DosTips.com

Posted: **24 Jan 2023 12:05**

I tried creating a .bat scrip to search the subkeys of one registry entry for a string anyplace in the subkey.
The registry key is below in a Set "Key="
There are 165 subkeys. One subkey example looks like:

Code: Select all

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraVNC\UltraVNC Viewer\UltraVNC Viewer (Listen Mode).lnk
C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe
-listen

If the subkey has the string that I have in a Set "Str=" below, I'd like to delete the subkey.

I don't understand enough about a for loop.
I don't understand enough about searching a subkey.
I took a stab at creating something that is currently not working:

Code: Select all

@Echo On
Set "Key=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC"
Set "Str=uvnc bvba"
setlocal EnableExtensions DisableDelayedExpansion
for /F "usebackq delims=" %%I in ("%Str%") do (Echo reg delete "%Key%" /v "%%~I" /f 2>nul
    if not errorlevel 1 echo Deleted "%%~I" from %Key%
)
endlocal
cmd /k

I'm running this in Windows 10

Please give me a suggestion on how to fix the "For" loop.

Posted: **26 Jan 2023 16:12**

I almost found a solution. This code doesn't delete the keys. It does find the correct keys.

Code: Select all

@Echo Off
Set "Key=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC"
Set "Str=uvnc bvba"
setlocal EnableExtensions DisableDelayedExpansion

If exist %~dpn0.txt del %~dpn0.txt
for /F "EOL=E Delims=" %%I in ('@%SystemRoot%\System32\reg.exe query "%Key%" /v * ^| find "%Str%"') do (reg delete "%Key%" /v "%%~I" /f 2>nul
     if not errorlevel 1 echo Deleted "%%~I" from %Key% >>%~dpn0.txt
)
endlocal
cmd /k

I have found the correct data in the reg delete
I'm getting an error:

ERROR: The system was unable to find the specified registry key or value.

This is what the Registry keys look like:

: VNCSubkeys.jpg (406.04 KiB) Viewed 8288 times

If I echo it to the screen this is one example:

reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC" /v " 231 REG_MULTI_SZ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraVNC\UltraVNC Viewer\UltraVNC Viewer (Listen Mode).lnk\0C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe\0-listen" /f

I think the reg delete should have the %Key% /v (then only the name of the subkey)

Code: Select all

reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC" /v  231

In the code above the subkey value "%%~I" includes the name and the data.
How can I change the code above to breakout the name of the subkey?

Posted: **29 Jan 2023 23:52**

I have figured out the answer to my cmd line.

Code: Select all

@Echo Off
    Set "Key=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC"
    Set "Str=uvnc bvba"
    setlocal EnableExtensions DisableDelayedExpansion
    If exist %~dpn0.txt del %~dpn0.txt
    If exist %~dpn0Str.txt del %~dpn0Str.txt
    for /F "tokens=1,2*" %%A in ('@%SystemRoot%\System32\reg.exe query "%Key%" /v * ^| find "%Str%"') DO @(Echo=@%SystemRoot%\System32\reg.exe delete "%Key%" /v "%%A" /f
    if not errorlevel 1 echo Deleted "%%A" from "%Key%" >>%~dpn0.txt 
	echo %%C >>%~dpn0Str.txt
    )
    endlocal
    cmd /k

This gives me the subkey name in %%A
This gives me the subkey data in %%C
Note: Echo= before the reg delete needs to be removed for it to execute
Note: This must be run as administrator

DosTips.com

Delete subkeys in a registry key

Delete subkeys in a registry key

Re: Delete subkeys in a registry key

Re: Delete subkeys in a registry key