| Hive = "HKEY_LOCAL_MACHINE" | | KeyPath = "Software\333" | | ValueName = "444" | | shuzhi = 29 | | gaiwei = 20 | | Hive2 = "HKEY_LOCAL_MACHINE" | | KeyPath2 = "Software\2012" | | ValueName2 = "0610" | | shuzhi2 = 98 | | gaiwei2 = 70 | | strTitle = "注册表监视" | | nShowTime = 3 | | | | WQL = "Select * from RegistryValueChangeEvent Where (" & _ | | "Hive = '"&Hive&"' and " & _ | | "KeyPath = '"&Replace(KeyPath,"\","\\")&"' and " & _ | | "ValueName = '"&ValueName&"') OR (" & _ | | "Hive = '"&Hive2&"' and " & _ | | "KeyPath = '"&Replace(KeyPath2,"\","\\")&"' and " & _ | | "ValueName = '"&ValueName2 & "') " | | | | Set ws = CreateObject("WScript.Shell") | | CheckReg ValueName | | CheckReg ValueName2 | | Set Sink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") | | Set objWMIServices = GetObject("winmgmts:" & _ | | "{impersonationLevel=impersonate}!\\.\root\default") | | objWMIServices.ExecNotificationQueryAsync Sink, WQL | | ws.Popup "Listening for Registry Change Events...", nShowTime, strTitle, 4096 | | Do : WScript.Sleep 1000 : Loop | | | | Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) | | | | CheckReg wmiObject.ValueName | | End Sub | | | | Sub CheckReg(VName) | | On Error Resume Next | | RegFullPath = Hive & "\" & KeyPath & "\" & ValueName | | RegFullPath2 = Hive2 & "\" & KeyPath2 & "\" & ValueName2 | | if VName=ValueName then | | Value = ws.RegRead(RegFullPath) | | if Err then | | ws.RegWrite RegFullPath, gaiwei, "REG_DWORD" | | Err.Clear | | end if | | if CStr(Value)=CStr(shuzhi) then | | ws.Popup RegFullPath & " 变成了 " & shuzhi, nShowTime, strTitle, 4096 | | ws.RegWrite RegFullPath, gaiwei, "REG_DWORD" | | end if | | end if | | if VName=ValueName2 then | | Value = ws.RegRead(RegFullPath2) | | if Err then | | ws.RegWrite RegFullPath2, gaiwei2, "REG_DWORD" | | Err.Clear | | end if | | if CStr(Value)=CStr(shuzhi2) then | | ws.Popup RegFullPath2 & " 变成了 " & shuzhi2, nShowTime, strTitle, 4096 | | ws.RegWrite RegFullPath2, gaiwei2, "REG_DWORD" | | end if | | end if | | End SubCOPY |
|