Registry hacks - in particular deletion

Content Authoring
1

(imported topic written by SystemAdmin)

hey all,

I’m trying to delete a value in the registry but am not able to do it via the registry wizard or via the code below. What am i doing wrong?? I’m trying to remove the string value “Bob” from the key HKEY_CLASSES_ROOT\CLSID{027FCE5E-4A03-47D5-AEB7-4E145BB7CB91}\InprocServer32

if {exists value “” of key “HKCR\CLSID%7B027FCE5E-4A03-47D5-AEB7-4E145BB7CB91%7D\InprocServer32” of registry}

if {exists value “” of key “HKCR\CLSID%7B027FCE5E-4A03-47D5-AEB7-4E145BB7CB91%7D\InprocServer32” of registry} contain “tsjDocAssembly.dll”}

delete __appendfile

delete wizardedit.reg

appendfile Windows Registry Editor Version 5.00

appendfile

appendfile

HKEY_CLASSES_ROOT\CLSID%7B027FCE5E-4A03-47D5-AEB7-4E145BB7CB91%7D\InprocServer32

appendfile “Bob”=-

move __appendfile wizardedit.reg

waithidden regedit /s “wizardedit.reg” endif

endif

endif

cheers, Pete

2

(imported comment written by SystemAdmin)

This is what happens when I create the task thru the registry wizard:

Completed action uses wow64 redirection false

Completed delete __appendfile

Completed delete wizardedit.reg

Completed appendfile Windows Registry Editor Version 5.00

Completed appendfile

Failed appendfile

HKEY_CLASSES_ROOT\CLSID{027FCE5E-4A03-47D5-AEB7-4E145BB7CB91}\InprocServer32

appendfile “Bob”=-

move __appendfile wizardedit.reg

waithidden regedit /s “wizardedit.reg”

I ran the action thru the fixlet debugger and got this error:

Command failed (The operator “fce5e” is not defined.) appendfile

HKEY_CLASSES_ROOT\CLSID{027FCE5E-4A03-47D5-AEB7-4E145BB7CB91}\InprocServer32

3

(imported comment written by jessewk)

Try using a double left curly brace instead of percent encoding:

appendfile

HKEY_CLASSES_ROOT\CLSID{{027FCE5E-4A03-47D5-AEB7-4E145BB7CB91}\InprocServer32

4

(imported comment written by SystemAdmin)

Thanks that worked. Taking the fixlet further, I would like to test the value of a key to see if it contains certain chars. The best I am able to do is an absolute value test using “=”. Am I able to use regex to see if any of the chars are in the value? This is what I have currently:

if {exists value “” of key “HKCR\CLSID%7B027FCE5E-4A03-47D5-AEB7-4E145BB7CB91%7D\InprocServer32” of registry and (value “” of key “HKCR\CLSID%7B027FCE5E-4A03-47D5-AEB7-4E145BB7CB91%7D\InprocServer32” of registry = “C:\Program Files\Trim Context\tsjDocAssembly.dll”) }

delete __appendfile

delete wizardedit.reg

appendfile Windows Registry Editor Version 5.00

appendfile

appendfile

HKEY_CLASSES_ROOT\CLSID{{027FCE5E-4A03-47D5-AEB7-4E145BB7CB91}\InprocServer32

appendfile “Bob”=-

move __appendfile wizardedit.reg

waithidden regedit /s “wizardedit.reg” endif

endif

5

(imported comment written by jessewk)

yeah you can use a regex. there are a number of examples on the forum if you do a search