0

Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed:

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

But it returns this:

ERROR: Invalid syntax.
Type "REG DELETE /?" for usage.

I am not too sure what am I doing wrong because when I used REG ADD, it worked.

Thanks in advance

8
  • You must have a copy of cmd with name sethc in Windows/system32/. Just delete that copy of cmd. Commented Mar 24, 2018 at 20:00
  • I apologize for my ignorance, but how should I do that? Commented Mar 24, 2018 at 20:11
  • OK. It must be in C: drive or where your system is installed. Have a look into that for Windows folder, then into that System32 and then search for cmd and sethc. You will probably find two cmd there out of which one is copy of sethc (sticky keys .exe program) and you have to delete that. Commented Mar 24, 2018 at 20:16
  • 1
    That's not a valid command. \t is for adding, not deleting. See ss64.com/nt/reg.html Commented Mar 25, 2018 at 5:04
  • 1
    I'm voting to close this question as off-topic because it is user confusion about CLI syntax and not appsec. Commented Mar 25, 2018 at 5:05

1 Answer 1

1

The syntax of the command is incorrect.

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger

This will delete the value. You can do the same for "explorer.exe".

0

Not the answer you're looking for? Browse other questions tagged .