关闭

C# 利用WMI进行注册表监视

2369人阅读 评论(6) 收藏 举报

VERSION 5.00
Begin VB.Form frmMain
   Caption         =   "Form1"
   ClientHeight    =   3090
   ClientLeft      =   60
   ClientTop       =   450
   ClientWidth     =   4680
   LinkTopic       =   "Form1"
   ScaleHeight     =   3090
   ScaleWidth      =   4680
   StartUpPosition =   3  '窗口缺省
End
Attribute VB_Name = "frmMain"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit
Private WithEvents objRegVaule As SWbemSink
Attribute objRegVaule.VB_VarHelpID = -1
Private WithEvents objRegTree As SWbemSink
Attribute objRegTree.VB_VarHelpID = -1
Private WithEvents objRegKey As SWbemSink
Attribute objRegKey.VB_VarHelpID = -1

Private Sub Form_Load()
    Dim objSWbemServices As SWbemServices
    'Set objRegVaule = New SWbemSink
    Set objRegTree = New SWbemSink
    Set objRegKey = New SWbemSink
    Set objSWbemServices = GetObject("winmgmts:root/default")
    'objSWbemServices.ExecNotificationQueryAsync objRegVaule, "SELECT * FROM RegistryValueChangeEvent WHERE ((Hive='HKEY_LOCAL_MACHINE' AND " & "KeyPath='SYSTEM//CurrentControlSet//Services//USBSTOR' AND ValueName='Start') Or (Hive='HKEY_LOCAL_MACHINE' AND " & "KeyPath='SYSTEM//CurrentControlSet//Control//StorageDevicePolicies' AND ValueName='WriteProtect'))"
    objSWbemServices.ExecNotificationQueryAsync objRegTree, "SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & "RootPath='SYSTEM//CurrentControlSet//Services//USBSTOR'"
'    objSWbemServices.ExecNotificationQueryAsync objRegKey, "SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' " & "AND KeyPath='SOFTWARE//Microsoft//Windows NT//CurrentVersion'"
End Sub


Private Sub Form_Unload(Cancel As Integer)
    'objRegVaule.Cancel
    objRegTree.Cancel
    objRegKey.Cancel
End Sub

Private Sub objRegVaule_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
    Dim swProperty As SWbemProperty, swPropertys As SWbemPropertySet
    Set swPropertys = objWbemObject.Properties_
    For Each swProperty In swPropertys
        'On Error Resume Next
        MsgBox swProperty.Name   ' & vbNewLine & swProperty.Value
    Next
End Sub


Private Sub objRegTree_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
    Dim swProperty As SWbemProperty, swPropertys As SWbemPropertySet
    Set swPropertys = objWbemObject.Properties_
'    Dim objSWbemServices As SWbemServices
'    Set objRegVaule = New SWbemSink
'    Set objSWbemServices = GetObject("winmgmts:root/default")
'    objSWbemServices.ExecNotificationQueryAsync objRegVaule, "SELECT * FROM RegistryValueChangeEvent WHERE ((Hive='HKEY_LOCAL_MACHINE' AND " & "KeyPath='SYSTEM//CurrentControlSet//Services//USBSTOR' AND ValueName='Start') Or (Hive='HKEY_LOCAL_MACHINE' AND " & "KeyPath='SYSTEM//CurrentControlSet//Control//StorageDevicePolicies' AND ValueName='WriteProtect'))"
    For Each swProperty In swPropertys
        'On Error Resume Next
        MsgBox swProperty.Name & vbNewLine & swProperty.Value
    Next
End Sub

Private Sub objRegKey_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
    Dim swProperty As SWbemProperty, swPropertys As SWbemPropertySet
    Set swPropertys = objWbemObject.Properties_
    For Each swProperty In swPropertys
        On Error Resume Next
        MsgBox swProperty.Name & vbNewLine & swProperty.Value
    Next
End Sub
 

0
0

查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:326680次
    • 积分:4459
    • 等级:
    • 排名:第7048名
    • 原创:81篇
    • 转载:0篇
    • 译文:2篇
    • 评论:434条
    文章分类
    最新评论
    chenhui530新浪博客