一 代码
from win32api import *
from win32con import *
def GetValues(fullname):
name =str.split(fullname,'\\',1)
try:
if name[0] == 'HKEY_LOCAL_MACHINE':
key = RegOpenKey(HKEY_LOCAL_MACHINE,name[1],0,KEY_READ)
elif name[0] == 'HKEY_CURRENT_USER':
key = RegOpenKey(HKEY_CURRENT_USER,name[1],0,KEY_READ)
elif name[0] == 'HKEY_CLASSES_ROOT':
key = RegOpenKey(HKEY_CLASSES_ROOT,name[1],0,KEY_READ)
elif name[0] == 'HKEY_CURRENT_CONFIG':
key = RegOpenKey(HKEY_CURRENT_CONFIG,name[1],0,KEY_READ)
elif name[0] == 'HKEY_USERS':
key = RegOpenKey(HKEY_CURRENT_CONFIG,name[1],0,KEY_READ)
else:
print("err,no key named %s" % name[0])
info = RegQueryInfoKey(key)
for i in range(0,info[1]):
ValueName = RegEnumValue(key,i)
print(str.ljust(ValueName[0],30),ValueName[1])
RegCloseKey(key)
except:
pass
if __name__ == '__main__':
keyNames =['HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Run',\
'HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnce',\
'HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnceEx',\
'HKEY_CURRENT_USER\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnce',\
'HKEY_CURRENT_USER\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Run']
for keyName in keyNames:
print('\n')
print(keyName)
GetValues(keyName)
二 运行结果
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
RtHDVCpl C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
RtHDVBg_Dolby "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
RtHDVBg_LENOVO_MICPKEY "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_MICPKEY
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
ucdrv_repair "C:\Program Files (x86)\UCBrowser\Security\uclauncher.exe" --repair
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
Wechat D:\Program Files (x86)\Tencent\WeChat\WeChat.exe -autorun
ctfmon C:\WINDOWS\system32\ctfmon.exe
sesvc "D:\Program Files\360se6\Application\components\sesvc\sesvc.exe" /b:1 /c:1
NewsClientStratRun C:\Users\lenovo\AppData\Roaming\2144GameBox\NewsClient.exe /runhide
HCDNClient "C:\Program Files (x86)\IQIYI Video\LStyle\5.5.33.3550\QyKernel.exe" -shell_start