//監視HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run項#include <windows.h>//定義一個監視註冊表啟動項的函數int reg(){ HANDLE hNotify; HKEY hKeyx; //DWORD dwRes; hNotify = CreateEvent(NULL, //不使用SECURITY_ATTRIBUTES結構 FALSE, //不自動重設 TRUE, //設定初始狀態 "RegistryNotify" //事件對象的名稱 ); if (hNotify == 0) { MessageBox(NULL,"CreateEvent failed"," ",MB_OK); ExitProcess(0); } if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, //根鍵 "Software\\Microsoft\\Windows\\CurrentVersion\\Run", //子鍵 0, //reserved KEY_NOTIFY, //監視用 &hKeyx //儲存控制代碼 ) != ERROR_SUCCESS) { CloseHandle(hNotify); MessageBox(NULL,"RegOpenKeyEx failed"," ",MB_OK); ExitProcess(0); } if (RegNotifyChangeKeyValue(hKeyx, //監視子鍵控制代碼 TRUE, //監視此項的子鍵 REG_NOTIFY_CHANGE_NAME | REG_NOTIFY_CHANGE_LAST_SET, //監視增加或刪除了子鍵,監視索引值發生是否改變 hNotify, //接受註冊表變化事件的事件物件控點 TRUE //註冊表變化前報告 ) != ERROR_SUCCESS) { CloseHandle(hNotify); RegCloseKey(hKeyx); MessageBox(NULL,"RegNotifyChangeKeyValue failed"," ", MB_OK); ExitProcess(0); } if (WaitForSingleObject(hNotify, INFINITE) != WAIT_FAILED) { MessageBox(NULL,"註冊表有改動"," ",MB_OK); } CloseHandle(hNotify); RegCloseKey(hKeyx); return 0;}void main(){ // DWORD ID; // CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)reg, NULL, 0, &ID); //建立線程 // printf("ok\n");reg();}