delete registry entries with script

Hello

I need a little a help. I need a script or batch file to delete a series of registry entries that were created during an install. I used a snapshot software to expose all registry entries and now I want to make sure they are all removed. I have this in a text file and here is a portion of that:
HKEY_CLASSES_ROOT\AppID\{24D495A5-A174-4945-819D-CF294600C500}
HKEY_CLASSES_ROOT\AppID\{D71CBC24-F638-4606-9023-E11891FA52D7}
HKEY_CLASSES_ROOT\AppID\IDriver.EXE
HKEY_CLASSES_ROOT\AppID\IDriver2.exe

There were 800 entries during the install! I have them all listed like above in a text file.
Is there a way I can create a script to remove them using this txt file?

Thanks in advance!

 

Regedit can delete using a REG file. An example I use.

Code:

Windows Registry Editor Version 5.00

[[color=red]-[/color]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "NeroCheck "= "G:\\WINDOWS\\system32\\NeroCheck.exe "
 "NvCplDaemon "= "RUNDLL32.EXE G:\\WINDOWS\\system32\\NvCpl.dll,NvStartup "
 "nwiz "= "nwiz.exe /install "
 "Windows Defender "= "\ "G:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide "
 "AVG7_CC "= "G:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP "
 "SmcService "= "G:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui "

Notice the "-" in the first line and where it is placed. This tells Regedit to delete the Key and all Keys attached to it. The following lines recreate it.

 

Yes, there is a way.

Let me preface this by saying that you may be taking too much action and risk for something that doesn't matter and could cause dire consequences.

That said, I'll trust you to you own judgment and offer the following that I have used in the past:

Armed with that knowledge, it will be up to you to ensure that the text file is in the proper format to be of use. Then you will have to edit it using the "Find and replace" tool of some word processor so that the proper minus symbol can be inserted where needed. You may use that method to place the square brackets ([ ]) around the key if they are not there in your original file. Then you will need to add the proper introductory text string (first line in the file) so that it will be recognized as a Rededit file. That text is the line:

REGEDIT4

That line is compatible with all versions of Windows. Place it as the first line in your newly created text file. When all of you editing is complete, rename the file so that it has an extension of .reg rather than txt. That will allow it to be recognized as a regedit file and when double clicked will add or remove data from your registry.

It is imperative that you backup the Registry prior to running this file since any misteps can render your system unbootable.

I suggest using drive imaging for backups using some software such as Acronis true Image prior to doing this cleansing.

Again, I advise you to consider leaving the registry alone if your system is working alright. Only you can determine if deleting the entire key or merely deleting some specific value string is appropriate. It's a very dangerous undertaking when 800 keys are involved!

 

A little confused??

I am a little confused on that.
Let's say in that text file I wanted to create a regedit file to place the "-" to remove everything added to the HKLM.
What would be the syntax in the find and replace option in a word processor app?

 

Ps

PS

This is a training pc. No biggy if it is a no go!
Thanks

 

As an example, lets consider that your text file already has the square brackets. In that case you could use the "Find & Replace" settings of :

Find = [

Replace With = [-

That would remove the entire key.

That's the general idea. I don't know what your text file looks like so I can't be more specific.

If instead you need to remove a particular value string or binary item, it gets a little more dicey. That would require a massive amount of manual editing of the text file in order to preserve the key for any other strings that were present before this install.

Don't fail to consider using System Restore to do this job if you had it engaged at the time. Registry restoring is its forte.

 

sample of the text

Here is a sample of the text
HKEY_CLASSES_ROOT\CLSID\{9E104755-C78C-4BAC-941C-29857740D46F}\VersionIndependentProgID
HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}
HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\LocalServer32
HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\ProgID
HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\VersionIndependentProgID
HKEY_CLASSES_ROOT\Installer\Features\0E01CCD6F0102BF44B846BDBEB74AB0A
HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A
HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList
HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Media
HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Net
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A76467F04A6635E40B50FC100DF3C7BB
HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}
HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid
HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid32
HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\TypeLib
HKEY_CLASSES_ROOT\Interface\{0624352B-E86A-48B9-B23D-D4BEDA6DF1D9}

 

Since the first obvious common item in all those lines of text is the upper case H, it would follow that when using a "Search and Replace" tool you could do a search for H and replace it with [-H as a beginning stroke. That would take care of one condition that is required for deleting the Key. The other condition requires that a ] bracket occur at the end of each text string. In that case you could search for a line feed symbol and replace it with a line feed symbol] to accomplish your goal. The line feed character symbol will vary with the word processor software that you use. It won't be available on anything less than a full featured one.

Good luck with your experiment. If you don't have a full featured word processor available, you could upload the file somewhere and post a link here. Then perhaps someone will be able to perform the editing and return it to you.

 

jawdoc, Testing the instruction given I am able to construct this:

REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{9E104755-C78C-4BAC-941C-29857740D46F}\VersionIndependentProgID]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\LocalServer32]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\ProgID]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\VersionIndependentProgID]
[-HKEY_CLASSES_ROOT\Installer\Features\0E01CCD6F0102BF44B846BDBEB74AB0A]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Media]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Net]
[-HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A76467F04A6635E40B50FC100DF3C7BB]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid32]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\TypeLib]
[-HKEY_CLASSES_ROOT\Interface\{0624352B-E86A-48B9-B23D-D4BEDA6DF1D9}]

Or perhaps a better view is this:

Code:

REGEDIT4

[-HKEY_CLASSES_ROOT\CLSID\{9E104755-C78C-4BAC-941C-29857740D46F}\VersionIndependentProgID]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\LocalServer32]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\ProgID]
[-HKEY_CLASSES_ROOT\CLSID\{AF0996A6-75B5-457D-B417-49B5FBF97E73}\VersionIndependentProgID]
[-HKEY_CLASSES_ROOT\Installer\Features\0E01CCD6F0102BF44B846BDBEB74AB0A]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Media]
[-HKEY_CLASSES_ROOT\Installer\Products\0E01CCD6F0102BF44B846BDBEB74AB0A\SourceList\Net]
[-HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A76467F04A6635E40B50FC100DF3C7BB]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\ProxyStubClsid32]
[-HKEY_CLASSES_ROOT\Interface\{023F4789-ADC1-4030-9DE3-7ED7F57EA2CA}\TypeLib]
[-HKEY_CLASSES_ROOT\Interface\{0624352B-E86A-48B9-B23D-D4BEDA6DF1D9}]

That looks like it would work for your experiment. As I cautioned before, be careful of what you ask since you may "get it."

 

That worked great now....

Thanks for all the help! That worked great.
Now, this may be impossible (other than manually) but what if I need to create a script to remove the data entries that were added during an install...
This is text from a log during that install...
And I just want to remove Values added to the Key.
Can this be done is a similar way???

HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib "Version"
Type: REG_SZ
Data: 1.0
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189} "(Default)"
Type: REG_SZ
Data: ISetupMedia4
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid "(Default)"
Type: REG_SZ
Data: {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32 "(Default)"
Type: REG_SZ
Data: {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib "(Default)"
Type: REG_SZ
Data: {01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}

 

I don't see any easy way to edit value strings alone. Using the search feature to get to the string and then manually deleting the various length scripts would be the only way that I can think of. At least it would place your curser at the right point to begin the work.

For example, search for the word Type and delete the whole line. Then select Find Next and continue onward. When that finishes search for the word Data and do as above.

When those lines are all cleared you can then do a search for "space symbol and replace it with "=-space symbol

I hope you have <800 this time since this process sounds like it may be labor intense.

 

The current format of your log makes it a bit more difficult, but not impossible to do. Start with Excel.

Copy the entire list of entries for which you only want to remove the values and paste it into cell A1. Now click the A column header to select the whole column, then click the Sort arrow on the toolbar (or Data>Sort). Using your last post as an example, it will now look like the following.

Code:

Data: {00020424-0000-0000-C000-000000000046}
Data: {00020424-0000-0000-C000-000000000046}
Data: {01F6AFCB-2AFF-4A6F-8681-E51C4AC277B7}
Data: 1.0
Data: ISetupMedia4
HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib  "Version "
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}  "(Default) "
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid  "(Default) "
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32  "(Default) "
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib  "(Default) "
Type: REG_SZ
Type: REG_SZ
Type: REG_SZ
Type: REG_SZ
Type: REG_SZ

Click the first HKEY entry, hold down the Shift key and click the last HKEY entry, then right click>Copy

Open Word, right click and Paste. Now highlight and copy either the word "(Default)" or "Version ", then click a blank space on the page to deselect the hightlighted word. Click Edit>Replace. Find What should be or needs to be selected. Press Ctrl+V to paste from the clipboard. Press Tab to advance the cursor to the Replace With field. Click the More button. Click Special>Manual Line Break. This will insert the following characters in the replace with field.

^|

and no, you cannot get the same effect by inserting the caret and pipe symbols. Now press Ctrl+V to paste from the clipboard again. Now cursor through the Replace With field to edit it to appear as follows.

^| "Default "=-
or
^| "Version "=-

Click Replace All. It will look like the following.

Code:

HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib 
“Version”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189} 
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid 
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32 
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib 
“Default”=-

Now, I bet you want to get the end of each path bracketed, right? Empty the Find What field, click Special>Manual Line Break to insert the ^| characters. Tab to the Replace With field and enter an end bracket.

]

Click Replace All. It will now look like the following.

Code:

HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib ]“Version”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189} ]“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid ]“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32 ]“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib ]“Default”=-

Now you have to once again Find What

“Default”=-
or
“Version”=-

Replace With

^|“Default”=-
or
^|“Version”=-

to achieve a result like the following.

Code:

HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib ]
“Version”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189} ]
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid ]
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32 ]
“Default”=-
HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib ]
“Default”=-

Ahh, but we're not done. There's a space between each end bracket and the end of the path. That's an easy one. Find What; hit spacebar 1 time and enter an end bracket. Replace With; end bracket only. And of course, the leading bracket. Find What; HKEY Replace With; [HKEY

Now we have the end result, that we paste into notepad with a REGEDIT4 heading.

Code:

REGEDIT4

[HKEY_CLASSES_ROOT\Interface\{065BC041-955D-42E2-A767-F26CA8E5A2A3}\TypeLib]
“Version”=-
[HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}]
“Default”=-
[HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid]
“Default”=-
[HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\ProxyStubClsid32]
“Default”=-
[HKEY_CLASSES_ROOT\Interface\{06DAA70F-FCCD-44E1-A676-716E6234C189}\TypeLib]
“Default”=-

EDIT: I errantly removed the quote tags around the "(Default)" entries above. They should stay there.

 

Nice work Dave! Using the spreadsheet never crossed my feeble mind.

Following your lead, and also taking advantage of the fact that there is a space before each leading " and also a space after each trailing ", I was able to get all the necessary editing done in the spreadsheet program except for the line feed following the ] bracket. You can insert the space into the Search/Replace fields by merely pressing the space bar.

Then Copy/pasting the results into Word made inserting the line feed one easy step.

Thanks for the input.

ps. I think the value item "Default" needs to be "(Default)" with the parenthesis brackets included.

 

Thanks Dude. I never thought about using the replace feature in Excel .... cuts the process down a few steps

I often use Excel for large batch files, where I have to insert an echo in front of many lines of registry entries or file paths, or a repetitive >>text.txt entry appended to the paths. Using column B for the entries, you can enter echo on A1, then select all necessary column A rows, press Ctrl+D and it will fill all the selected A cells with echo. Same for the >>text.txt entry in column C. Copy the whole sheet to notepad and using copy>paste, replace the space inserted by excel (which is multiple spaces in notepad) with 1 space. A real time saver.