +0000

No, both of the two entries having -3 in Counter do have
Last timestamps.
As for the ones having 0 in Counter, Last timestamps are
all empty.

By: Didier Stevens

Didier Stevens — Tue, 05 Aug 2008 18:35:29 +0000

No, a 0 counter in the Counter column of the UserAssist utility means again that this is a special value, but its meaning is unknown.

csidl6 is the special directory with the user’s favorites.

Is the last timestamp empty?

By: Nobuyuki Hirato

Nobuyuki Hirato — Tue, 05 Aug 2008 03:56:18 +0000

Thanks for quick reply.

> Can you share which programs you’ve found with ‘negative
> counter values’?

Yes.
This time I’ve encountered two .url files under UEME_RUNPIDL:%csidl6%\, both indicated with values of -3.

> Internally, this action assigns a value of 0 to the
> counter. I’ve programmed UserAssist to display “Removed
> from list” in the counter column.

Does it mean all 0’s in the counter column should be
replaced with “Removed from list”?
I see a lot of entries with counter 0, apart from ones with “Removed from list”. Again, predominantly UEME_RUNPIDL:%csidl6%\??????.url ones.

By: Didier Stevens

Didier Stevens — Mon, 04 Aug 2008 17:11:29 +0000

In fact, the counters are stored inside the binary registry data with an offset of 5. So if a program has been executed exactly once, the counter stored inside the binary registry data is equal to 6, and my UserAssist utility will subtract 5 and display 1. I believe that this +5 offset is a classic programming trick used by the MS programmers to be able to store special values in the same binary format.
One special value I’ve identified is 0: this indicates that the program is never to appear in the start menu in the most executed programs list. A user can decide to remove a program from the start menu list by right-clicking the entry and selecting “Remove from this list in de context menu. Internally, this action assigns a value of 0 to the counter. I’ve programmed UserAssist to display “Removed from list” in the counter column.
Negative values in the counter column are special values that I’ve not yet identified. I’ve had reports of installation programs creating userassist registry entries with values 1 or 2, but I don’t know what this implies.

Can you share which programs you’ve found with ‘negative counter values’?

By: Nobuyuki Hirato

Nobuyuki Hirato — Mon, 04 Aug 2008 09:01:15 +0000

Thanks very much for sharing your powerful and handy tool.

Question 1:
What causes the counter to have a negative value?

Question 2:
What causes the counter to have “Removed from list” instead of a number?

I’ve been using this tool for some time, but today I have encountered above
cases for the first time.

By: Didier Stevens

Didier Stevens — Sun, 01 Jun 2008 09:15:56 +0000

I’ve used it in the past on W2K, it works. I believe that you’ve so much entries in the UserAssist keys, that it takes a long time for my utility to analyze them all and display the result. Let the program run for some time and see what happens.