Solved

VBS and Registry keys

Posted on 2004-10-29
321 Views
Last Modified: 2012-08-13
Hello everyone,

I have a small issue that I need a little help with. I have a logon script that I use on the network, I have added the ability to delete certain registry keys to it...but it deletes it based on the value (i.e. name). What I want to do is delete it based on the data, for instance we have a user with a virus that makes a key in the key HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce with a value of "wlan driver" and data being serviced.exe. I can delete it based on "wlan driver" but I need to get rid of it based on "serviced.exe"

Any help would be very helpful

Thanks
0
Question by:JoeDW
    3 Comments
     
    LVL 7

    Accepted Solution

    by:
    Following untested code should do it:

    set sh = WScript.CreateObject("WScript.Shell")
    If ucase(sh.RegWrite("HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\wlan driver")) = "SERVICED.EXE" then
         sh.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\wlan driver"
    end if

    0
     
    LVL 1

    Author Comment

    by:JoeDW
    That looks great but would there be anyway to incorporate this into my current code:

    Private Sub RegClean

      On Error Resume Next

      Dim strRegKey              
      Dim strSubKey        
      Dim strKey              
      Dim strRegVal        
     
      strRegKey1 = "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion"
      strRegKey2 = "HKCU\Software\Microsoft\Windows\CurrentVersion"
      strRegKey3 = "HKLM\Software\Microsoft\Windows\CurrentVersion"
     
      strSubKey1 = "Run"
      strSubKey2 = "RunOnce"
      strSubKey3 = "RunServices"
     
      strRegVal1 = "wlan driver"
      strRegVal2 = "MSMGR"
      strRegVal3 = "Windows network driver"
     
      strKey1 = (strRegKey3 & "\" & strSubKey2 & "\" & strRegVal1)
      strKey2 = (strRegKey3 & "\" & strSubKey2 & "\" & strRegVal2)
      strKey3 = (strRegKey3 & "\" & strSubKey2 & "\" & strRegVal3)
       
      objWshShell.RegDelete (strKey1)
      objWshShell.RegDelete (strKey2)
      objWshShell.RegDelete (strKey3)
     
    End Sub

    Thanks again for the comment
    0
     
    LVL 1

    Author Comment

    by:JoeDW
    never mind I have it now...thanks for the help though
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Introduction This article makes the case for using two modules in your VBA/VB6 applications to provide both case-sensitive and case-insensitive text comparison operations.  Recently, I solved an EE question using the LIKE function.  In order for th…
    When designing a form there are several BorderStyles to choose from, all of which can be classified as either 'Fixed' or 'Sizable' and I'd guess that 'Fixed Single' or one of the other fixed types is the most popular choice. I assume it's the most p…
    As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
    Get people started with the utilization of class modules. Class modules can be a powerful tool in Microsoft Access. They allow you to create self-contained objects that encapsulate functionality. They can easily hide the complexity of a process from…

    846 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now