registry issues

[mor.bas]

Hi,
I'm working on win 7
1. how I can delete regestry key as a system account (only system account have premission to it)?
2. how i can move on every key that had "Intel 223" inside and delete it?

Thanks in advance....

[abc0502]

I Tried to Use the "REG QUERY" but couldn't. also, you will have to run it as administrator it won't take this right unless you give it to and i think it won't work when you delete the keys as windows 7 protect some registry keys i only tested on XP

This will Export All The Content of The Main 5 Keys HKLM, HKCU, HKCR, HKU, HKCC to a txt files.
(you can set the keys you will search in, in the variable <MainKeys>)

Then will search in each one of them for the word you also set in the <Word> variable.
The result will be all the lines that contain this word, but the valid registry key will always start with <HKEY> so we will remove the first character "[" and compare all the these lines if the first 4 characters (after the first one "[") match <HKEY> it will then remove the first and last characters "[" & "]" and display the Full Key.

I didn't add the delete command as I will be Insane to do that
it will just display the key, give it a try.

Code: Select all

@Echo Off

:: Set Variables
Set "TMPPath=%TEMP%\REG_Files"
Set "MainKeys=HKLM HKCU HKCR HKU HKCC"
Set "Word=Offline Files"

:: Create Temporary Files
IF NOT EXIST "%TMPPath%" MD "%TMPPath%"

:: Export All The Content of The Main Keys to Files
For %%A in (%MainKeys%) Do REG EXPORT %%A "%TMPPath%\%%A.txt" >nul

:: Search in Every Exported File for The Key Name and use It as a Variable
Setlocal EnableDelayedExpansion
For %%A in (%Mainkeys%) Do (
   For /F "skip=2 delims=" %%B in ('FIND "%Word%" "%TMPPath%\%%A.txt"') Do (
      Set "line=%%B"
      IF "!line:~1,4!" EQU "HKEY" Echo !line:~1,-1!
   )
)

PAUSE
:: Remove TMPPath Folder
RMDIR /S /Q "%TMPPath%" 2>nul

Exit /B

It will take some time till it export the key to the files, mine take few seconds as it 64 MB.