0

Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed:

REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

But it returns this: 

ERROR: Invalid syntax.
Type "REG DELETE /?" for usage.

I am not too sure what am I doing wrong because when I used REG ADD, it worked.

Thanks in advance

Improve this question
8
  • You must have a copy of cmd with name sethc in Windows/system32/. Just delete that copy of cmd.
    – C0deDaedalus
    Mar 24, 2018 at 20:00
  • I apologize for my ignorance, but how should I do that?
    – Kenneth Chen
    Mar 24, 2018 at 20:11
  • OK. It must be in C: drive or where your system is installed. Have a look into that for Windows folder, then into that System32 and then search for cmd and sethc. You will probably find two cmd there out of which one is copy of sethc (sticky keys .exe program) and you have to delete that.
    – C0deDaedalus
    Mar 24, 2018 at 20:16
  • 1
    That's not a valid command. \t is for adding, not deleting. See ss64.com/nt/reg.html
    – Neil Smithline
    Mar 25, 2018 at 5:04
  • 1
    I'm voting to close this question as off-topic because it is user confusion about CLI syntax and not appsec.
    – Neil Smithline
    Mar 25, 2018 at 5:05

1 Answer 1

Reset to default
1

The syntax of the command is incorrect.

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger

This will delete the value. You can do the same for "explorer.exe".

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged .