[SOLVED] Strange non-Latin characters in Windows 10 HKEY_CLASSES_ROOT

[WKKos]

Yesterday, your moderator "softwaremaniac" successfully helped me solve the problem entitled "Strange non-Latin characters in Windows 10 HKEY_CURRENT_USER". Today, I would appreciate it very much if the same MVP could help me solve a similar problem that I call "Strange non-Latin characters in Windows 10 HKEY_CLASSES_ROOT" that I have noticed on my Windows 10 Pro (64-bit) ASUS desktop PC.
Please, find screenshots of the the relevant parts of the registry key:

- HKEY_CLASSES_ROOT (1).jpg
- HKEY_CLASSES_ROOT (1-1).jpg
- HKEY_CLASSES_ROOT (2).jpg

Following the advice by "softwaremaniac" given yesterday, I have done now the steps:

Step#1 - Export Users hive

• Click on the Start button and in the search box, type regedit.
• When you see regedit on the list, right-click on it and select Run as administrator.
• When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.
  
  HKEY_CLASSES_ROOT
• Once selected, click File > Export....
• Change the Save as type: to Registry Hive Files (.).
• Name this file Users (with no file extension) and save it to your Desktop.
• Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
• Attach the .ZIP file to your next post.

If the file is too large to upload here, upload to Dropbox or OneDrive or SendSpace and just provide the link here.

Attachments:

• Since the file Users.zip is too large to be uploaded here (it is 14.3 MB), you can download it via the link https://iz1zda.db.files.1drv.com/y4...66GB3ZNgaqieDMdmyhk/Users.zip?download&psid=1
  

I have already saved on Desktop of my desktop PC: FRST64.exe.

Please, work out and make available to me a suitable fixlist.txt file that I will save on Desktop.
Then, I will run FRST64 by Right-Clicking on the file and choosing Run as administrator, and then press the Fix button.
FRST64 will generate a log on the Desktop (Fixlog.txt) and I'll post the log file in my reply.

 

[Sysnative Windows Update]

Hi!

I need HKEY_CLASSES_ROOT this time.

 

[WKKos]

Did I not compress HKEY_CLASSES_ROOT? I selected this key. It is still highlighted on my computer...

 

[Sysnative Windows Update]

Ahhh, you just named it Users. Okay. I see it now.

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

 

[WKKos]

All are gone, but one new has appeared - the last item of the key. I am sure it was not there. What's going on? What application is responsible for the creation of the items successfully deleted and the new one? Very strange...

 

[WKKos]

And the log file...

 

[Sysnative Windows Update]

Upload the hive again please.

 

[WKKos]

Here is the link to the file Root.zip:
https://iz1zda.db.files.1drv.com/y4...Yn4JdFseJU2ihbV9LRvk/Root.zip?download&psid=1

 

[Sysnative Windows Update]

Here you are.

 

[WKKos]

The sub-key is still there - see the log file. Is it your oversight or it has been re-created?

 

[Sysnative Windows Update]

You have used the wrong script.

 

[WKKos]

I don't understand what's going on. I have used your latest fixlist.txt file which is a single-line text file: [-HKEY_CLASSES_ROOT\�翹]. And the entry is still there... It seems that your script file is not correct (judging by the screenshot).

 

[Sysnative Windows Update]

The script is correct. The tool is interpreting the characters incorrectly. Can you try manually deleting the key by right-clicking on it and selecting Delete.

 

[WKKos]

Yes, I've just deleted the key manually. Hopefully, it will not be unnecessarily re-created. Still wonder what application can be blamed for the weird sub-keys in the HKEY_CLASSES_ROOT key... Thanks again for your kind assistance in solving the problem. Have a nice weekend!

 

[Sysnative Windows Update]

No problem. Like I said, I'm highly suspicious of Avast.