[solved] Silent batch delete registry key / value:

[ByteAnalyser]

---::[ ForeworD ]::---
Once again hello to all A new problem arised in my project script. I hope not to be too dumb... First please let me know if the title is good or should I change it for other to find it easily with "Search" forum.

---::[ SituatioN ]::---
I need to delete some registry entries (keys) and I will bring here as example only 1 so no one gets confused.

---::[ AnalysiS ]::---
I tried with REG DELETE "regkeypath" /V "regkey2delete" /F . Here follows some tries:
Note: the sid is passed through the variable %SID% (S-1-5-21-1993962763-1383384898-527237240-1003), which I learned and understood thanks to aGerman in the thread: viewtopic.php?f=3&t=1176. I know that the variable is parsed well into the string... anyway here is the complete string tests with REG.EXE.

Code: Select all

reg delete "HKU\S-1-5-21-1993962763-1383384898-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-0060
97DEACF9}\Count" /v "HRZR_EHACVQY:\ZFA.yax" /f
=== In this case I get the error "Fehler: Der angegebene Registrierungsschlüssel oder Wert konnte nicht gefunden werden.", which means that reg.exe cannot find the path or the value.

reg delete "HKU\S-1-5-21-1993962763-1383384898-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-0060
97DEACF9}\Count\" /v "HRZR_EHACVQY:\ZFA.yax" /f
=== In this case I added the backslash "\" after Count and when executed it asks me if I want to delete, I press "y" and it deletes the entire "Count" path...

---::[ What did I dO? ]::---
"Googled" very much for finding what I'm doing wrong on the reg.exe, found nothing. Looked many, (really many) alternatives for deleteing registry from batch silently... nothing to do (I'm not a good searchlore!)

---::[ What do I neeD? ]::---
I need a way to delete 5 registry entries (keys) stored in HKU hive with parsed SID and the path along to "Count" and delete ONLY but entirely (as in the example above): HRZR_EHACVQY:\ZFA.yax. I prefer to not make use of .reg files or .inf files... Preferably a built in command or a very very small .exe (no gui) file.

---::[ NoteS ]::---
Only, but only if possible again some info to understand the solution (if solutions will be posted).

---::[ ConclusioN ]::---
!!!Thank you very much in advance!!!
Respect2aLL
kind regards to the readers and
Best Regards to the helpers

[aGerman]

If the value contains a back slash then you have to escape it by a second back slash. Try

Code: Select all

reg delete "HKU\S-1-5-21-1993962763-1383384898-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-0060
97DEACF9}\Count" /v "HRZR_EHACVQY:\\ZFA.yax" /f

Regards
aGerman

[aGerman]

[EDIT]
No, sorry. A single back slash is OK if you wrote the value in quots.
Make a .reg export file from this value. Maybe you will see what's wrong.

Regards
aGerman
[/EDIT]

[ByteAnalyser]

Thank you aGerman for taking care I appreciate it... So, I "destroyed" my other pc trying some other tests with registry... everything has gone so now I'm working on another xp... The name of the key I would like to delete is displayed in regedit.exe gui as follows: HRZR_EHACVQY:%pfvqy2%\ZFA Rkcybere.yax. The full path is HKU\S-1-5-21-682003330-1229272821-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count. The following is the content of the exported .reg file:

Code: Select all

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-682003330-1229272821-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count]

"HRZR_EHACVQY:%pfvqy2%\\ZFA Rkcybere.yax"=hex:01,00,00,00,13,00,00,00,68,13,6c,ad,de,f2,ca,01

[... here just follows all other keys ...]

And I read somewhere about the escape char caret "^", so I tried the following:

Code: Select all

reg delete "HKU\S-1-5-21-682003330-1229272821-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /v "HRZR_EHACVQY:%pfvqy2%\\ZFA Rkcybere.yax" /f
=== with a second backslash "\" as escape

reg delete "HKU\S-1-5-21-682003330-1229272821-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /v "HRZR_EHACVQY:%pfvqy2%^\ZFA Rkcybere.yax" /f
=== with the caret "^" as escape

reg delete "HKU\S-1-5-21-682003330-1229272821-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /v "HRZR_EHACVQY:%pfvqy2%\ZFA Rkcybere.yax" /f
=== without any escape

----===::[ In all 3 cases above it keeps saying the it cannot find the key or the value ]::===----

But the key exists as shown in the img below:

I even tried some variations with single quotes ('), but nothing.

Please, help me out of here
Thank you very much in advance...

[aGerman]

Now it makes sense. %pfvqy2% is interpretet as (nonexisting) Variable.
"HRZR_EHACVQY:%pfvqy2%\ZFA Rkcybere.yax"
is interpreted as
"HRZR_EHACVQY:\ZFA Rkcybere.yax"
thats why the message "not found".

You have to double the percent signs.
"HRZR_EHACVQY:%%pfvqy2%%\ZFA Rkcybere.yax"

Regards
aGerman

[ByteAnalyser]

Thanks a lot aGerman for staying in touch to this thread... Excited I immediately tried your suggestion about the double percent "%" that way:

Code: Select all

reg delete "HKU\S-1-5-21-1993962763-1383384898-527237240-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /v "HRZR_EHACVQY:%%pfvqy2%%\ZFA.yax" /f

But it keeps displaying the same error:
Fehler: Der angegebene Registrierungsschlüssel oder Wert konnte nicht gefunden werden.
any further ideas?

[aGerman]

Something must be wrong with your path (missing number or something else). I searched my registry and found a similar value. I tried to delete it (without /f switch, because I have no idea what this value is good for).

Code: Select all

@echo off &setlocal
reg delete "HKU\S-1-5-21-362068211-4027322273-1247584293-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count" /v "HRZR_EHACVQY:%%pfvqy2%%\ZvaTJ\ZvaTJ.yax"
pause

And that was the reaction:

Code: Select all

Delete the registry value HRZR_EHACVQY:%pfvqy2%\ZvaTJ\ZvaTJ.yax (Y/N)?

As you can see it was found.

BTW: Did you ever press F5 to update the registry editor window? Maybe it doesn't exist, because one of your tests was successful.

Regards
aGerman

[ByteAnalyser]

Wow I feel like a dumb (usually I pay a lot of attention when researching) ... worked on the same thing with different values, variables on 4 different pc's. Ok looking at your posts and trying 3 things on my script... now it seems that everything works well. let's hope I'm able to finish this script (I'm working on it since 12 days every night from 02.30 am to 05.45 am... and it doesn't work well, yet.

Info: the final "/f" switch/option simply = force... so the script does delete everything silently w/o asking.

Thanks again +aGerman for your patient (Gedult).
Respect and Best Regards from ByteAnalyser

[aGerman]

Thank god!
I knew the meaning of the /f switch (but not the meaning of the registry value). That's why I didn't use it for testing.

Regards
aGerman