Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been happily running Windows 7 on my ultrabook for over a year now. It's stable, fast, everything pretty much works as it should, except something is adding randomly named keys to the registry at HKEY_CURRENT_USER. So occasionally I go in and delete all the $äe, bløþ¶Ŗx, etc. keys with a sense of impending doom as I try to not delete actual valid trees. Is there any way to find out what is creating these bogus, annoying, possibly dangerous keys to the registry?

share|improve this question
    
Have you check for malware? Try using something like Combofix, [link]bleepingcomputer.com/download/combofix –  StBlade Oct 30 '13 at 11:12
    
FYI: you can export the keys to a file before removing them. In case you need to put them back. :) –  techie007 Oct 30 '13 at 11:31
1  
I believe TeaTimer will alert you to any program making a registry change. TeaTimer is a component of Spybot S&D. Other than actually catching the bad actor, you won't find a lot of historical metadata about registry keys to audit. you could always lock down that section of the registry and see what complains, but be extra careful to record what you did so you can undo it later. –  Frank Thomas Oct 30 '13 at 11:44
    
@techie007: I do keep complete registry backups just in case, but these specific keys really don't need saving. :-) –  oKtosiTe Oct 30 '13 at 12:52
    
@StBlade: Perhaps I've become a bit complacent relying on MSE to do most of the heavy lifting. Will have a scan or two. –  oKtosiTe Oct 30 '13 at 12:53
show 1 more comment

1 Answer

up vote 3 down vote accepted

You could try the SysInternals tool Process Monitor. It's great for watching what's happening to the file system/registry (although there is so much information you'll need to think up a useful filter to weed out 'normal' activity).

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

share|improve this answer
    
If the TeaTimer option doesn't work out I will certainly give this a try. –  oKtosiTe Oct 30 '13 at 12:57
    
Actually, I got a hit pretty quickly by looking through the Registry Summary. LWEMon.exe (a Logitech Wingman supporting program) appears to be accessing these weird keys. Will follow up with TeaTimer to be sure, but it looks as though we may have found the perpetrator. –  oKtosiTe Oct 30 '13 at 13:02
    
After having disabled the autostart for LWEMon.exe, the registry keys have stopped popping up. Problem solved. Thank you very much! Accepted. –  oKtosiTe Nov 5 '13 at 16:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.