The most important feature of this new UserAssist version is the explain command. Now you can right-click an entry, select explain and get a nice explanation for the selected entry, like this:
I’ve spend some time researching all the different types of values the UEME strings can have and how they relate to user actions. The explain function contains everything I discovered. The source code for this feature is a prototype, I’ve been developing it as I discovered the logic behind the UEME strings, hence it is not a clean design and I plan to rewrite it once I get the full picture. Of course, this design is hidden for you as a user and you should not care about it.
The Logging Disabled switch is OS-aware (Windows XP, 2003 and Vista).
And the last new feature of this version is the support of cleartext Userassist entries (i.e. entries that are not ROT13 encoded). BTW, Windows Vista doesn’t support the NoEncrypt setting.
This version was also tested on Windows 2003, I didn’t notice a difference with Windows XP, but I must admit the testing was limited.
And I would like to test it on Windows 2008 while attending Microsoft IT Forum.
Didier Stevens 
[…] UserAssist V2.4.1 […]
Pingback by Liquidmatrix Security Digest » Security Briefing: October 17th — Wednesday 17 October 2007 @ 10:39
Thanks, Didier, for making a very useful tool even better! It seems to work fine on Vista systems, loading the dat file. A suggestion is to set an option or just allow the program to load wihtout scanning the local registry. I always use UA to interpret an exported hive, so it would be handier to open the app and choose a file. Thanks!
Comment by Jimmy Weg — Monday 5 November 2007 @ 2:35
I’ll include this suggestion in a new version.
Comment by Didier Stevens — Monday 5 November 2007 @ 21:48