You can also find the value by checking the Windows Registry, which you can view or edit by using the Registry Editor program that comes with Microsoft Windows. You can find the value by navigating to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Options and checking the value for AutoRecoverTime.

[ More Info ]

[/os/windows/registry] permanent link

When I ran a scan of a Windows System with Spybot Search & Destroy 1.62, it reported it found a Windows registry key associated with GhostMail - it identified GhostMail as adware. To check the registry key, I typed regedit in the "Type here to search" field at the bottom of the screen and then selected the "Registry Editor" app when it appeared in the list of returned results (you can also open the application by typing regedit and hitting enter at a command prompt. I then navigated to the relevant key. I wanted to determine when the registry was created or at least when it was last modified. You can't see that information in the Windows Registry Editor, but you can create a text file that will contain that information by right-clicking on a key and choosing "Export" to generate a text file - select "Text Files (*.txt)" in the "Save as type" field, not the default value of "Registration Files (*.reg)." The text file will contain the key as well as the time it was last written to:

In this case, the date on the key was months ago, so didn't explain recent problems on the user's PC and since Spybot - Search & Destroy didn't locate anything else, the registry key may have been a remnant of something removed many months ago.

[ More Info ]

[/os/windows/registry] permanent link

One way you can add a new entry in the registry for a program to run when the user logs in is to use the regedit program that comes with the Windows operating system and which is normally found in the C:\Windows directory.

[ More Info ]

[/os/windows/registry] permanent link

From a command line interface (CLI), i.e., a command prompt, I can issue the command reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit /v LastKey, which will show me the last key that was accessed while in regedit. If I reopen regedit, it will start with that key selected, i.e., it will open from the key selected when I exited from the program.

C:\>reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit /v LastKey

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
    LastKey    REG_SZ    Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


C:\>

Note: the command is querying a key in HKEY Current User (HKCU), so the results apply to the account from which the command is run. If you run the command from a different account on the system, you will get the LastKey value for that account.

[/os/windows/registry] permanent link

The file is a hidden and system file, so you would need to turn on the display of hidden and system files in the Windows Explorer to see it, but even then, if you are logged into the account for which you are trying to access NTUSER.DAT it will be locked from access. You can view the contents of the file for another account or the contents of a backup copy of NTUSER.DAT using the RegFileExport utility from NirSoft as explained in Recovering information for the HKCU branch of the registry from a backup.

[/os/windows/registry] permanent link

[ More Info ]

[/os/windows/registry/devicepath] permanent link

1. Click on Start.
2. Select Run.
3. Type regedit
4. Click on Ok.
5. Navigate to HKEY_CLASSES_ROOT\lnkfile.
6. On the right side of the window, right-click on IsShortcut and choose Delete.

Remember, you must be careful when editing the registry. Mistakes in editing registry entries can cause significant problems.

As an alternative to the above method, you can use this shortcut-arrow-removal.reg registry file, which will delete the IsShortcut key from the registry. Download the file (you can right-click on the link and choose "download", "save link target as", or whatever your browser ues to initiate a download) and then, once it is downloaded, double-click on the file on your system. When prompted "Are you sure you want to add the information in shortcut-arrow-removal.reg to the registry?", select "Yes". That action will result in the key being removed; the prompt about adding information is just the default message that appears whenever you click on a .reg file.

References:

1. Remove shortcut arrow from desktop icons
   Free PC Tech Support - Guides and FAQs

[/os/windows/registry] permanent link

[ More Info ]

[/os/windows/registry] permanent link

While troubleshooting an Internet access problem on a system, I noticed a lot of entries for dubious sites in the registry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\. There were a lot of keys for domain names I know are associated with adware/spyware, such as 180solutions.com, brilliantdigital.com, and exactsearchbar.com. There were a lot of other dubious sounding domain names, such as casinoking.com, casinolasvegas.com, and casinodelrio.com. When I checked the values of the keys, I noticed they were all set as follows:

At Microsoft's WinInet Registry settings webpage, I found the following:

Per Site Cookie Handling

To handle site-by-site cookies, per-domain cookie decisions are stored under the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\<domain> key. The domains are added to the registry by WinInet when the user adds sites by using the Per Site Privacy Actions dialog box.

The default value of the <domain> key stores the decision value. The following table shows the possible values.

Value	Description
REG_DWORD: 1 (COOKIE_STATE_ACCEPT)	Accept all cookies from this site.
REG_DWORD: 5 (COOKIE_STATE_REJECT)	Reject all cookies from this site.

So a value of five in the key will block cookies from a site listed with that value. The values were probably placed there by one of the antispyware programs I previously installed on the system.

Internet Explorer 6 apparently checks the P3P keys to determine whether to allow a site to place a cookie on the system as described in IE6 and cookies. P3P stands for Platform for Privacy Preferences.

References:

1. WinInet Registry Settings
2. IE6 and cookies
3. P3P Public Overview

[/os/windows/registry] permanent link