It is just a text file dump of HKLM:
reg query HKLM /s > HKLM.txt
mark_all_occurences("py.exe","WIP",'0',"8192",'5','0','1','0','1','0','2','2');
I did Find py.exe
Match whole word
List all occurances
ListCurrentContext
B/A -2,+2
The results:
Find all "py.exe", Whole word
File C:\Users\joe\AllFiles\HKLM2.txt
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon
463266 40: (Default) REG_SZ "C:\WINDOWS\py.exe",5
463273 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
463284 40: (Default) REG_SZ "C:\WINDOWS\py.exe",2
463291 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
463302 40: (Default) REG_SZ "C:\WINDOWS\py.exe",3
463308 40: (Default) REG_SZ "C:\WINDOWS\py.exe",1
463338 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
463349 40: (Default) REG_SZ "C:\WINDOWS\py.exe",5
463367 40: (Default) REG_SZ "C:\WINDOWS\py.exe",1
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.NoConFile\shell
Total found: 9
The file size is 28,749,166 (I deleted about half of the file past the above matches).
When I remove the first 460,000 lines the problem does not repro.
New size: 169,810 bytes
Then the results look like:
Find all "py.exe", Whole word
File C:\Users\joe\AllFiles\HKLM2.txt
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.ArchiveFile\DefaultIcon
3332 40: (Default) REG_SZ "C:\WINDOWS\py.exe",5
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command
3339 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.CompiledFile\DefaultIcon
3350 40: (Default) REG_SZ "C:\WINDOWS\py.exe",2
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command
3357 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon
3368 40: (Default) REG_SZ "C:\WINDOWS\py.exe",3
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.File
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.File\DefaultIcon
3374 40: (Default) REG_SZ "C:\WINDOWS\py.exe",1
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.File\shell
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.File\shell\open\command
3404 40: (Default) REG_SZ "C:\WINDOWS\py.exe" "%L" %*
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.File\shellex
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\DefaultIcon
3415 40: (Default) REG_SZ "C:\WINDOWS\py.exe",5
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell
---------:
-:
-:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.NoConFile\DefaultIcon
3433 40: (Default) REG_SZ "C:\WINDOWS\py.exe",1
+:
+:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Python.NoConFile\shell
Total found: 9