Windows stores information about the programs that you use

Posted by Martin in Operating Systems, Security, Tools, Windows  Tags: , , , , , , ,

22

Jan



I really had troubles finding an appropriate title for this article. Windows XP displays a list of the most recent programs that you have accessed by default in the start menu. Did you know that those information are continuously updated even though the option to show them has been disabled ? A check on my personal account revealed that Windows stored information from 2005 until today.

The information are stored in the registry using a simple ROT-13 encryption. Windows XP saves the full path and name of the program, last access and the number of total executions. UserAssist is a nice little tool that decrypts the information and displays them it its main window. You can clear single entries by right-clicking and selecting clear. If you do have many entries in that list you might want to clear them all by clicking on commands, clear them all.

This does not disable the logging, it simply clears the current state. Windows XP will continue to log all activity unless you disable the whole process by clicking on commands, logging disabled. This will take effect once you restart, logoff and on again or kill the explorer.exe task in the task manager.

The manual way to disable logging would be to open your registry and navigate to the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Settings\NoLog

and set the value of that key to 1.

Windows stores the encrypted information in the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Please note that you should not disable or clear the feature if you want to work with the recent items in your start menu.


Like such posts? Get updates via RSS NEWS FEED. Love Ghacks? Find out how you can help!

4 Users Commented In This Post

Subscribe To This Post Comment Rss Or TrackBack URL
Me says:

I didn’t use the program but I read the registry key using a ROT13 converter.
On Windows Millenium, the content of the key is the list of the IE favorites, including the deleted ones.
Thank you Martin, once again ! Very interesting !

Hornswaggled says:

I dont mind the tracking, I just dont like how its hidden. If there was a list of recent programs, just like recent docs that may actually be of some use to people though the start menu does this itself.

I dont like the idea of tracking anymore than the next guy. We all need to start using and learning linux and try to get away from all the tracking OS’s that the big guys use.

I remember an article on Digg describing hoe the fbi, cia can remotely access any computer running xp through a backdoor and access everything undetected. I dont have much of anything to hide but I dont think they should have that much power.

Bob Jones says:

Will this not affect the pre-fetching feature? I wouldn’t put privacy over speed in this instance.

Martin says:

I did not expect speed drops after I removed and disabled this “feature”. Don’t think prefetch is affected at all by this

Leave Your Comments Below
Hello, please leave your thought below

Please Note: Each comment will be manually approved by an admin. There is no guarantee that a comment will be posted. Please do not submit the comment multiple times.