1

reg.exe import "备份文件路径.reg"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

<#
  Find registry keys whose KEY NAME contains 'wincompress'.
  Outputs a TXT and a CSV. No deletion.
#>
param(
    [string]$Keyword = 'wincompress',
    [string]$OutTxt = ".\wincompress_registry_keys.txt",
    [string]$OutCsv = ".\wincompress_registry_keys.csv"
)

$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $IsAdmin) { Write-Warning "It is recommended to run PowerShell as Administrator." }

$Is64OS = [Environment]::Is64BitOperatingSystem
$roots = @('HKLM','HKCU','HKCR','HKU','HKCC')
$results = New-Object System.Collections.Generic.List[string]

function Search-Keys {
    param([string]$Root,[string]$Keyword,[string]$RegView)
    $args = @('query', $Root, '/f', $Keyword, '/k', '/s')
    if ($RegView) { $args += "/reg:$RegView" }
    $out = & reg.exe @args 2>$null
    if ($LASTEXITCODE -eq 0 -and $out) {
        foreach ($line in $out) {
            if ($line -match '^HKEY_') { $results.Add($line.Trim()) }
        }
    }
}

foreach ($root in $roots) {
    Write-Host "Scanning $root (64-bit view if applicable)..."
    Search-Keys -Root $root -Keyword $Keyword -RegView '64'
    if ($Is64OS) {
        Write-Host "Scanning $root (32-bit view)..."
        Search-Keys -Root $root -Keyword $Keyword -RegView '32'
    }
}

$uniq = $results | Sort-Object -Unique
if ($uniq.Count -eq 0) {
    Write-Host "No registry key name contains '$Keyword'."
} else {
    $uniq | Set-Content -Path $OutTxt -Encoding UTF8
    $uniq | ForEach-Object { [pscustomobject]@{ RegistryKey = $_ } } |
        Export-Csv -NoTypeInformation -Encoding UTF8 -Path $OutCsv
    Write-Host "Found $($uniq.Count) keys."
    Write-Host "Output files:`n$OutTxt`n$OutCsv"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

<#
  Delete registry keys from a list (TXT), with per-key .reg backups by default.
  Supports -WhatIf. Attempts both 64-bit and 32-bit registry views on 64-bit OS.
#>
[CmdletBinding(SupportsShouldProcess=$true)]
param(
    [Parameter(Mandatory=$true)]
    [string]$InputList,                      # TXT from step 1
    [string]$BackupDir = ".\Backup_wincompress",
    [switch]$NoBackup
)

if (-not (Test-Path -LiteralPath $InputList)) { throw "List not found: $InputList" }
if (-not $NoBackup) { New-Item -ItemType Directory -Force -Path $BackupDir | Out-Null }

$Is64OS = [Environment]::Is64BitOperatingSystem
$stamp = Get-Date -Format "yyyyMMdd_HHmmss"
$log = ".\remove_wincompress_$stamp.log"

"Start: $(Get-Date)" | Out-File -FilePath $log -Encoding UTF8

$keys = Get-Content -LiteralPath $InputList |
    Where-Object { $_ -and ($_ -match '^HKEY_') } |
    ForEach-Object { $_.Trim() } |
    Sort-Object -Unique

$succ = 0; $fail = 0

function SafeName([string]$path) {
    return ($path -replace '[\\/:*?""<>|]','_')
}

foreach ($k in $keys) {
    # Backups
    if (-not $NoBackup) {
        $base = Join-Path $BackupDir (SafeName $k)
        # x64 view (or default on 32-bit OS)
        if ($PSCmdlet.ShouldProcess("$k [x64]", 'Backup')) {
            & reg.exe export "$k" "$base.x64.reg" /y /reg:64 2>$null | Out-Null
            if ($LASTEXITCODE -eq 0) {
                "Backup OK (x64): $base.x64.reg" | Tee-Object -FilePath $log -Append | Out-Null
            } else {
                "Backup FAIL (x64): $k" | Tee-Object -FilePath $log -Append | Out-Null
            }
        }
        # x86 view on 64-bit OS
        if ($Is64OS -and $PSCmdlet.ShouldProcess("$k [x86]", 'Backup')) {
            & reg.exe export "$k" "$base.x86.reg" /y /reg:32 2>$null | Out-Null
            if ($LASTEXITCODE -eq 0) {
                "Backup OK (x86): $base.x86.reg" | Tee-Object -FilePath $log -Append | Out-Null
            } else {
                "Backup FAIL (x86): $k" | Tee-Object -FilePath $log -Append | Out-Null
            }
        }
    }

    # Delete x64/default
    if ($PSCmdlet.ShouldProcess("$k [x64]", 'Delete')) {
        & reg.exe delete "$k" /f /reg:64 2>$null | Out-Null
        if ($LASTEXITCODE -eq 0) {
            $succ++; "Delete OK (x64): $k" | Tee-Object -FilePath $log -Append | Out-Null
        } else {
            "Delete FAIL (x64): $k" | Tee-Object -FilePath $log -Append | Out-Null
        }
    }
    # Delete x86 on 64-bit OS
    if ($Is64OS -and $PSCmdlet.ShouldProcess("$k [x86]", 'Delete')) {
        & reg.exe delete "$k" /f /reg:32 2>$null | Out-Null
        if ($LASTEXITCODE -eq 0) {
            $succ++; "Delete OK (x86): $k" | Tee-Object -FilePath $log -Append | Out-Null
        } else {
            "Delete FAIL (x86): $k" | Tee-Object -FilePath $log -Append | Out-Null
        }
    }
}

"End: $(Get-Date)" | Out-File -FilePath $log -Append -Encoding UTF8
"Summary: success=$succ, see log: $log" | Write-Host

1

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

1
2
3

.\Find-WincompressRegistryKeys.ps1 -Keyword 'wincompress' `
  -OutTxt "$env:USERPROFILE\Desktop\wincompress_keys.txt" `
  -OutCsv "$env:USERPROFILE\Desktop\wincompress_keys.csv"

1

.\Remove-WincompressRegistryKeys.ps1 -InputList "$env:USERPROFILE\Desktop\wincompress_keys.txt" -WhatIf

1
2

.\Remove-WincompressRegistryKeys.ps1 -InputList "$env:USERPROFILE\Desktop\wincompress_keys.txt" `
  -BackupDir "$env:USERPROFILE\Desktop\Backup_wincompress"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

<#
  Run Remove-WincompressRegistryKeys.ps1 as SYSTEM via Task Scheduler COM API.
  Place this file in the same folder as Remove-WincompressRegistryKeys.ps1
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory=$true)]
    [string]$InputList,
    [string]$BackupDir = "$env:USERPROFILE\Desktop\Backup_wincompress",
    [switch]$NoBackup
)

function Q([string]$s){ '"' + $s.Replace('"','""') + '"' }

$removeScript = Join-Path $PSScriptRoot 'Remove-WincompressRegistryKeys.ps1'
if (-not (Test-Path -LiteralPath $removeScript)) { throw "Missing Remove-WincompressRegistryKeys.ps1 in the same folder." }
if (-not (Test-Path -LiteralPath $InputList)) { throw "Input list not found: $InputList" }
if (-not (Test-Path -LiteralPath $BackupDir)) { New-Item -ItemType Directory -Force -Path $BackupDir | Out-Null }

$ps = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"

$tokens = New-Object System.Collections.Generic.List[string]
$tokens.Add('-NoProfile')
$tokens.Add('-ExecutionPolicy'); $tokens.Add('Bypass')
$tokens.Add('-File'); $tokens.Add((Resolve-Path $removeScript).Path)
$tokens.Add('-InputList'); $tokens.Add((Resolve-Path $InputList).Path)
$tokens.Add('-BackupDir'); $tokens.Add((Resolve-Path $BackupDir).Path)
if ($NoBackup) { $tokens.Add('-NoBackup') }

$argString = ($tokens | ForEach-Object { if ($_ -like '-*') { $_ } else { Q $_ } }) -join ' '

$service = New-Object -ComObject 'Schedule.Service'
$service.Connect()
$root = $service.GetFolder('\')
$td = $service.NewTask(0)
$td.RegistrationInfo.Description = 'Temp SYSTEM task: remove wincompress registry keys'
$td.Principal.UserId = 'SYSTEM'
$td.Principal.LogonType = 5 # TASK_LOGON_SERVICE_ACCOUNT
$td.Principal.RunLevel = 1   # TASK_RUNLEVEL_HIGHEST
$td.Settings.Hidden = $true
$td.Settings.AllowDemandStart = $true
$td.Settings.StartWhenAvailable = $true
$td.Settings.MultipleInstances = 2 # TASK_INSTANCES_IGNORE_NEW
$td.Settings.ExecutionTimeLimit = 'PT2H'
$td.Settings.DisallowStartIfOnBatteries = $false
$td.Settings.StopIfGoingOnBatteries = $false

$action = $td.Actions.Create(0) # TASK_ACTION_EXEC
$action.Path = $ps
$action.Arguments = $argString
$action.WorkingDirectory = (Split-Path -Parent (Resolve-Path $removeScript).Path)

$name = 'Temp_RemoveWincompress_' + [Guid]::NewGuid().ToString('N')
$null = $root.RegisterTaskDefinition("\$name", $td, 6, $null, $null, 5, $null)

$task = $root.GetTask("\$name")
$running = $task.Run($null)

$deadline = (Get-Date).AddMinutes(30)
while ((Get-Date) -lt $deadline) {
    try { $state = $running.State } catch { break }
    if ($state -eq 4 -or $state -eq 2 -or $state -eq 3) { Start-Sleep -Seconds 2 } else { break }
}

$rc = $null
try { $rc = $task.LastTaskResult } catch {}
try { $root.DeleteTask("\$name", 0) } catch {}

if ($rc -ne $null) {
    Write-Host ("Done. Task LastTaskResult=" + $rc)
} else {
    Write-Host "Done."
}

1
2
3
4
5

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

.\Invoke-RemoveWincompressAsSystem.ps1 `
  -InputList "$env:USERPROFILE\Desktop\wincompress_keys.txt" `
  -BackupDir "$env:USERPROFILE\Desktop\Backup_wincompress"

1
2

psexec64.exe -accepteula -s -i powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^
  "& { & 'C:\Path\Remove-WincompressRegistryKeys.ps1' -InputList 'C:\Path\wincompress_keys.txt' -BackupDir 'C:\Path\Backup_wincompress' }"

1

psexec64.exe -accepteula -s -i cmd.exe