Results 1 to 17 of 17

Thread: Deleting Registry Keys

Threaded View

  1. #1

    Thread Starter
    PowerPoster
    Join Date
    May 2006
    Posts
    2,295

    Deleting Registry Keys

    Hey guys I am using this code to search for registry keys that certain spy ware makes.

    VB Code:
    1. Option Explicit
    2.  
    3. Private Type FILETIME
    4.     intLow As Long
    5.     intHigh As Long
    6. End Type
    7.  
    8. Private Declare Function RegOpenKeyEx Lib "advapi32.dll" _
    9.     Alias "RegOpenKeyExA" _
    10.     (ByVal hKey As Long, _
    11.     ByVal lpSubKey As String, _
    12.     ByVal ulOptions As Long, _
    13.     ByVal samDesired As Long, phkResult As Long) As Long
    14.  
    15. Private Declare Function RegEnumKeyEx Lib "advapi32.dll" _
    16.     Alias "RegEnumKeyExA" _
    17.     (ByVal hKey As Long, _
    18.     ByVal dwIndex As Long, _
    19.     ByVal lpName As String, _
    20.     lpcbName As Long, _
    21.     ByVal lpReserved As Long, _
    22.     ByVal lpClass As String, _
    23.     lpcbClass As Long, _
    24.     lpftLastWriteTime As FILETIME) As Long
    25.  
    26. Private Declare Function RegCloseKey Lib "advapi32.dll" _
    27.     (ByVal hKey As Long) As Long
    28.  
    29. Const HKEY_CLASSES_ROOT = &H80000000
    30. Const HKEY_CURRENT_USER = &H80000001
    31. Const HKEY_LOCAL_MACHINE = &H80000002
    32. Const HKEY_USERS = &H80000003
    33.  
    34. Const ERROR_SUCCESS = 0&
    35.  
    36. Const SYNCHRONIZE = &H100000
    37. Const STANDARD_RIGHTS_READ = &H20000
    38. Const KEY_QUERY_VALUE = &H1
    39. Const KEY_ENUMERATE_SUB_KEYS = &H8
    40. Const KEY_NOTIFY = &H10
    41. Const KEY_READ = ((STANDARD_RIGHTS_READ Or _
    42.                   KEY_QUERY_VALUE Or _
    43.                   KEY_ENUMERATE_SUB_KEYS Or _
    44.                   KEY_NOTIFY) And _
    45.                   (Not SYNCHRONIZE))
    46.  
    47. Dim strBranch As Long
    48.  
    49. Private Sub Combo1_Click()
    50.     ' Set the branch to search depending on
    51.     ' what is selected in the ComboBox
    52.     Select Case Combo1.ListIndex
    53.         Case 0
    54.             strBranch = HKEY_CLASSES_ROOT
    55.         Case 1
    56.             strBranch = HKEY_CURRENT_USER
    57.         Case 2
    58.             strBranch = HKEY_LOCAL_MACHINE
    59.         Case Else
    60.             strBranch = HKEY_USERS
    61.     End Select
    62. End Sub
    63.  
    64.  
    65.  
    66. Private Sub startscanregbutton_Click()
    67.     Dim i As Integer
    68.     Dim lngKeyHandle As Long
    69.     Dim lngResult As Long
    70.     Dim lngCurIdx As Long
    71.     Dim strValue As String
    72.     Dim lngValueLen As Long
    73.     Dim strClass As String
    74.     Dim lngClassLen As Long
    75.     Dim strResult As String
    76.     Dim lngTime As FILETIME
    77.     Dim strSearch As String
    78.     Dim intSearchLen As Integer
    79.     Dim blnMatch As Boolean
    80.    
    81.     i = 0
    82.     ' Clear the current results
    83.     listreg.Clear
    84.     ' Assign the new string to search for
    85.     strSearch = Text1.Text
    86.     intSearchLen = Len(strSearch)
    87.    
    88.     ' Open the Root Branch to search
    89.     lngResult = RegOpenKeyEx(strBranch, _
    90.             "", _
    91.              0&, _
    92.              KEY_READ, _
    93.              lngKeyHandle)
    94.    
    95.     If lngResult <> ERROR_SUCCESS Then
    96.         MsgBox "Cannot open key.", , "Search Registry Keys"
    97.     Else
    98.     ' If the Root branch can be opened, disable
    99.     ' the buttons and begin the search
    100.         startscanregbutton.Enabled = False
    101.        ' Command2.Enabled = False
    102.         listreg.Enabled = False
    103.         Reg.MousePointer = 11
    104.        
    105.         lngCurIdx = 0
    106.         Do
    107.             lngValueLen = 2000
    108.             strValue = String(lngValueLen, 0)
    109.             lngClassLen = 2000
    110.             strClass = String(lngClassLen, 0)
    111.        
    112.             ' Enumerate all the sub keys
    113.             lngResult = RegEnumKeyEx(lngKeyHandle, _
    114.                  lngCurIdx, _
    115.                  ByVal strValue, _
    116.                  lngValueLen, _
    117.                  0&, _
    118.                  ByVal strClass, _
    119.                  lngClassLen, _
    120.                  lngTime)
    121.            
    122.             ' Increment the index of found keys
    123.             lngCurIdx = lngCurIdx + 1
    124.        
    125.             If lngResult = ERROR_SUCCESS Then
    126.                 ' Trim the current key to its actual length
    127.                 strResult = Left(strValue, lngValueLen)
    128.                
    129.                 ' Eliminate case if the search is insensitive
    130.                 blnMatch = False
    131.                 strValue = strResult
    132.                 If Check1.Value = 0 Then
    133.                     strResult = LCase(strResult)
    134.                     strSearch = LCase(strSearch)
    135.                 End If
    136.  
    137.                 ' Compare strings based upon search type
    138.                 Select Case Combo2.ListIndex
    139.                     Case 0
    140.                         ' Check if any portion of the search string is found.
    141.                         If InStr(strResult, strSearch) Then blnMatch = True
    142.                     Case 1
    143.                         ' Check if an exact match is found.
    144.                         If strResult = strSearch Then blnMatch = True
    145.                     Case 2
    146.                         ' Check if the search string matches the
    147.                         ' left portion of the key string.
    148.                         If Left(strResult, intSearchLen) = strSearch Then blnMatch = True
    149.                     Case Else
    150.                         ' Check if the search string matches the
    151.                         ' right portion of the key string.
    152.                         If Right(strResult, intSearchLen) = strSearch Then blnMatch = True
    153.                 End Select
    154.                
    155.                 ' Populate the list with keys that match
    156.                 ' the search criteria
    157.                 If blnMatch Then
    158.                     i = i + 1
    159.                     listreg.AddItem strValue
    160.                 End If
    161.             End If
    162.        
    163.         ' Keep looking for more keys
    164.         Loop While lngResult = ERROR_SUCCESS
    165.         ' Close the Root Branch
    166.         lngResult = RegCloseKey(lngKeyHandle)
    167.    
    168.         ' Enable the buttons
    169.         Reg.MousePointer = 0
    170.         listreg.Enabled = True
    171.         startscanregbutton.Enabled = True
    172.       '  Command2.Enabled = True
    173.        
    174.         ' Display the total matches
    175.         MsgBox "Total matches:" & Str(i), , "Search Registry Keys"
    176.     End If
    177. End Sub
    178.  
    179.  
    180. Private Sub Form_Load()
    181.  
    182.    
    183.     SearchReglbl.Caption = "Search Mode:"
    184.  
    185.    
    186.    Currentreglbl.Caption = "Find What:"
    187.  
    188.     Combo1.AddItem "HKEY_CLASSES_ROOT"
    189.     Combo1.AddItem "HKEY_CURRENT_USER"
    190.     Combo1.AddItem "HKEY_LOCAL_MACHINE"
    191.     Combo1.AddItem "HKEY_USERS"
    192.     Combo1.ListIndex = 0
    193.     Combo1.TabIndex = 0
    194.    
    195.  
    196.     Combo2.AddItem "Portion"
    197.     Combo2.AddItem "All"
    198.     Combo2.AddItem "Left"
    199.     Combo2.AddItem "Right"
    200.     Combo2.ListIndex = 0
    201.     Combo2.TabIndex = 1
    202.    
    203.  
    204.     Text1.Text = ""
    205.     Text1.TabIndex = 2
    206.    
    207.  
    208.     Check1.Caption = "Match Case"
    209.     Check1.Move 4680, 1320, 1275, 255
    210.     Check1.TabIndex = 5
    211.  
    212.  
    213.     listreg.TabIndex = 6
    214. End Sub
    215.  
    216. Private Sub Image2_Click()
    217. Unload Me
    218. End Sub
    219.  
    220. Private Sub Image3_Click()
    221.  
    222. End Sub

    Now, I got that code off of a Microsoft site, and changed some of it around. But I was wondering, if the program did find a match, how do I delete a registry key if it is in text1.text?

    Thanks

    OR Perhaps I am using the wrong thing to search, according to virus list. certain viruses or spyware will put a "mutex" like this {BD96C556-65A3-11D0-983A-00C04FC29E36}

    in the system registry.
    I would like to search for such things and delete them if there is a match.
    Last edited by Justin M; Apr 18th, 2008 at 04:16 PM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width