Re: Syntax for deletions in a .reg file
Spacey Spade said:
Only needed now is to be able to export a reg file that looks like:
[-HKEY_USERS........] where you know what the minus sign in the key will
do. Can you put minus signs in front of values as well?
Syntax for removing a key, as you say, it's the "-" inside the bracket.
(It's strong, an RD kind of thing, which also kills any subkeys beneath
it.)
[-HKEY_CURRENT_USER\UglyKey]
Syntax, for removing a value: it's using the value name, together with
setting a minus (-) for that value data. IOW, the "=" is followed by a "-".
[HKEY_CURRENT_USER\AnyKey]
"UglyValue"=-
It's whole keys that I delete, 98% of the time. Yet I do have some values
that I like to kill...
== DELETE VALUES ==
First example
Sometimes when online, I run a "keep alive" program. I've not devoted
time to look for the best option in this cat, so in the meantime I use
the one that's installed. It's AC-Plug, by I-Opus. These people have
decided, that despite calling their program freeware, they want to try to
use my msie-based browsers as an advertising medium for their company.
By inserting their name into my browser header, which files into webmaster
logs. I consider it my right to control how my browser-agent header reads
out, and to disallow outsiders plastering onto it their brand-name bumper
stickers.
So to keep it clean, I launch AC-Plug only from a shortcut that points to
a .bat:
------Run AC-PLUG.bat-----------------
acplug -on -tray
regedit /s kill.reg
cls
--------------------------------------
The kill.reg file abruptly wipes out their sneaky value:
-------Kill.reg------------------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\User Agent\Post Platform]
"iOpus-I-M"=-
-----------------------------------------
Second example
The free registerware programs from FreshDevices. The FD "freewares"
commit the same sneaky insertion of invalid keys into your registry as
is most common with time-out shareware. The common act: creating one or
more garbage/bogus registry keys, then using those bogus keys to store
what are usually hex values for tracking counts or date.
Even after I went through the registration routine with FreshDevices.com,
and entered the information via the interface of their programs, I found
that every launch of their programs continues to insert bogus krap.
I like to view, and try to learn from, my registry in its true and _valid_
form. I do not want the nonsensical clutter in there that serves to only
cause me confusion. So my launch of the FreshDevices programs gets followed
by a deletion of their invalid keys.
On two of their programs, I have nothing within the relevant key I need
to keep. For example, FreshDiagnose creates the following whenever it is
launched:
[HKCR\fndfile\shellex\Topic]
"Z"=hex:00,00,00,00,20,63,e2,40
"CZ"=hex:53,be,0b,01
"CY"=dword:00000001
Since I've got no valid values under that [..\Topic], I run a deletion of
the entire key.
[-HKEY_CLASSES_ROOT\fndfile\shellex\Topic]
I've the same circumstance with their FreshUI, where I can just kill the
whole key [HKCR\ShellScrap\shellex\Topic]. OTOH, FreshDownload's chosen
location for inserting garbage values: It's a key which, on my system,
also contains a value that appears as if it might be legit.
[HKCR\mhtmlfile\shell\open\ddeexec\Topic]
@="WWW_OpenURL"
"Z"=hex:00,00,00,00,a0,81,e2,40
"CZ"=hex:32,be,0b,01
So this is a case where I think I want to keep the key itself, in case it's
correctly needed, while deleting those values within it which are known to
be invalid. The .reg file then comes out this way:
------delete bogus values.reg---------------
REGEDIT4
[HKEY_CLASSES_ROOT\mhtmlfile\shell\open\ddeexec\Topic]
"Z"=-
"CZ"=-
----------------------------------------------
.. . . .
Value deletion examples fin, and coming back to the beginning:
Only needed now is to be able to export a reg file that looks like:
[-HKEY_USERS........] where you know what the minus sign in the key will
do. Can you put minus signs in front of values as well?
Delete Key
[-HKEY_CURRENT_USER\UglyKey]
Delete Value
[HKEY_CURRENT_USER\AnyKey]
"UglyValue"=-
Another related action in using .reg files, it would be for replacing
values.
== REPLACE VALUES ==
For example, changing the HTTP connections values. Say I'd previously had
my values at a conservative (law-abiding.good-netizen) setting, but then
later chose instead to overwrite them to something much higher. The new
value data entries after the "=" will overwrite the old:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings]
"MaxConnectionsPer1_0Server"=dword:00000028
"MaxConnectionsPerServer"=dword:00000028
The other values in the [..\Internet Settings] key in the registry, they
will be left untouched by the merge.
Another example for overwriting values. For a while I was going back and
forth between two user settings, mostly related to color schemes, for
TreePad Lite. I used a pair of .reg files to toggle between two layout
schemes. An excerpt from one of those files:
[HKEY_CURRENT_USER\Software\Freebyte\Treepad2\Tree\Font]
"font_name"="verdana"
"font_color"=dword:00ffff00
Here, the "font_color" value data in the .reg file overwrites whatever
color setting is in place in my registry when the .reg gets merged.
.. . . .
These examples, for deleting values, and for changing values, they are
something I have need to do only a fraction of the time, compared to key
deletions.
== DELETE KEYS ==
Deleting keys is something I do constantly; and in many cases, system-
atically. For instance, to deal with the constant annoyance, committed
by far too many programs, to vainly insert their custom filetype and
association into my registry, every time I launch their executable.
It becomes even more of a problem when that program is also auto-creating
a \shellnew key under its custom extension, badly littering up my explorer
context-click "New" menu.
Systematic whole-key deletion, for cutting out that annoyance.
------Kill FileImg's krap.reg------------------------
REGEDIT4
[-HKEY_CLASSES_ROOT\.fid]
[-HKEY_CLASSES_ROOT\.fii]
[-HKEY_CLASSES_ROOT\FileImgDiff.Document]
---------------------------------------------------------
Before finishing the deletion examples talke here, I should make sure to
at least note a couple of keep-in-mind things about branch names as they
relate to .reg files.
== REGISTRY BRANCH NAMES ==
[1] HKLM, HKCR, HKU, HKCU, etc
I like this shorthand and choose it in writing most often. It is also
pretty widely functional. It can be fed to the graphical registry editors,
when you want them to load a path. It is used in .inf files for registry
manipulatons. (Also the Script Host, for .vbs & .js, it uses the
abbreviations, only excluding hw branches. I've seen around some other
contexts, additionally, where the shorthand is used, tho' those were
contexts too foreign to my experience for me to enumerate them.)
Where the shorthand does not work is in .reg files that are used to merge
to the registry. I'd slipped up about that, including recently in a post
made to acf. I gave a .reg file that was dysfunctional, because I'd not
written out the branch name. The example from that case: I'd mistakenly
written HKCU\ for a .reg, instead of the needed longer HKEY_CURRENT_USER\.
So I figure I should note here that others may also need to look out for
avoiding this type of error that I've found myself prone to.
[2] HKCU and HKCR are pretend/imaginary/virtual
Also true with the hardware related branches. This doesn't matter if
you're in Windows. Yet if you need a .reg file to get processed before
Windows has loaded, then you have to name the real, actual branches
involved. There are only two: HKEY_LOCAL_MACHINE and HKEY_USERS.
If in Windows, it's simpler to deal with, say: HKEY_CLASSES_ROOT\
Instead of working from the real path: HKEY_LOCAL_MACHINE\Software\CLASSES\
Everything seems to work fine, and more conveniently, when using the
short virtual paths, including with .reg files to merge. Just be aware.
You will need to make adjustments in any .reg which you plan to have
processed at a stage in the boot process that occurs before Windows
has loaded.
[BRANCH LAYOUT FOOTNOTE]
In my notes [1] and [2] above, I'm making somewhat elliptical reference
to the registry layout and branch names. For those not already adjusted
to what's up with the basic outline of the branches as viewed in a reg
editor, best bet is to look over one of the web pages that presents this
in a visual table layout together with brief definitions about each branch.
(google w maybe "registry structure" or architecture.) In the meantime,
below for a brief rough sketch.
[Real]
HKLM....HKEY_LOCAL_MACHINE
HKU.....HKEY_USERS
[Virtual; software]
HKCR....HKEY_CLASSES_ROOT
= HKEY_LOCAL_MACHINE\Software\Classes
HKCU....HKEY_CURRENT_USER
= HKEY_USERS\<name>
[Virtual; devices, hardware]
HKCC....HKEY_CURRENT_CONFIG
= HKEY_LOCAL_MACHINE\Config\<number>
HKDD....HKEY_DYN_DATA (dynamic, not-for-edit)