Questions tagged [registry]

The Microsoft Windows Registry is a database for storing settings and data for the Microsoft Windows operating system and Windows applications.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Does the filesystem windows is installed on have an effect on the time zone settings of windows registry timestamps? [migrated]

As far as I know Windows Registry timestamps are stored as UTC timestamps when Windows is installed on an NTFS filesystem. Does this change when Windows is installed on a FAT Filesystem (e.g. FAT32)? ...
0
votes
0answers
17 views

Strange Chinese characters in my Windows Registry. How to Remove? [duplicate]

I just went into my Windows 8 Registry when I saw something just like: Regedit shows strange chinese characters in my system - should I be worried? That question was from 6 years ago. Now is 2019 &...
1
vote
1answer
115 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
1
vote
0answers
50 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...
0
votes
1answer
102 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
0
votes
1answer
1k views

How can I remove Sticky Keys Exploit via cmd? [closed]

Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed: REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\...
-1
votes
1answer
335 views

How to read command line argument for potential issue

I have a IOC that has a command line argument that looks like this below. Wanted to see if someone could help me parse it out a little bit to understand what is happening. C:\Windows\System32\mshta....
0
votes
1answer
66 views

Windows registry debug

is there any way to monitor, debug changes made by a installation to the OS registry ? I'm aware of Process Monitor but I look for something that I can enable and that will run in the background. ...
1
vote
1answer
933 views

Help with viewing hidden registry entries

Like the title says, I need help with viewing hidden registry entries that are not normally accessible through the default windows regedit. To start off, my friends son tried downloading a free game ...