China DOS Union

-- Unite DOS · Advance DOS · Grow DOS --

Union site: www.cn-dos.net　Forum site: www.cn-dos.net/forum
DOS stands for freedom, openness and progress. Let us work hard, learn from the openness and GNU spirit of FreeDOS and Linux, and together build and grow a free GNU GPL world!

Guest Register Log in Members Blogs Search Command Prompt Bash Upload Statistics
中国DOS联盟论坛
The time now is 2026-07-15 00:25
Welcome new member HGJFJR423　 RSS
48,012 topics / 350,091 posts / today 1 new / 48,229 members 不转换/ 简体中文/ 繁體中文（台灣）/ 繁體中文（香港）
中国DOS联盟论坛 » DOS批处理 & 脚本技术（批处理室） » How to use batch processing to delete the registry entries of rogue software View 4,248　Replies 7
Tell a Friend Share to X Share to Weibo Share to Telegram Share to QQ Zone Copy Link QR Code
Original Poster Posted 2006-11-30 08:13　·　 中国 山东 菏泽 电信
wang6610
银牌会员
★★★
Credits 1,246
Posts 488
Joined 2003-11-11 00:00
22-year member
UID 12699
Gender Male
Status Offline
HKLM\SOFTWARE\3721 -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\Assist -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\Assist\Modules -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\AutoLive -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\AutoLive\scrblock -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\CnsMin -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\CnsMinCg -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\CnsMin\CnsMinEx -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\3721\CnsMin\Variant -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\AutoLive.Live -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\AutoLive.Live.1 -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\AutoLive.Live\CLSID -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\AutoLive.Live\CurVer -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsHelper.CH -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsHelper.CH.1 -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsHelper.CH\CLSID -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsHelper.CH\CurVer -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsMinHK.CnsHook -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsMinHK.CnsHook.1 -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsMinHK.CnsHook\CLSID -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\CnsMinHK.CnsHook\CurVer -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\AutoUpdate -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\Enable -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\Hint -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\List -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\Reset -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\ResetCatch -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\!CNS\Tips -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CnsMin -> Adware.CnsMin : Ignored.
HKU\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721 -> Adware.CnsMin : Ignored.
HKU\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsMin -> Adware.CnsMin : Ignored.
HKU\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsMin\Variant -> Adware.CnsMin : Ignored.
HKU\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsUrl -> Adware.CnsMin : Ignored.
HKU\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\InputCns -> Adware.CnsMin : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.URLSearchHook -> Adware.CrackedEarth : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.URLSearchHook.1 -> Adware.CrackedEarth : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.URLSearchHook\CLSID -> Adware.CrackedEarth : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.URLSearchHook\CurVer -> Adware.CrackedEarth : Ignored.
C:\Program Files\Rising\AntiSpyware\Ras.exe -> Heuristic.Win32.HostFile : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.SrchHook -> Hijacker.ShopNav : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.SrchHook.1 -> Hijacker.ShopNav : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.SrchHook\CLSID -> Hijacker.ShopNav : Ignored.
HKLM\SOFTWARE\Classes\SearchHook.SrchHook\CurVer -> Hijacker.ShopNav : Ignored.
Floor 2 Posted 2006-11-30 08:15　·　 中国 山东 菏泽 电信
wang6610
银牌会员
★★★
Credits 1,246
Posts 488
Joined 2003-11-11 00:00
22-year member
UID 12699
Gender Male
Status Offline
You can also provide the *.reg for deleting them.

Thank you!
Floor 3 Posted 2006-11-30 08:59　·　 中国 广东 电信
namejm
荣誉版主
★★★★
batch fan
Credits 5,226
Posts 1,737
Joined 2006-03-10 00:38
20-year member
UID 51697
From 成都
Status Offline
This item C:\Program Files\Rising\AntiSpyware\Ras.exe is not a registry entry, right? Since I'm not very familiar with the registry, the following code has excluded this one:



@echo off

:: Save the content at the top floor as test.txt and then run this script

:: Check that the content of del.reg is correct before running del.reg

:: If this script can meet the needs, remove the :: at the beginning of the last two lines to automatically delete the relevant registry entries



echo Windows Registry Editor Version 5.00>del.reg

echo.>>del.reg

setlocal enabledelayedexpansion

for /f "tokens=1 delims=>" %%i in (test.txt) do (

    set var=%%i

    if "!var:~0,2!"=="HK" (

        set var=!var:~0,-2!

        set var=!var:HKLM\=HKEY_LOCAL_MACHINE\!

        set var=!var:HKU\=HKEY_USERS\!

        echo >>del.reg

        echo.>>del.reg

    )

)

:: regedit /s del.reg

:: del /q del.reg


[ Last edited by namejm on 2006-11-29 at 08:34 PM ]
尺有所短，寸有所长，学好CMD没商量。
考虑问题复杂化，解决问题简洁化。
Floor 4 Posted 2006-11-30 10:15　·　 中国 山东 菏泽 电信
wang6610
银牌会员
★★★
Credits 1,246
Posts 488
Joined 2003-11-11 00:00
22-year member
UID 12699
Gender Male
Status Offline
First, thank the moderator namejm.

The content of del.reg obtained is as follows: (I don't know if it's correct?)

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\Assist]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\Assist\Modules]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\AutoLive]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\AutoLive\scrblock]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\CnsMin]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\CnsMinCg]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\CnsMin\CnsMinEx]

[-HKEY_LOCAL_MACHINE\SOFTWARE\3721\CnsMin\Variant]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoLive.Live]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoLive.Live.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoLive.Live\CLSID]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AutoLive.Live\CurVer]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH\CLSID]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsHelper.CH\CurVer]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook\CLSID]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CnsMinHK.CnsHook\CurVer]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\AutoUpdate]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\Enable]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\Hint]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\List]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\Reset]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\ResetCatch]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CNS\Tips]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CnsMin]

[-HKEY_USERS\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721]

[-HKEY_USERS\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsMin]

[-HKEY_USERS\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsMin\Variant]

[-HKEY_USERS\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\CnsUrl]

[-HKEY_USERS\S-1-5-21-2000478354-842925246-1202660629-500\Software\3721\InputCns]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.URLSearchHook]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.URLSearchHook.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.URLSearchHook\CLSID]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.URLSearchHook\CurVer]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.SrchHook]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.SrchHook.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.SrchHook\CLSID]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchHook.SrchHook\CurVer]
Floor 5 Posted 2006-11-30 11:36　·　 中国 广东 电信
namejm
荣誉版主
★★★★
batch fan
Credits 5,226
Posts 1,737
Joined 2006-03-10 00:38
20-year member
UID 51697
From 成都
Status Offline
If in a reg file, the format of can uprooting this item. Then this code can achieve your purpose.

Rechecked and found that there are exclamation marks in the registry item. When processing, filter them out. This problem is a bit troublesome.

[ Last edited by namejm on 2006-11-29 at 10:44 PM ]
尺有所短，寸有所长，学好CMD没商量。
考虑问题复杂化，解决问题简洁化。
Floor 6 Posted 2006-11-30 12:10　·　 中国 广东 电信
namejm
荣誉版主
★★★★
batch fan
Credits 5,226
Posts 1,737
Joined 2006-03-10 00:38
20-year member
UID 51697
From 成都
Status Offline
Modify the code of 3F as follows, please test:


@echo off

echo Windows Registry Editor Version 5.00>del.reg

echo.>>del.reg

for /f "tokens=1 delims=>" %%i in (test.txt) do (

    call :build_reg "%%i"

    

)

:: regedit /s del.reg

:: del /q del.reg

goto :eof



:build_reg

set var=%1

set var=%var:~1,-3%

if "%var:~0,2%"=="HK" (

    set var=%var:HKLM\=HKEY_LOCAL_MACHINE\%

    set var=%var:HKU\=HKEY_USERS\%

    echo >>del.reg

    echo.>>del.reg

)

goto :eof
尺有所短，寸有所长，学好CMD没商量。
考虑问题复杂化，解决问题简洁化。
Floor 7 Posted 2007-06-12 21:30　·　 中国 广东 深圳 龙岗区 电信
okmhy
新手上路
★
Credits 15
Posts 7
Joined 2006-06-23 13:36
20-year member
UID 57456
Status Offline
C:\>reg delete \\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\888 /f
Error: Invalid item name
Where is the mistake in this sentence?
I have tested repeatedly and it seems that the mistake is here: there is a space in "Windows NT". How to solve this?
Floor 8 Posted 2009-01-13 16:19　·　 中国 江苏 南京 电信
anythingsky
新手上路
★
Credits 11
Posts 6
Joined 2008-12-12 13:18
17-year member
UID 133645
Gender Male
Status Offline
It's too advanced, I can't understand it at all.
Printable Version | Subscribe | Add to Favorites
Forum Jump:
[ Contact the Union admin team - 中国DOS联盟 ]

Sponsored by ifanr Inc | © 2001–2023