How to delete registry properties with randomized names - powershell

Question

I'm trying to remove junk registry items left from adware in several machines. The adware created registry keys in the following path:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
Property: a random name that is different from machine to machine
Value: a malicious string that is the same from machine to machine
Get-ChildItem -path HKLM:\System\Controlset001\Services |
Get-ItemProperty |
Where-Object {$_.ValueName -eq "Value"} |
Remove-ItemProperty -ErrorAction SilentlyContinue
I´ve tried the method above to delete keys when I know the subkey and properties, but since the property is random I am getting no results. Thank you very much!

Answer 1

Here's an alternative script for get-itemproperty:
# get-itemproperty2.ps1
param([parameter(ValueFromPipeline)]$key)
process {
$key.getvaluenames() |
foreach {
$value = $_
[pscustomobject] #{
Path = $key -replace 'HKEY_CURRENT_USER',
'HKCU:' -replace 'HKEY_LOCAL_MACHINE','HKLM:'
Name = $Value
Value = $Key.GetValue($Value)
Type = $Key.GetValueKind($Value)
}
}
}
So you can do something like:
Get-ChildItem HKLM:\System\Controlset001\Services | .\Get-ItemProperty2 |
Where Value -eq MyValue | Remove-ItemProperty -Whatif

Answer 2

Use of Get-ItemProperty isn't required for your task (and there is no need to re-implement a variation of it, the way that the currently accepted answer does).
Instead, filter by the output from the .GetValue() method applied to each subkey of the registry path of interest, assuming a known property name (registry value name):
# Specify whatever fixed value the malware stored in the 'ImagePath'
# property of the randomly named keys.
$propValue = '...'
Get-ChildItem -LiteralPath HKLM:\System\ControlSet001\Services |
Where-Object { $_.GetValue('ImagePath') -eq $propValue } |
Remove-Item -WhatIf
Note: Common parameter -WhatIf previews the operation; remove it to perform the actual operation.
Get-ChildItem -LiteralPath HKLM:\System\ControlSet001\Services enumerates all subkeys of the specified path.
Where-Object { $_.GetValue('ImagePath') -eq $propValue } selects only those subkey(s) whose ImagePath property has the specified value.
Remove-Item then removes the selected subkey(s).
If you want to find data (a property value) among all properties (registry values) of the input keys, you can use the following approach:
$propValue = '...'
Get-ChildItem -LiteralPath HKLM:\System\ControlSet001\Services |
Where-Object {
foreach ($name in $_.GetValueNames()) {
if ($_.GetValue($name) -eq $propValue) { return $true } }
}
}| Remove-Item -WhatIf