Unable to delete registry key

[alegator]

I scanned my registry for errors and the following key in the HKLM\Software root was detected as unnecessary/corrupt:


I tried to manually delete it using regedit but Windows does not allow showing the following:


So I tried various registry scanners/cleaners without success (they're unable to delete it even though they detect it as corrupt).
I also tried doing it in Safe Mode without success.
Any ideas? Thanks
NOTE: I'm running WinXP Pro SP3 with full administrative rights

[Dv8ted2]

Right click that registry key and select permissions. Give the everyone group full control of that key. You should now be able to delete it.

[stiltman]

Right click that registry key and select permissions. Give the everyone group full control of that key. You should now be able to delete it.

Yes, but I've found many badware/spyware/..etc to give no rights at all to the key and sub keys. You'll have to take ownership of the root key then all the sub keys first. then set permissions after. Then finally delete them

Real PITA.....had to do this several times in the past.
BTW, never give the everyone group full control on any key that you're not going to delete right away

[alegator]

Right click that registry key and select permissions. Give the everyone group full control of that key. You should now be able to delete it.

I tried it with no success.
It still does not allow to delete the parent or child subkeys related to Minnetonka Audio Software.

[alegator]

I finally solved the issue by using RegDelNull. The "version" subkey contained embedded-null characters and that's why I was unable to delete it using regedit. But RegDelNull deleted it as explained here:
http://technet.microsoft.com/en-us/sysinternals/bb897448.aspx

[redwudz]

Good information to know, thanks.

[alegator]

Good information to know, thanks.

You're welcome. I just wanted to let everyone know in case you ever cope with this issue.

[ChrissyBoy]

Good information to know, thanks.

I second that - you learn something new everyday!

[Ai Haibara]

I'll third it - I'd been looking for a way to delete registry keys with nulls since some malware I'd had to deal with on a relative's system left several of them behind.

[alegator]

I'll third it - I'd been looking for a way to delete registry keys with nulls since some malware I'd had to deal with on a relative's system left several of them behind.

Well, I'm glad that my post has helped others. One more note about my case: this registry key was not malware related, but a registry key left by an uninstalled software. It was the first time in more than 15 years of Windows experience that I dealt with an undeletable registry key but fortunately there was a way out.

[Ai Haibara]

It does tend to border on malware tactics, though - using the null character more or less ensures that Regedit can't do anything with those keys... and it also prevents Regedit from 'seeing' them to begin with, I believe. Why regular software would be doing that to their registry keys, I don't know. Sure, it'd keep 'regular' users from messing with/deleting those keys, but is it really worth it to hide ordinary software registry keys like that?

[sambat]

I finally solved the issue by using RegDelNull. The "version" subkey contained embedded-null characters and that's why I was unable to delete it using regedit. But RegDelNull deleted it as explained here:
http://technet.microsoft.com/en-us/sysinternals/bb897448.aspx

What led you to believe it was null characters that were the cause of the problem?

[alegator]

It does tend to border on malware tactics, though - using the null character more or less ensures that Regedit can't do anything with those keys... and it also prevents Regedit from 'seeing' them to begin with, I believe. Why regular software would be doing that to their registry keys, I don't know. Sure, it'd keep 'regular' users from messing with/deleting those keys, but is it really worth it to hide ordinary software registry keys like that?

In my case I can assure this was not malware related. I scanned my PC with various malware scanners (at least 6) and all clean.Also, regedit was able to view the key as you can see in my first post (see attached screenshot). Finally,the fact that this key was a leftover from an uninstall and later got corrupted is probably the reason why the "Version" key ended up with null characters.

What led you to believe it was null characters that were the cause of the problem?

Well, as you can read in my posts I tried every possible means to delete this key and I was unsuccessful, I could only delete the key using the RegDelNull tool. Also, the fact that the RegDelNull tool detected the "Version" key as an embedded-null character key confirms this. This was consistent with the fact that when I right clicked on the Version key and chose Modify, both the Value name and Value Data of the string where empty, confirming it was a null character key.

[jagabo]

It does tend to border on malware tactics, though - using the null character more or less ensures that Regedit can't do anything with those keys... and it also prevents Regedit from 'seeing' them to begin with, I believe. Why regular software would be doing that to their registry keys, I don't know.

It might be related to a time limited trial. Keeps you from uninstalling and reinstalling the software to start a new trial period.

[Ai Haibara]

In my case I can assure this was not malware related. I scanned my PC with various malware scanners (at least 6) and all clean.Also, regedit was able to view the key as you can see in my first post (see attached screenshot). Finally,the fact that this key was a leftover from an uninstall and later got corrupted is probably the reason why the "Version" key ended up with null characters.

I'm not sure about how well anti-spyware/malware packages handle the 'hidden' registry entries. It seems to be detected more by the anti-rootkit software.
On the system I mentioned above, the registry entries were definitely caused by malware. But Spybot, MalwareBytes and even the antivirus scanners didn't pick up the hidden entries on scans. The anti-rootkit packages I was running (as it was indeed a rootkit) did detect them, but apparently wouldn't do anything about them, which is why I'd been looking for a way to delete those keys.

It might be related to a time limited trial. Keeps you from uninstalling and reinstalling the software to start a new trial period.

I guess that could be possible. I'm sure the programmers use more than one method for doing that, too, though. (For example, hiding files anywhere throughout the system. I still don't know what SUPER does to keep you from using older versions of the program, at that. :/ )