Delete keys from Registry

Hi,

I have Win 7 Pro 64 bit version and  I would like to delete from Registry some keys.
The path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_04D8&PID_900A\
I would like the entire “VID_04D8&PID_900A” folder deleted.
For some reasons cannot, but I want to remove it.
I need some suggestions how can I do that.

Background
The keys are related with Microchip  PICkit 3 programmer seen as “USB Input Device” in Device Manager. I had some troubles with PICkit 3 and I decided to uninstall all the software from Microchip, including the drivers for PICkit 3. Then later I want a new, clean install. I would like to clean any left-overs in registry too. Then with a new installed driver the settings to be reset to default original values.

Registry.jpg
LVL 21
viki2000Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mark BillExchange, AD, SQL, VMware, HPE, 3PAR, FUD, Anti MS Tekhnet, Pro EE, #1Commented:
log into the computer with the local administrator account, should be able to then.

If not download regseeker a great free tool from a company called hoverdesk this will do the job.

You may need to restart the PC and log in as local admin straight away before any other user to get this done too.

Ta
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

Make sure you login with Administrator rights' user , Then right click on "Device Parameters",  in attached screen shot, choose permissions and tick on full control for your own user. Some times even the administrator does not have full rights on some reg. keys.

This way one can take control of any registry key.
0
viki2000Author Commented:
For "Device Parameters" I can allow Permisions - Full, but for the rest no. The rest of the info I cannot delete or change.
RegSeeker cannot find "VID_04D8&PID_900A"
0
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

Eng. Nidal KamalInformation ConsultantCommented:
Hi,

Try to install Power tools from https://www.macecraft.com/. Then run the tool to scan and fix reg.
After fixing and cleaning damaged reg. keys, restart the system, and try to get full control of  "VID_04D8&PID_900A".

If that didn't help, please provide full screen shots including the permissions of  "VID_04D8&PID_900A".
0
viki2000Author Commented:
I am logged in as "viki2000", but viki2000 is Administrator. It is a standalone PC connected to Internet. It is not on domain.
I click Start - Run - Type "regedit", then click right on regedit.exe and "Run as Administrator".
The folder  "VID_04D8&PID_900A" with its sub-folders is alwasy there, cannot be deleted or permissions changed to full control.
I installed jv16 powertools x, I ran it few times because it said to have registry errors. Now is 100% healthy - see attached picture.
I used also the Registry search from inside the jv16 power tools. I deleted everything what could be detected related with "VID_04D8&PID_900A" , but in the end is note saying that not all entries in registry could be deleted.
Restarted PC several times. Tried again the regedit.exe from windows. The same, cannot be deleted.
Registry
And here are the registry screen shots:
https://drive.google.com/file/d/0BwXmKaSw75eKa05tNTVoMkdDTVk/view
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

It looks like the owner rights has special permissions that prevent even admins to change it.
Please take full root backup of registry before proceeding, just in case something wrong happened. Execute regedit choose the root of reg. "computer", File->Export... write in a name you want , then press Save. Then Follow below steps:

1.Goto the reg. key that you cannot change permissions to, then click on Advance  for special permissions.
2. A new screens appears choose Add
3.Pick Select Principal.
4.Write administrators and click on Check Names,then press OK.
5. Click on Full Control under Basic Permissions, then press OK.

Now Administrators should have full permission to modify or del the reg. key.
0
viki2000Author Commented:
Does not allow me to do that.
Registry_2
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

I have included screen shots of the steps needed to gain Full Control

https://drive.google.com/folderview?id=0B1H6XkYMsBgiNFRZaVBTd3J3ZlU&usp=sharing
0
viki2000Author Commented:
Here it is the recorded screen with the steps and the negative result:
https://drive.google.com/file/d/0BwXmKaSw75eKOUozQzA0MlVnZGc/view
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

It looks like there is a special permission at the upper level of the Reg key.
Please try to give Full Control the user you login with on the upper level .
Waiting for your positive feedback.
0
viki2000Author Commented:
But the user login is member of Administrators.
What else can I do?
There is no other user on that PC.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

No problem with having one Administrator. I mean the premissions of attached two reg keys must have the administrator Full previlge too.
Reg-keys.png
0
viki2000Author Commented:
"Please try to give Full Control the user you login with on the upper level ."
How do I do that?
As long as the logged user is Administrator, what else can we expect? Which is an upper level? And how to access it?
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

What I mean in the upper level in registry not at user level. In other words, one should give rights to the lower two reg keys as the upper level in registry have full control. The two keys which must have full control too, to be able to delete the registry key above them, attached.
Reg-keys.png
0
viki2000Author Commented:
I understand what you suggest that I shall do, but as previous questions above, how do I accomplish that?
I am logged in with a user account that has Administrator rights.
What else can I do to to have more rights over the registry?

I have only one user and has Administrator rights.
Nevertheless, I tried one more thing. I activated Administrator account as suggested here:
https://www.youtube.com/watch?v=loU9qJd28hM

Run Command Prompt as Administrator in the exiting account and then type:
net user administrator /active:yes

Then I got the Administrator account at the login moment.
I logged in with that Administrator account.
I tried to delete those keys. It does not work.
I checked the permissions. It has full permission.
What is wrong?

It cross to my mind only on more thing.
What if some services are active and the registry keys relate to the services or some application active in memory?
Would be then a situation like I have, impossible to delete those keys from registry ? Or are the registry keys are independent of the services or other applications?
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

Please double check you have full permissions of the two folders registry keys underneath the Reg. Keys folder you want to delete.
Can you please try to delete the registry keys on the right hand side, one by one, then remove the folder reg. keys on the left hand side of the reg.?

If that didn't work, please support me with recorded screens that show the permissions the three folders on the left hand side that need to be deleted.
0
viki2000Author Commented:
I think that is my basic problem. I cannot give full permissions to certain keys or folders even if I am logged in as Administrator. There are other restrictions that I am not aware.
Have a look by yourself:
https://drive.google.com/open?id=0BwXmKaSw75eKMlA0VXJnNWJjaTA

I will be gone for 1 week, then we can chat again.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

To gain Full Control on the remaining, not deleted, sub keys, please follow the steps mentioned in screen shots as is. Don't add or choose any permissions from the first page, just click on advance for special permissions to add and get full permissions.

https://drive.google.com/folderview?id=0B1H6XkYMsBgiNFRZaVBTd3J3ZlU&usp=sharing
0
viki2000Author Commented:
I do not have that option "ALL APPLICATION PACKAGES". It is just not there.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

That is O.K. just pick any  group or user to proceed with Advance permissions and special settings as mentioned above in numbered screen shots.
0
viki2000Author Commented:
I am logged in as Administrator.
I run “regedit” as Administrator.
And there is a higher authority than me. Unbelievable.
See for yourself:
https://drive.google.com/open?id=0BwXmKaSw75eKWlY1dVFBLXlaRms
https://drive.google.com/open?id=0BwXmKaSw75eKTTk2cXlRRGFGcjg 

I will come back after 6th January 2016 to discuss the matter or to abandon it for the time being.
Is not so urgent anymore. I do not need any more to delete those keys, but is interesting why I cannot.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

After choosing Advance permissions and before clicking on Apply, or O.K., please choose Replace all Child Object permissions entries with inheritable permission entries from this object, as attached. Then Click on Apply , OK Keys. Do this for all sub-keys.

This should make the Administrator be able to del the lowest sub keys then be able to del the required Reg. Key.
Choose-Replace-all-child-....png
0
viki2000Author Commented:
OK, I will try that Friday or Monday. For the moment I cannot have access to that PC.
0
viki2000Author Commented:
I have tried.
The same error.
Does not allow me to change anything.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

Can you follow steps mentioned in this article https://community.landesk.com/support/docs/DOC-10928 , to offline load the reg. keys, modify it, then unloaded with the modified , deleted keys?

If you need any help with software needed, I will be more than happy to help you get them.
0
viki2000Author Commented:
It just came another idea in my mind.
How about unistall the antivirus, antimalware software?
I tried only disable, but does not work.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

I think it is better to eliminate all possibilities by booting from windows PE edition.
0
viki2000Author Commented:
I think editing outside the Windows may solve the problem, but I do not want to try it now.
It make me feel not safe. What if the Windows will not boot anymore properly?
And is a bit too much trouble for me, because I am focused on other tings more important.
I would prefer more trials inside Windows.
If you do not mind I will like to know the opinion of other experts too.
0
Radhakrishnan RSenior Technical LeadCommented:
Hi,

It's definitely permission issue. you need to take ownership of the entire root registry and it's sub folder, place a tick mark on "Replace all child objects auditing entries with inheritable auditing entries with this objects". While applying this settings you may get access denied. If so, Auditing tab, add "Administrato" with full control then again select  "Replace all child objects auditing entries with inheritable auditing entries with this objects". Again go to "effective access" and do the same steps as above.

You need to play around this location again if you still get access denied. Surely it works if you set the permission properly, this will be the root cause of this issue.
0
viki2000Author Commented:
But that was suggested also before in different ways and did not work.
Of course I can try one more time Monday-Tuesday and I can even record record the screen.
What about my previous idea: would be possible that the antivirus or anti-malware software to take over the authority/permission and to not let me delete those keys?
0
Davis McCarnOwnerCommented:
Here is a far simpler way.....
Download PSTools by SysInternals (now Microsoft): https://technet.microsoft.com/en-us/sysinternals/pstools.aspx
Unzip it.
In the extracted folder, create this BAT file:
c:\pstools\psexec -s -i regedit.exe
pause
(I named mine PS-Regedit.bat)
Copy the pstools folder to C:\, navigate to it, right-click on the BAT file, and choose run as administrator.
You'll be prompted to agree to PSEXEC; but, afterwards, you'll be running REGEDIT as the SYSTEM account and can then do anything (so be careful, OK?).

I use this regularly to clean up the detritus from malware, failed antivirus uninstalls, etc.; because, for example, when you've got 10+ McAffee devices left behind, changing the permissions on each entry is a pain in the behind!
1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
viki2000Author Commented:
Thank you Davis.
I will definitely try that next week as it seems a logic approach which gives me hope.
0
Davis McCarnOwnerCommented:
As a note, the SYSTEM account is above Administrator and can do just about anything!
0
viki2000Author Commented:
Finally today I had time to try it.
PStools worked like a charm. 2min and problem solved.
Definilty Davis McCarn solved the problem, but if you do not mind I would like to offer some points to Eng. Nidal Kamal too for the advices and time spent.
Suggestions coming from Radhakrishnan do not work. In fact are similar with what Eng. Nidal Kamal told me several times in different ways.
0
Eng. Nidal KamalInformation ConsultantCommented:
Good day,

Thanks for your kind points Viki2000.

Thanks Davis McCarn for your en lighting way. Editing remotely without the cumbersome of booting from winPE, then modifing offline exclusive permission.

I am glad that it finally work out.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.