is there a registry scanner that can find non unicode keys?

Hi

I have some weird keys , I guess are Chinese or Japanese or asiatic

I'm looking for a registry tool that let me find all of them , I have tried regscanner and registryfinder but they haven't such features

thanks

 

Scan your pc for malware (if it says nothing doesnt mean theres nothing, but its a start). Could also be drive corruptionn.

https://duckduckgo.com/?q=japanese chinese registry keys

https://security.stackexchange.com/questions/37437/unknown-asian-chinese-registry-keys

If you read that, it might be just an encoding error. Try to translate em based on diff encodings (read site for more info)

 

However you might already know they are safe, and thus you came here to ask how to scan em to find all.

in this case, you can export your registry with regedit (make sure to click All branches)



Then, you can use some regex to match whatever unicode chars u want

https://www.regular-expressions.info/unicode.html

Have fun

EDIT: Now I noticed that u might have non-unicode chars (lol), in that case check what encoding you are using and google "regex [your encoding]". For example for ANSI you have this https://github.com/chalk/ansi-regex

 

btw it wouuld also help if u could copy and paste the strings of your keys, image doesnt work

 

Usually RegKeyFixer is able to find registry entries with invalid characters, special symbols and permissions but it can be difficult to use for average users:

https://github.com/jschicht/RegKeyFixer

Do a registry backup or System Image before you proceed and experiment on a working system!

 

Hi
i have run malwarebyte last trial version and updated ,it does found nothing
Windows Registry Editor Version 5.00

Code:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.둉Ĝ鉵耀¿]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.둉Ĝ鉵耀¿\OpenWithList]
"a"="vlc.exe"
"MRUList"="a"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.둉Ĝ鉵耀Èɹ亨ɹ佸ɹ䷘ɹ䴈ɹ䰸ɹဠɸཐɸ຀ɸධɸೠɸఐɸୀɸੰɸ]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.둉Ĝ鉵耀Èɹ亨ɹ佸ɹ䷘ɹ䴈ɹ䰸ɹဠɸཐɸ຀ɸධɸೠɸఐɸୀɸੰɸ\OpenWithList]


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.寀握耀¤]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.寀握耀¤\OpenWithList]
"a"="vlc.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.㜝ㇻ耀¿ɛ亨ɛ佸ɛ䷘ɛ䴈ɛ䰸ɛဠɚཐɚ຀ɚධɚೠɚఐɚୀɚੰɚ]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.㜝ㇻ耀¿ɛ亨ɛ佸ɛ䷘ɛ䴈ɛ䰸ɛဠɚཐɚ຀ɚධɚೠɚఐɚୀɚੰɚ\OpenWithList]
"a"="vlc.exe"
"MRUList"="a"

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.㜝ㇻ耀¶]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.㜝ㇻ耀¶\OpenWithList]

 

Hi
to perfom only a search of the entire registy is it right ?
RegKeyFixer.exe \Registry\ -f -s > C:\regfinder.txt
thanks

 

Hi,

I don't think this will work. Probably you should scan the registry hives one by one.
Also to understand the results you should convert the hex values to more friendly output: (so not an easy task).

https://www.raymond.cc/blog/convert-windows-registry-hex-to-text/

 

No one wants to fiddle with regex?

Ok fine, I will (if I have time)

 

that token are unicode. those are not part of ansi or ascii.
https://en.wikipedia.org/wiki/UTF-16

But strange that they are related to VLC, from where did you get your installation file?

VLC ist this one here (videolan.org) - nothing else.
http://download.videolan.org/pub/videolan/vlc/

uninstall VLC and check again. and check for adware with adwcleaner
https://toolslib.net/downloads/viewdownload/1-adwcleaner/

 

Ok there we go, easy:

We open UTF 16 encoder https://www.browserling.com/tools/utf16-encode

We copy a string -
둉Ĝ鉵耀Èɹ亨ɹ佸ɹ䷘ɹ䴈ɹ䰸ɹဠɸཐɸ຀ɸධɸೠɸఐɸୀɸੰɸ



We press Encode, Bam



Now we go to utf 16 decoder to check if it worked - https://www.browserling.com/tools/utf16-decode

We paste the encoded stuff



And let's decode



Bam, same result

Let's compare just in case, original string vs decoded string, https://text-compare.com/



Boom easy. Now all u have to do is to make the regex with the symbols (u already got some of their unicode numbers with the encoder), and search through that exported registry file with your method of choice

 

@Floyd 57 @B-boy/StyLe/
Hi
well , i don't find so easy it
maybe a tool that can search for no ansi ...could be easy
thanks
@Brummelchen
Hi
I have uninstalled and re-installed vlc
but these keys are still there
I just would like to find asiat keys on all the registry , the keys i have posted are not dangerous but I could have other keys like them
thanks

 

Everything 1.4.1.1004 (x64) by voidtools should find them. When I can't find a reg key this does it. Freeware.

 

What? Isn't Everything only for Files and Folders?

 

delete the keys and reinstall VLC ("english")

 

Maybe I got it wrong. But I remember searching & deleting reg keys.

 

This a rather old timer. I don't know if it can be of any help but you never know. I used it for years to clean out obsolete registry keys

http://www.trashreg.com/rtkf_eng.html

 

Hi
i will give a try !
thanks

 

NirSoft ReScanner can find unicode string located inside a binary value.
https://www.nirsoft.net/utils/regscanner.html