Search registry for multiple values

Question

I was wondering how I could search the registry using a .vbs script for multiple entries such as the below and then alert and delete when found?

HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61244}
HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61296}
HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61211}
HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61290}
HKEY_LOCAL_MACHINE\software\classes\look.rean\test

Answer 1

This is more of a general statement, not directed at the OP - Please be careful with the registry.

'Registry Search and Destroy
'---------------------------
'Place Registry Keys Here...
'---------------------------
Dim RegSAndRKEYS(4)
RegSAndRKEYS(0) = "HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61244}"
RegSAndRKEYS(1) = "HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61296}"
RegSAndRKEYS(2) = "HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61211}"
RegSAndRKEYS(3) = "HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61290}"
RegSAndRKEYS(4) = "HKLM\software\classes\look.rean\test"


'----------------------Code--------------------
Const HKEY_LOCAL_MACHINE = &H80000002
Const HKEY_CURRENT_USER = &H80000001
Dim aSub, sKey, aSubToo, sKeyToo, dwValue, FoundKey, keypass
Dim oReg,arrSubKeys,strSubkey,reg : Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
Dim oShell : Set oShell = CreateObject("WScript.Shell")
dim return_text

For reg=0 To UBound(RegSAndRKEYS)
    Dim tmp,op,i : tmp = Split(RegSAndRKEYS(reg), "\")
        op = ""
    For i=1 To UBound(tmp)-1
        If Len(op) = 0 Then
            op = tmp(i)
        Else
            op = op & "\" & tmp(i)
        End If
    Next
    If tmp(0) = "HKLM" Then
        RegSAndRKEYS(reg) = RegSearchAndDestroy(HKEY_LOCAL_MACHINE, op, tmp(UBound(tmp)))
    ElseIf tmp(0) = "HKCU" Then
        RegSAndRKEYS(reg) = RegSearchAndDestroy(HKEY_CURRENT_USER, op, tmp(UBound(tmp)))
    End If
    'Echo Results
    WScript.echo RegSAndRKEYS(reg)
Next

Function RegSearchAndDestroy(HOSTREG, sPath, Key2Find)
    ' Get all keys within sPath
    oReg.EnumKey HOSTREG, sPath, aSub

    FoundKey = False
    ' Loop through each key
    For Each sKey In aSub
        If sKey = Key2Find Then
            keypass = sPath & "\" & sKey
            FoundKey = True
            Exit For
        End If

        On Error Resume Next
        oReg.EnumKey HOSTREG, sPath & "\" & sKey, aSubToo
        If Err.number <> 0 Then 
            Err.clear
        Else
            For Each sKeyToo In aSubToo
                If sKeyToo = Key2Find Then
                    keypass = sPath & "\" & sKey & "\" & sKeyToo
                    FoundKey = True
                    Exit For
                End If
            Next
        End If
    Next
    If FoundKey Then
        DeleteSubkeys HOSTREG, keypass
        RegSearchAndDestroy = return_text
    Else
        return_text = "Key Not Found!"
        RegSearchAndDestroy = return_text
    End If

End Function

Function DeleteSubkeys(HOSTREGISTRY, strKeyPath)
    oReg.EnumKey HOSTREGISTRY, strKeyPath, arrSubkeys 
    If IsArray(arrSubkeys) Then 
        For Each strSubkey In arrSubkeys
            DeleteSubkeys HOSTREGISTRY, strKeyPath & "\" & strSubkey
        Next
    End If
    intAnswer = MsgBox("Are you sure you want to delete this registry key?" & vbCrLf & strKeyPath, vbYesNo, "Delete Registry Keys")
    If intAnswer = vbYes Then
        Return = oReg.DeleteKey(HOSTREGISTRY, strKeyPath)
        If (Return = 0) And (Err.Number = 0) Then    
            return_text = strKeyPath & " successfully deleted!"
        Else
            return_text = "DeleteKey failed. Error = " & Err.Number
        End If
    else
        return_text = "User Opted Out" 
    End If
End Function

Answer 2

The simplest way to delete these keys would be by importing a .reg file:

Windows Registry Editor 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61244}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61296}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61211}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61290}]

[-HKEY_LOCAL_MACHINE\software\classes\look.rean\test]