Well, does anyone know what this stuff is or relates to?

It's located here...

HKEY_CLASSES_ROOT\zh_auto_file

It also shows up in Hkey\Current User and Hkey\User



Inside the keys with the wierd character are (Default) REG_SZ values like...

.7z_auto_file
dmp_auto_file
BAK_auto_file
tmp_auto_file
sav_auto_file


etc...


/edit

This all seems to be associated with this CLSID: {2C256447-3F0D-4CBB-9D12-575BB20CDA0A}

...and under that CLSID I find ProgID: FaultrepElevatedDataCollection

...which seems to revolve around Faultrep.dll

Berton said:

I don't see that in mine but a Search of the Internet suggest it may be associated with Netscape. Can't tell what the language is.

I don't really have anything weird installed on here.

Google? : what is Task Utility.TEU_EOSUtilitytask? - Google Search

Jacee said:

Google? : what is Task Utility.TEU_EOSUtilitytask? - Google Search

Say what"? That link takes me to a bunch of pics?


faultrep.dll seems to be a Microsoft file. It was last modified when updating to .804, on February 9th 2021
It's File Description is: Windows User Mode Crash Reporting D....

@Jacee

Are you suggesting it might be part of, or have to do with Canon EOS Utility?
Canon EOS Utility is how I get pics from my DSLR to the computer.

Ghot said:

I've had these before, and just delete them

Worth noting, those seen in your image are not inside 'zh_auto_file' but actually under AFTER 'zune' which is the last ascii character extension in the sort order before these Chinese characters show up.

While obviously suspicious, from what I've read they're more likely bad programming that misinterprets 32 bit Unicode and 8 bit Ascii when adding file extension entries to the HKEY_CLASSES_ROOT.

Two chinese characters show up as root entries
Regedit shows strange chinese characters in my system - should I be worried?
Weird Chinese Entries In My Registry Solved - Windows 7





VLC is known to do this as well as Avast processes. I found mine were tied to .sh and .ahk file associations I'd made to open with Notepad++ and .webp with Xnview

Code:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\⒑䡪眀蠀W]
@="webp_auto_file"

Take a look at the command path's at the bottom of the trees for these entries. They may lead you to the culprit:

.7z_auto_file
dmp_auto_file
BAK_auto_file
tmp_auto_file
sav_auto_file

Farvatten said:

I've had these before, and just delete them

Worth noting, those seen in your image are not inside 'zh_auto_file' but actually under 'zune' which is the last ascii character extension in the sort order before these Chinese characters show up.

While obviously suspicious, from what I've read they're more likely bad programming that misinterprets 32 bit Unicode and 8 bit Ascii when adding file extension entries to the HKEY_CLASSES_ROOT.


Regedit shows strange chinese characters in my system - should I be worried?
Weird Chinese Entries In My Registry Solved - Windows 7

VLC is known to do this as well as Avast processes. I found mine were tied to .sh and .ahk file association I'd made to open with Notepad++ and .webp with Xnview

Code:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\⒑䡪眀蠀W]
@="webp_auto_file"

Take a look at the command path's at the bottom of the trees for these entries. They may lead you to the culprit:

.7z_auto_file
dmp_auto_file
BAK_auto_file
tmp_auto_file
sav_auto_file

Both command paths under zh_auto_file point to notepad, as shown in the pic.

And the value(s) for zune are shown as well.




I mean I could make a backup and then delete the Canon EOS Utility, with Revo, and see if that clears it. Then if it doesn't...then delete XnView??


Side note: comp is scanned with Bitdefender Internet Security 2020 and with Malwarebytes...comes up clean.
sfc /scannow and DISM are always clean as well.

Farvatten said:

There's some confusion, I'm not sure why your looking at zh_auto_file.

These entries are listed BELOW the 'zune' entry.
Click on the first one under 'zune'.

Ok... zune is all Microsoft Store related. the reason I'm looking at zh_auto_file is....


Inside the keys with the wierd character are (Default) REG_SZ values like...

.7z_auto_file
dmp_auto_file
BAK_auto_file
tmp_auto_file
sav_auto_file
zh_auto_file





It looks to me like zune is under zh_auto_file









The first item down from the zh_auto_file expand arrow is... zune
I searched the registry for zune, and every instance was related to MS Store