3

I'm seeing a strange key HKEY_CLASSES_ROOT\핵樦Ḁ耀 in my registry.

I've seen a few issues like this (here and here) that relate to a UTF-16 <-> ASCII encoding bug, and I've tried translating encodings to see if this helps, but it doesn't seem to.

I tested this with Python like so, after getting the byte values from an online converter since my terminal doesn't support UTF very well:

# byte values returned from encoding 핵樦Ḁ耀 is this.
encoded_bytes = '75d5266a001e0080'

# Attempt to decode as ASCII fails as byte values are out of range
bytes.fromhex(encoded_bytes).decode('ascii')

# Yields the error message "'ascii' codec can't decode byte 0xd5 in position 1: ordinal not in range(128)"
# No way this is ASCII, regardless of le vs. be

# Trying utf-8 as well with little/big end encoding with error message "'utf-8' codec can't decode byte 0xd5 in position 1: invalid continuation byte"
bytes.fromhex('75d5266a001e0080').decode('utf-8') # Error
bytes.fromhex('d5756a261e008000').decode('utf-8') # Same error, but at position 0

It seems to have a nonsensical translation per Google Translate, and it's unlikely that it has any real meaning anyway since there's one Korean glyph, two Chinese glyphs, and one Latin character.

Is this also likely to be an encoding problem? If so, any thoughts on what the actual value is?

Update: I ran a full system scan with McAfee and it didn't turn up anything, which makes sense since this is a fairly fresh PC.

drognisep
  • 131
  • 3

0 Answers0