完整的注册表操作实例 VBS脚本。

转载自品略图书馆 http://www.pinlue.com/article/2020/03/2117/0510041050719.html

 

①创建主键、创建各类型的键值。

②读取键值并分析键值类型。

③枚举主键及键值。

④判断键或键值是否存在。

⑤查询注册表键的操作权限。

⑥监视注册表根键、主键、键值，当发现变动时提示。

代码如下:

"""注册表查询/操作

On Error Resume Next

Const HKEY_CLASSES_ROOT = &H80000000"""设置注册表5大根键，HKCR-----------①

Const HKEY_CURRENT_USER = &H80000001"""HKCU

Const HKEY_LOCAL_MACHINE = &H80000002"""HKLM

Const HKEY_Users = &H80000003"""HKU

Const HKEY_Current_Config = &H80000005"""HKCC

Const REG_SZ = 1"""设置注册表键值类型，字符串型---------------------------②

Const REG_EXPAND_SZ = 2"""扩展字符串型

Const REG_BINARY = 3"""二进制型

Const REG_DWORD = 4"""双字节型

Const REG_MULTI_SZ = 7"""多字符串型

Const KEY_QUERY_VALUE = &H0001"""查询注册表权限，查询数值-----------------③

Const KEY_SET_VALUE = &H0002"""设置数值

Const KEY_CREATE_SUB_KEY = &H0004"""创建子项

Const DELETE = &H00010000"""删除项值

"""-----------------配置环境(路径)----------------------------------------00

strComputer = "."

Set WshShell = WScript.CreateObject("WScript.Shell")

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

strKeyRoot = HKEY_LOCAL_MACHINE

Regpath = "HKEY_LOCAL_MACHINE"

strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Run"

WshSHell.popup "设置路径【HKLM\Software\Microsoft\Windows\CurrentVersion\Run】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建主键"REG_KEY_SZ"----------------------------------01

strKeyPathNew = "Software\Microsoft\Windows\CurrentVersion\Run\User_baomaboy\""""注意因为是新建主键，要多加个“\”

oReg.CreateKey strKeyRoot, strKeyPathNew

WshSHell.popup "创建主键【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\User_baomaboy\】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建字符串值"REG_SZ"----------------------------------02

strValueName="1字符串名"

strValue="字符串值"

oReg.SetStringValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "创建字符串【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\1字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建双字节值"REG_DWORD"--------------------------------

strValueName="2双字节名"

strValue=1

oReg.SetDWORDValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "创建双字节值【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\2双字节名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建多字符串"REG_MULTI_SZ"-----------------------------

strValueName="3多字符串名"

arrStringValues = Array("QQ25926183", "userbaomaboy","LLKJ", "玲珑科技")

oReg.SetMultiStringValue strKeyRoot, strKeyPath, strValueName, arrStringValues

WshSHell.popup "创建多字符串【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\3多字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建扩展字符串"REG_EXPAND_SZ"--------------------------

strValueName = "4扩展字符串名"

strValue = "%PATHEXT%"

oReg.SetExpandedStringValue strKeyRoot, strKeyPath, strValueName, strValue

WshSHell.popup "创建扩展字符串【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\4扩展字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------创建二进制值"REG_BINVRY_SZ"----------------------------

RegPathEr=Regpath&"\Software\Microsoft\Windows\CurrentVersion\Run\5二进制值"

WshSHell.RegWrite RegPathEr,1,"REG_BINARY"

WshSHell.popup "创建二进制值【HKLM\Software\Microsoft\Windows\CurrentVersion\Run\5二进制值】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 读取字符串值"REG_VALUE"-------------------------------

oReg.GetStringValue strKeyRoot, strKeyPath, "1字符串名", strRunCommand

WshSHell.popup "读取字符串值:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 读取双字节值"REG_DWORD"-------------------------------

oReg.GetDWORDValue strKeyRoot, strKeyPath, "2双字节名", strRunCommand

WshSHell.popup "读取双字节值:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 读取多字符串值"REG_MULTI_SZ"--------------------------

oReg.GetMultiStringValue strKeyRoot, strKeyPath, "3多字符串名", arrValues

For Each strValue In arrValues

DuoString=DuoString&vbcrlf&strValue

Next

WshSHell.popup "读取多字符串值:"&vbcrlf&vbcrlf&DuoString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 读取扩展字符串"REG_EXPAND_SZ"-------------------------

oReg.GetExpandedStringValue strKeyRoot, strKeyPath, "4扩展字符串名", strValue

WshSHell.popup "读取扩展字符串值:"&vbcrlf&vbcrlf&strValue&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 读取二进制值"REG_BINVRY_SZ"----------------------------

oReg.GetBinaryValue strKeyRoot, strKeyPath, "5二进制值", strValue

For i = lBound(strValue) to uBound(strValue)

ErString=ErString&strValue(i)

Next

WshSHell.popup "读取二进制值:"&vbcrlf&vbcrlf&ErString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 枚举主键"SUB_KEY"--------------------------------------

oReg.EnumKey strKeyRoot, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys

ArrSubKeyStr=ArrSubKeyStr&vbcrlf&subkey

Next

WshSHell.popup "枚举主键:"&vbcrlf&vbcrlf&ArrSubKeyStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 枚举键值和键值类型"KEY_Value_Types"--------------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes

For i=0 To UBound(arrValueNames)

If Len(arrValueNames(i)) > 0 Then

Select Case arrValueTypes(i)

Case REG_SZ ValueType=" >>>是：字符串值"

Case REG_EXPAND_SZ ValueType=" >>>是：扩展字符串值"

Case REG_BINARY ValueType=" >>>是：二进制值"

Case REG_DWORD ValueType=" >>>是：双字节值"

Case REG_MULTI_SZ ValueType=" >>>是：多字符串值"

End Select

arrValueStr=arrValueStr&vbcrlf&arrValueNames(i)&ValueType

End If

Next

WshSHell.popup "枚举键值和类型:"&vbcrlf&vbcrlf&arrValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 枚举键值和键值内容一"KEY_Value_Contenct"----------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes

For i=0 To UBound(arrValueNames)

If Len(arrValueNames(i)) > 0 Then

oReg.GetStringValue strKeyRoot,strKeyPath,arrValueNames(i),strValue"""适应于字符串型

ValueStr=ValueStr&vbcrlf&arrValueNames(i)&vbcrlf&strValue

end if

Next

WshSHell.popup "枚举键值和内容一:"&vbcrlf&vbcrlf&ValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 枚举键值和键值内容二"KEY_Value_Contenct"----------------

oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes

i=0

For Each strValue in arrValueNames

If Len(strValue) > 0 Then

i=i+1

oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand"""适应于字符串型

intLength = Len(strRunCommand)

if intLength > 35 then"""美化回显，(可再加代码判路径是否包含断汉字)

strRunCommand = Left(strRunCommand, 20)&"……"&Right(strRunCommand, 13)

end if

StrRoot= i&".【"&strValue&"】"&vbCRLF&" "&strRunCommand

ARoot=ARoot&vbCRLF&StrRoot

End If

Next

WshSHell.popup "枚举键值和内容二:"&vbcrlf&vbcrlf&ARoot&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 删除键值"REG_VALUE"-------------------------------------

oReg.DeleteValue strKeyRoot, strKeyPath, "5二进制值"

WshSHell.popup "删除键值:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&"\5二进制值"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""----------------- 删除主键"SUB_KEY"---------------------------------------

oReg.DeleteKey strKeyRoot, strKeyPathNew

WshSHell.popup "删除主键:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPathNew&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""-----------------判断键值是否存在-----------------------------------------

strValue="""病毒"""

oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand

If IsNull(strRunCommand) Then

WshSHell.popup strValue&"此注册表键值不存在."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

Else

WshSHell.popup strValue&"注册表中存在此键值."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

End If

"""----------------- 检查注册表访问权限"Check Up Extent Of Power"------------

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_QUERY_VALUE, bHasAccessRight

If bHasAccessRight = True Then

aaa="可以查询数值"

Else

aaa="不可查询数值"

End If

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_SET_VALUE, bHasAccessRight

If bHasAccessRight = True Then

bbb="可以设置数值"

Else

bbb="不可设置数值"

End If

oReg.CheckAccess strKeyRoot, strKeyPath, KEY_CREATE_SUB_KEY, bHasAccessRight

If bHasAccessRight = True Then

ccc="可以创建主键"

Else

ccc="不可创建主键"

End If

oReg.CheckAccess strKeyRoot, strKeyPath, DELETE, bHasAccessRight

If bHasAccessRight = True Then

ddd="可以删除键值"

Else

ddd="不可删除键值"

End If

WshSHell.popup "注册表访问权限:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&vbcrlf&vbcrlf&aaa&vbcrlf&bbb&vbcrlf&ccc&vbcrlf&ddd&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒钟后本窗口将自动关闭!", 5, "QQ:25926183", 0 + 64

"""－－－－－恢复注册表原样--------

oReg.DeleteValue strKeyRoot, strKeyPath, "4扩展字符串名"

oReg.DeleteValue strKeyRoot, strKeyPath, "3多字符串名"

oReg.DeleteValue strKeyRoot, strKeyPath, "2双字节名"

oReg.DeleteValue strKeyRoot, strKeyPath, "1字符串名"

"""-----------------监视注册表键值"REG_KEY_SZ"-------------------------------

"""用以对注册表中HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1字符串名"分支下的所有更改内容进行监视。

"Set wmiServices = GetObject("winmgmts:root/default")

"Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")

"wmiServices.ExecNotificationQueryAsync wmiSink, _

""SELECT * FROM RegistryValueChangeEvent WHERE Hive="HKEY_LOCAL_MACHINE" AND " & _

""KeyPath="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" AND ValueName="1字符串名""

"WScript.Echo "开始监视注册表HKLM_Run主键键值的值的变化......" & vbCrLf

"While(1)

"WScript.Sleep 1000

"Wend

"Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)

"WScript.Echo ".........注册表改变......" & vbCrLf & _

""----------监视注册表键值的值变化-----------" & vbCrLf & _

"wmiObject.GetObjectText_()

"WScript.Quit(0)"""用作发现修改则提示后退出

"End Sub

"""-----------------监视注册表主键"REG_SubKey_SZ"-----------------------------

"""监视注册表，以发现对 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 的任何更改。

"Set wmiServices = GetObject("winmgmts:root/default")

"Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")

"wmiServices.ExecNotificationQueryAsync wmiSink, _

""SELECT * FROM RegistryKeyChangeEvent WHERE Hive="HKEY_LOCAL_MACHINE" AND " & _

""KeyPath="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run""

"WScript.Echo "开始监视注册表HKLM_Run主键的键值变化......" & vbCrLf

"While(1)

"WScript.Sleep 1000

"Wend

"Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)

"WScript.Echo ".........注册表改变......" & vbCrLf & _

""----------监视注册表主键键值变化-----------" & vbCrLf & _

"wmiObject.GetObjectText_()

"WScript.Quit(0)"""用作发现修改则提示后退出

"End Sub

"""-----------------监视注册表根键"REG_RootKey_SZ"----------------------------

"""监视注册表，以发现对 HKLM 的任何更改。

Set wmiServices = GetObject("winmgmts:root/default")

Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")

wmiServices.ExecNotificationQueryAsync wmiSink, _

"SELECT * FROM RegistryTreeChangeEvent WHERE Hive="HKEY_LOCAL_MACHINE" AND RootPath="""

WScript.Echo "开始监视注册表HKLM根键的所有变化......" & vbCrLf

While(1)

WScript.Sleep 1000

Wend

Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)

WScript.Echo ".........注册表改变......" & vbCrLf & _

"----------监视注册表根键所有变化-----------" & vbCrLf & _

wmiObject.GetObjectText_()

WScript.Quit(0)"""用作发现修改则提示后退出

End Sub