Reproduction
To reproduce this behavior you can follow these simple steps:
On any Windows Server 2003/Windows XP or Windows Vista/Windows Server 2008 system do the following:
1. Start RegEdit on your machine.
2. Create a test key: HKEY_LOCAL_MACHINE\SYSTEM\CustomKey
3. Add a string value to the key: SimpleString set it to the value “Test”.
4. Run the simple VBS provided below, the value of SimpleString should be “Test”.
5. In regedit, highlight the key value SimpleString, right click and select the “Modify Binary Data” option.
6. Remove all of the data from the window, you should see only the byte offset of “0000” displayed to the left in the dialog. Click OK to save.
7. Run the simple VBS from step 6 once again. You will notice a bunch of what appears to be junk characters displayed on the screen.
The simple VBS test script would be:
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\"&_
strComputer & "\root\default:StdRegProv")
objReg.GetStringValue HKEY_LOCAL_MACHINE,"SYSTEM\CustomKey","SimpleString",strVal
wscript.echo "StringValue: " & strVal
Detecting the junk character values is not always possible. To completely avoid the issue with the WMI Registry provider, use the low level Win32 Registry APIs.