Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to clean the Windows registry after manually removing a program. What I need to do is following.

  1. Find all keys, values, and data containing "something".
  2. Delete all keys, values, and data matching the description.

Can I use the Reg command in CMD for this somehow?

By "something" in this case, I mean "office12".

share|improve this question
    
You could, but most likely you wouldn't get what you wanted. I will expand later but consider programs may place registry entries on non-obvious places (which is why uninstallers exist). For the REG command here's the help –  Doktoro Reichard Sep 18 '13 at 19:45
    
@DoktoroReichard What would the syntax be for querying all root keys and not just specific keys like HKLM? Is it possible to redirect Reg Query to Reg Delete so that found matches are deleted? Can you do it in one line and without any advanced scripting, batch processing, etc.? –  sammyg Sep 18 '13 at 19:53
    
Can you define what you consider to be "something"? Are you looking for value names, key names, data in values, or what? –  Doktoro Reichard Sep 18 '13 at 20:11
    
I mean "office12". It doesn't matter if it's a key, value or data. I want to search them all, just like you can check what you want to find using the Ctrl+F (find) command in RegEdit. –  sammyg Sep 18 '13 at 20:22
    
I was really just looking for a way to automate the process a little bit. Instead of having to do Ctrl+F, type "office12" in the text field, Enter, DEL, F3, DEL, F3, DEL, F3, DEL, etc. –  sammyg Sep 18 '13 at 20:23

2 Answers 2

Like I said in the comment, you can delete registry keys all you want, either using the command prompt, or manually with Regedit. Now, the big problem is your first point.

  1. Find all keys, values, and data containing "something".

Unless you were monitoring / auditing the registry when you installed the program (and assuming the happy scenario the program didn't add registry keys at runtime, if so you would need to monitor the registry from start to finish), the program might have added keys to the registry in non-obvious places.

Most programs add their registry keys in the HKEY_CURRENT_USERS\Software or in HKEY_LOCAL_MACHINE\Software in a dedicated branch (I'm looking at wxMaxima, for instance, located in the first path). If you deleted the corresponding branch you could in theory delete all keys associated with the program. However, some programs might alter something somewhere on the rest of the registry, and that doesn't have a good rule of thumb.

If, on the other hand, you did monitor everything, then reversing the changes is trivial (because you know what were they). I suppose you could reinstall the program on a virtual environment and monitor there. In theory you would receive the same results.

From reading the REG help, no option is available to do what you propose on 1. What REG QUERY does is to check the values inside a registry key. To paste a usage:

C:\Documents and Settings\User>reg query HKCU\Software\wxMaxima

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\wxMaxima
    ShowTips    REG_DWORD       0x1
    tipNum      REG_DWORD       0xb
    pos-x       REG_DWORD       0xfffffffc
    pos-y       REG_DWORD       0xfffffffc
    pos-w       REG_DWORD       0x408
    pos-h       REG_DWORD       0x2ea
    pos-max     REG_DWORD       0x1
    lastPath    REG_SZ  (some random path)
    maxima      REG_SZ  C:\Maxima\\bin\maxima.bat
    parameters  REG_SZ  -X '--dynamic-space-size 1000'
    fontSize    REG_DWORD       0xc
    mathFontsize        REG_DWORD       0xc
    matchParens REG_DWORD       0x1
    showLong    REG_DWORD       0x0
    fixedFontTC REG_DWORD       0x1
    changeAsterisk      REG_DWORD       0x0
    enterEvaluates      REG_DWORD       0x0
    saveUntitled        REG_DWORD       0x1
    openHCaret  REG_DWORD       0x0
    defaultPort REG_DWORD       0xfaa
    usejsmath   REG_DWORD       0x1
    keepPercent REG_DWORD       0x1
    pos-restore REG_DWORD       0x0
    language    REG_DWORD       0x0
    fontEncoding        REG_DWORD       0x0

HKEY_CURRENT_USER\Software\wxMaxima\AUI

HKEY_CURRENT_USER\Software\wxMaxima\RecentDocuments

HKEY_CURRENT_USER\Software\wxMaxima\Style

HKEY_CURRENT_USER\Software\wxMaxima\Wiz

I'm looking for solutions. One I found involves exporting the Registry to a text file and from there filter the results.

share|improve this answer
    
Don't mind newer versions of Windows, this problem is on Windows XP. So that suits me nicely. It's XP Pro SP3. –  sammyg Sep 18 '13 at 20:02
    
The program I removed was Microsoft Office 2007. I didn't want to uninstall it. But after installing a newer version of Windows Installer (from 3.0 to 3.1) and then SP3 (with bundled Windows Installer 4.5) the problem arose. Basically all MSI or Windows Installer based programs started misbehaving. When I would log on to Windows I would get a "Windows Installer" dialog box "preparing to install" and it would say the "network resource" is unavailable. It looked similar to this one! If I clicked Cancel it would come up again. –  sammyg Sep 18 '13 at 20:12
    
I had to kill the process to get out of this loop. Then another program, "Logitech Communication Manager" would start messing with me. If I tried to use the uninstaller for any of the two programs, it would bring me the "installer" instead. So it was like stuck, trying to install something, from a "network resource" supposedly???... I couldn't take it anymore, so I had to forcefully kill them both! I don't care for any of them. I did try to follow different Microsoft KB articles, this one among others. But to no avail... –  sammyg Sep 18 '13 at 20:16
    
That being said, the problem might not even have to do with registry settings. Had you any reason to suspect that? If not, why not post another question detailing your real problem. It might attract people that might know a way to solve it. Also relevant is whether it only happens with that MATLAB .msi or everything in general. –  Doktoro Reichard Sep 18 '13 at 20:16
    
So that was the background. No, Matlab MSI file is no my problem. I posted the link to someone elses screenshot. Just to showcase the type of dialog box/prompt I was getting. Mine had something to do with Logiteche Communication Manager, and the other one was Office 2007 related. –  sammyg Sep 18 '13 at 20:19

I think an application called RegScanner can help you, although as noted in other answers, it might not be exactly what you want to do with your registry, so use it with care.

For more destructive power, you can use PsExec with it, e.g.

C:\progs\PsExec.exe -i -d -s c:\progs\regscanner-x64\regscanner.exe

which will make it run as SYSTEM user. If you still can't delete some registry keys, this article explains how to edit permissions on registry keys.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.