Registry Search & Replace Batch file

Question

how to create a batch file to search all existence ACADLSPASDOC in registry and replace the data value from 0 to 1

when i search the registry i found ACADLSPASDOC plenty of it in different folders. — MaxiExtreme
Only if you don't know what you are doing. We are technical here. Sprcify the problem. — user5721973
Ok. the AutoCad virus which is acad.vlx is changing the data value of ACADLSPASDOC from 0 to 1. so i want to make a batch file to run on all computers which the cad virus modified the value of ACADLSPASDOC in the registry.... — MaxiExtreme
In addition not all computers have the same autocad version so the ACADLSPASDOC will vary it's folder location depending on the version. — MaxiExtreme

Hackoo Hackoo · Accepted Answer · 2016-02-28T15:37:23

Give a try for this batch script just for searching :

@echo off
cls & color 0A & echo.
Mode con cols=55 lines=5
Title Check Registry Keys by Hackoo 2016
:::::::::::::::::::::::::::::::::::::::::
:: Automatically check & get admin rights
:::::::::::::::::::::::::::::::::::::::::
CLS
Echo.
Echo.
ECHO         **************************************
ECHO          Running Admin shell... Please wait...
ECHO         **************************************

:checkPrivileges
NET FILE 1>NUL 2>NUL
if '%errorlevel%' == '0' ( goto gotPrivileges ) else ( goto getPrivileges )

:getPrivileges
if '%1'=='ELEV' (echo ELEV & shift /1 & goto gotPrivileges)
Echo.
ECHO.
ECHO         **************************************
ECHO          Invoking UAC for Privilege Escalation
ECHO         **************************************

setlocal DisableDelayedExpansion
set "batchPath=%~0"
setlocal EnableDelayedExpansion
(
ECHO Set UAC = CreateObject^("Shell.Application"^)
ECHO args = "ELEV "
ECHO For Each strArg in WScript.Arguments
ECHO args = args ^& strArg ^& " "
ECHO Next
ECHO UAC.ShellExecute "!batchPath!", args, "", "runas", 1 
)> "%temp%\OEgetPrivileges.vbs"
"%SystemRoot%\System32\WScript.exe" "%temp%\OEgetPrivileges.vbs" %*
exit /B

:gotPrivileges
if '%1'=='ELEV' shift /1
setlocal & pushd .
cd /d "%~dp0"
::::::::::::::::::::::::::::
::START
::::::::::::::::::::::::::::
Title Check Registry Keys by Hackoo 2016
Set SearchString=ACADLSPASDOC
Set mykey="HKCU" "HKLM" "HKCR" "HKU" "HKCC"
Set TmpLogFile=Tmplogkey.txt
Set LogFile=Logkey.txt
If Exist %TmpLogFile% Del %TmpLogFile%
If Exist %LogFile% Del %LogFile%
For %%K in (%mykey%) Do Call :Check_Key %%K %SearchString% %TmpLogFile%
Cmd /U /C Type %TmpLogFile% > %LogFile%
Start "" %LogFile%
If Exist %TmpLogFile% Del %TmpLogFile%
Exit /b

:Check_Key
reg QUERY "%~1" >nul 2>&1
(
  if %errorlevel% equ 0 ( Echo. "%~1" & reg QUERY "%~1" /S /V "%~2" & echo. *************
    ) else ( echo "%~1" ===^> Not found
  )
) >>%3 2>&1

Registry Search & Replace Batch file

1 Answers