I have a comment about Change the Registered User Information:

It is not enough! The registered user's info is stamped liberally throught USER.EXE as well. Also, the volume serial number of the primary drive is also stamped into this file. There may be others altered at install time too. This is in Windows 95, and I guess later systems may have even more pervasive ways of placing the identity registered at install time throughout the OS. If you did want to set up as a new user, with new details, it is easier to start a reinstall than to root out all past ID references, though a small Ghost image file (Symantec/Norton Ghost) of an empty primary can be hexed to give a serial number you want. (Must be an uncompressed file). This can be useful if you want to transfer a program that has a license locked to a particular number. Once that is ghosted in, replacing a format, it is possible to install onto that, setting up a completely clean ID that uses the old serial number. Mostly pointless info, but just to show you that there is a lot more to think about than that article suggests. :)

[Reply or follow-up to this message]

Ok Doc. Since I have two identical machines with W95, you're saying if I swap the user.exe between the machines I'll also swap the identities.??


On Thursday, November 8, 2001 at 9:37 pm, The Doctor wrote:
>I have a comment about Change
>the Registered User Information:

>
>It is not enough!
>The registered user's info is stamped liberally throught USER.EXE as well. Also,
>the volume serial number of the primary drive is also stamped into this file. There
>may be others altered at install time too. This is in Windows 95, and I guess later
>systems may have even more pervasive ways of placing the identity registered at install
>time throughout the OS.
>If you did want to set up as a new user, with new details, it is easier to start
>a reinstall than to root out all past ID references, though a small Ghost image file
>(Symantec/Norton Ghost) of an empty primary can be hexed to give a serial number
>you want. (Must be an uncompressed file). This can be useful if you want to transfer
>a program that has a license locked to a particular number. Once that is ghosted
>in, replacing a format, it is possible to install onto that, setting up a completely
>clean ID that uses the old serial number. Mostly pointless info, but just to show
>you that there is a lot more to think about than that article suggests. :)
>

[Reply or follow-up to this message]

These are the instructions I followed to change the Registered owner to my name. It's the only place it shows. Go to RUN, type REGEDIT....click the plus marks in front of HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS and click the words Current Version. Scroll to Registered Owner on the right hand side, then right click that line and choose MODIFY....type in the new name and click OK. Close the Registry.


On Thursday, November 8, 2001 at 9:37 pm, The Doctor wrote:
>I have a comment about Change
>the Registered User Information:

>
>It is not enough!
>The registered user's info is stamped liberally throught USER.EXE as well. Also,
>the volume serial number of the primary drive is also stamped into this file. There
>may be others altered at install time too. This is in Windows 95, and I guess later
>systems may have even more pervasive ways of placing the identity registered at install
>time throughout the OS.
>If you did want to set up as a new user, with new details, it is easier to start
>a reinstall than to root out all past ID references, though a small Ghost image file
>(Symantec/Norton Ghost) of an empty primary can be hexed to give a serial number
>you want. (Must be an uncompressed file). This can be useful if you want to transfer
>a program that has a license locked to a particular number. Once that is ghosted
>in, replacing a format, it is possible to install onto that, setting up a completely
>clean ID that uses the old serial number. Mostly pointless info, but just to show
>you that there is a lot more to think about than that article suggests. :)
>

[Reply or follow-up to this message]

CJ, you didn't read what I said, did you. :) Now go and open your USER.EXE (In System dir) with a text editor, and search for you registered name. You will find it, I promise you, so you can't say it deosn't show up anywhere else. Anyway, sorry not to answer anything here for half a year, but I thought that posts would be mirrored as emails but I got none till today.


On Saturday, November 17, 2001 at 11:39 am, CJ wrote:
>These are the instructions I followed to change the Registered owner to my name.
>It's the only place it shows.
>
>Go to RUN, type REGEDIT....click the plus marks in front of HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS
>and click the words Current Version.
>
>Scroll to Registered Owner on the right hand side, then right click that line and
>choose MODIFY....type in the new name and click OK. Close the Registry.
>
>

[Reply or follow-up to this message]

Steve, this is a tad late cos the email notifier didn't work, but this might still help.. Basically, there are other things about a system that are encoded into USER.EXE, like the volume serial number for the partition, as well as the registered name and the keycode. It might swap the user ID if you swap USER.EXE. but I don't know how much is encoded there, or how much it might affect a system that is transferred rather than freshly installed. You'd also have to edit things in the Registry to match those in USER.EXE. If you are going to transfer between machines with different BIOS, mainboard, chipset or other major hardware variations, it is ALWAYS better to reinstall anyway. The only thing I ever found to be really useful was to keep a volume serial number, hence my detail in the first post, about Ghosting an uncompressed copy of a formatted primary and editing that number before copying it back to the drive. If you have a sector editor, you could do that direct to the disk anyway, and then install. Only reason I used Ghost is: 1. you can save the empty primary image as a file of only 6KB or so, and that might be useful to restore a partition table if you lose it due to virus or disk write failure. The data will not appear in the drive, but at least it's made easy for data recovery tools to reach. 2. it allows you to use a Windows sector or hex editor if you have one, on the file, otherwise you'd have to use a command line tool, which is rarely easy.


On Friday, November 9, 2001 at 6:26 am, Steve Easton wrote:
>Ok Doc. Since I have two identical machines with W95, you're saying if I swap the
>user.exe between the machines I'll also swap the identities.??
>

[Reply or follow-up to this message]

Hi Doc. You piqued my curiosity so I checked my usere exe files. I have 2 since a program I installed contained Microsoft Active Accessibility which replaced my user.exe with a newer version and placed the old one in a backup folder. The old one does contain user and organization info but the new one does not!!! Neither contained the product ID.


On Wednesday, June 26, 2002 at 10:33 am, The Doctor wrote:
>Steve, this is a tad late cos the email notifier didn't work, but this might still
>help..
>Basically, there are other things about a system that are encoded into USER.EXE,
>like the volume serial number for the partition, as well as the registered name and
>the keycode. It might swap the user ID if you swap USER.EXE. but I don't know how
>much is encoded there, or how much it might affect a system that is transferred rather
>than freshly installed.
>You'd also have to edit things in the Registry to match those in USER.EXE.
>
>
>If you are going to transfer between machines with different BIOS, mainboard, chipset
>or other major hardware variations, it is ALWAYS better to reinstall anyway. The
>only thing I ever found to be really useful was to keep a volume serial number, hence
>my detail in the first post, about Ghosting an uncompressed copy of a formatted primary
>and editing that number before copying it back to the drive. If you have a sector
>editor, you could do that direct to the disk anyway, and then install. Only reason
>I used Ghost is:
>1. you can save the empty primary image as a file of only 6KB or so, and that might
>be useful to restore a partition table if you lose it due to virus or disk write
>failure. The data will not appear in the drive, but at least it's made easy for data
>recovery tools to reach.
>2. it allows you to use a Windows sector or hex editor if you have one, on the file,
>otherwise you'd have to use a command line tool, which is rarely easy.
>
>
>

[Reply or follow-up to this message]

Ty Steve. That's new to me. Mine definitely has the ID as well, immediately after the strings "If you purchased Windows on floppy disks, click About on the Help menu. " and "0rundll32 shell32.dll,Control_RunDLL desk.cpl ,-". (minus quotes). As it seems the thing is recompiled live, I thought it best to assume other things vital to the current system might also be compiled in it, so I suggested starting with the clean, renumbered partition as a way to avoid upsetting that. It's especially interesting that one of M$'s own would replace a compiled USER.EXE with what seems to be a generic file. Thankyou. That is a good clue, and a good way to retain anonymity if it works in all cases. :) Another note: If as well as assigning the path to the swap file to be on another drive, this USER.EXE need not be rewritten, and if all INI files and the two Registry files could all be set up for storage on another partition, it might even be possible to coax W95 to boot off read-only media, which is something a LOT of people would like in specialist cases in older PC's with dedicated functions like MP3 player, household control unit, etc.. You could have all the main OS files on a CD, possibly even the INI files and Registry files, with an HD for swap file and nothing else (except another partition for stored data..), if it doesn't mind not being able to write to itself. I've not tried this, but it would be cool if it worked, turning a small 486 into dedicated hardware for whatever function was on the disk you start it with.


On Wednesday, June 26, 2002 at 11:44 am, Steve Easton wrote:
>Hi Doc. You piqued my curiosity so I checked my usere exe files. I have 2 since
>a program I installed contained Microsoft Active Accessibility which replaced my
>user.exe with a newer version and placed the old one in a backup folder. The old
>one does contain user and organization info but the new one does not!!! Neither
>contained the product ID.
>
>

[Reply or follow-up to this message]

I have read where people have made systems which boot the OS from a CD and run it entirely in memory. Takes a lot of RAM but it can be done.


On Wednesday, June 26, 2002 at 10:15 pm, The Doctor wrote:
>Ty Steve. That's new to me. Mine definitely has the ID as well, immediately after
>the strings "If you purchased Windows on floppy disks, click About on the Help menu.
> " and "0rundll32 shell32.dll,Control_RunDLL desk.cpl ,-". (minus quotes). As it
>seems the thing is recompiled live, I thought it best to assume other things vital
>to the current system might also be compiled in it, so I suggested starting with
>the clean, renumbered partition as a way to avoid upsetting that. It's especially
>interesting that one of M$'s own would replace a compiled USER.EXE with what seems
>to be a generic file. Thankyou. That is a good clue, and a good way to retain anonymity
>if it works in all cases. :)
>
>Another note: If as well as assigning the path to the swap file to be on another
>drive, this USER.EXE need not be rewritten, and if all INI files and the two Registry
>files could all be set up for storage on another partition, it might even be possible
>to coax W95 to boot off read-only media, which is something a LOT of people would
>like in specialist cases in older PC's with dedicated functions like MP3 player,
>household control unit, etc.. You could have all the main OS files on a CD, possibly
>even the INI files and Registry files, with an HD for swap file and nothing else
>(except another partition for stored data..), if it doesn't mind not being able to
>write to itself. I've not tried this, but it would be cool if it worked, turning
>a small 486 into dedicated hardware for whatever function was on the disk you start
>it with.
>
>
>
>

[Reply or follow-up to this message]

Don't worry about User.exe
Check this MS artical for details...

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q88363

User.exe was only coded with name and company information back in the days of windows 
3.1 win 3.11 wfw 3.1 .

Written in serialno.ini  in wfw 3.11  

and in the registry ever scince then..   :-)







On Thursday, November 8, 2001 at 9:37 pm, The Doctor wrote:
>I have a comment about Change 
>the Registered User Information:

>
>It is not enough!
>The registered user's info is stamped liberally throught USER.EXE as well. Also, 
>the volume serial number of the primary drive is also stamped into this file. There 
>may be others altered at install time too. This is in Windows 95, and I guess later 
>systems may have even more pervasive ways of placing the identity registered at 
install 
>time throughout the OS.
>If you did want to set up as a new user, with new details, it is easier to start 
>a reinstall than to root out all past ID references, though a small Ghost image 
file 
>(Symantec/Norton Ghost) of an empty primary can be hexed to give a serial number 
>you want. (Must be an uncompressed file). This can be useful if you want to transfer 
>a program that has a license locked to a particular number. Once that is ghosted 
>in, replacing a format, it is possible to install onto that, setting up a completely 
>clean ID that uses the old serial number. Mostly pointless info, but just to show 
>you that there is a lot more to think about than that article suggests. :)
>

[Reply or follow-up to this message]

Just for kicks, and because I have access to a wide variety of OSes, I decided to try testing all of them to see where I could find the Registered Owner name. Here's what I found...

Windows for Workgroups 3.11: Found (both in USER.EXE and SERIALNO.INI)
Windows 95 (OSR2): Found
Windows 98SE: Not found
Windows NT 4.0: Not found
Windows 2000 Pro: Not found
Windows XP Pro: Not found


I searched using both regular ASCII and Unicode, to make sure that I didn't miss anything... so I think it's safe to say that by no means will you *definitely* find it in USER.EXE, as you imply. They seem to have stopped doing it after Windows 95. :)


On Wednesday, June 26, 2002 at 10:29 am, The Doctor wrote:
>CJ, you didn't read what I said, did you. :)
>Now go and open your USER.EXE (In System dir) with a text editor, and search for
>you registered name. You will find it, I promise you, so you can't say it deosn't
>show up anywhere else.
>
>Anyway, sorry not to answer anything here for half a year, but I thought that posts
>would be mirrored as emails but I got none till today.
>
>
>
>

[Reply or follow-up to this message]

So Microsoft must be right, and I must be a gibbering looney. :) Ciaran will at least vindicate my judgement on this much: Microsoft might have made these things, but they're still wrong. Ciaran says it did not appear in OS's later than W95, and he checked them. It does appear in W95 though, as well as W31. User.exe should be ok if changed with a generic copy anyway, so maybe it doesn't matter. Anyway, my point is that I was challenging an article that presumed to describe with certainty how to anonymise your system. Doesn't matter if I was wrong. I looked for myself, and found things that no-one ever told me before or since. And I shared what I found. That is what counts. If we want anonymity, at least we should all know not to trust Microsoft too much. :)


On Sunday, June 30, 2002 at 7:19 pm, Erik Pavels wrote:

>Don't worry about User.exe
>Check this MS artical for details...
>
>http://support.microsoft.com/default.aspx?scid=kb;EN-US;q88363
>
>User.exe was only coded with name and company information back in the days of windows 
>3.1 win 3.11 wfw 3.1 .
>
>Written in serialno.ini  in wfw 3.11  
>
>and in the registry ever scince then..   :-)
>
>
>

[Reply or follow-up to this message]

Ty Ciaran. The first answer was in another post, mainly answering Eric Pavels, but something else has occurred to me. I'd noticed the volume serial number of the primary the OS is installed on imprinted several times, partly in User.exe, and elsewhere, though I forget where, to be honest. I just remember needing a serial number to last beyond a reformat once, and decided that life was too short to root for all the places once I'd found about five. There were several, as I say.. I just did a sector edit to get the number from the old drive into the new one immediately after formatting, and let the OS installer copy that where it liked. I bring this up because it may be that this did not get stopped in later OS's. Admittedly it can't be used to track a person much, but it does help build up some kind of profile of a single user's machine. Far more insidious is the GUID I have just learned about. :) That is often generated in the saving of documents made by M$ programs, and contains the MAC address of the network card in the machine. This can link the originator of a document to records held by the ISP, and cookies have been used to transmit this info to any site owner who knows the appropriate ActiveX control. Basically, there are so many ways to track and profile people that it's not even worth being paranoid. Just assume 'they' might be watching, and don't do anything to make it worth their while. Works for me, anyway. :)


On Tuesday, July 9, 2002 at 2:28 am, Ciaran wrote:
>Just for kicks, and because I have access to a wide variety of OSes, I decided to
>try testing all of them to see where I could find the Registered Owner name. Here's
>what I found...
>

>Windows for Workgroups 3.11: Found (both in USER.EXE and SERIALNO.INI)
>Windows 95 (OSR2): Found
>Windows 98SE: Not found
>Windows NT 4.0: Not found
>Windows 2000 Pro: Not found
>Windows XP Pro: Not found
>

>I searched using both regular ASCII and Unicode, to make sure that I didn't miss
>anything... so I think it's safe to say that by no means will you *definitely* find
>it in USER.EXE, as you imply. They seem to have stopped doing it after Windows 95.
>:)
>

[Reply or follow-up to this message]

Hi, Does anyone kow how to do this in XP ? Thanks, Les Bell


On Wednesday, June 26, 2002 at 10:29 am, The Doctor wrote:
>CJ, you didn't read what I said, did you. :)
>Now go and open your USER.EXE (In System dir) with a text editor, and search for
>you registered name. You will find it, I promise you, so you can't say it deosn't
>show up anywhere else.
>
>Anyway, sorry not to answer anything here for half a year, but I thought that posts
>would be mirrored as emails but I got none till today.
>
>
>
>

[Reply or follow-up to this message]

Ask on the XP forum.






On Wednesday, March 19, 2003 at 12:05 pm, Les bell wrote:
>Hi,
>
>Does anyone kow how to do this in XP ?
>
>Thanks,
>
>Les Bell
>
>

[Reply or follow-up to this message]

Hey ! buddy, just follow the path and change the name HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CurrentVersion now change the value in RegisteredOrgnisation and RegisteredUser and see the magic enjoy ! :o) Ravi


On Wednesday, March 19, 2003 at 12:45 pm, retired wrote:

>Ask on the XP forum.
>
>
>On Wednesday, March 19, 2003 at 12:05 pm, Les bell wrote:
>>Hi,
>>
>>Does anyone kow how to do this in XP ?
>>
>>Thanks,
>>
>>Les Bell
>>
>>
>

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum