Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed:

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

But it returns this:

ERROR: Invalid syntax.
Type "REG DELETE /?" for usage.

I am not too sure what am I doing wrong because when I used REG ADD, it worked.

Thanks in advance

  • You must have a copy of cmd with name sethc in Windows/system32/. Just delete that copy of cmd. – C0deDaedalus Mar 24 '18 at 20:00
  • I apologize for my ignorance, but how should I do that? – Kenneth Chen Mar 24 '18 at 20:11
  • OK. It must be in C: drive or where your system is installed. Have a look into that for Windows folder, then into that System32 and then search for cmd and sethc. You will probably find two cmd there out of which one is copy of sethc (sticky keys .exe program) and you have to delete that. – C0deDaedalus Mar 24 '18 at 20:16
  • 1
    That's not a valid command. \t is for adding, not deleting. See ss64.com/nt/reg.html – Neil Smithline Mar 25 '18 at 5:04
  • 1
    I'm voting to close this question as off-topic because it is user confusion about CLI syntax and not appsec. – Neil Smithline Mar 25 '18 at 5:05

The syntax of the command is incorrect.

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger

This will delete the value. You can do the same for "explorer.exe".


Not the answer you're looking for? Browse other questions tagged or ask your own question.