'''注冊表查詢/操作 
On Error Resume Next 
Const HKEY_CLASSES_ROOT = &H80000000'''設置注冊表5大根鍵，HKCR-----------① 
Const HKEY_CURRENT_USER = &H80000001'''HKCU 
Const HKEY_LOCAL_MACHINE = &H80000002'''HKLM 
Const HKEY_Users = &H80000003'''HKU 
Const HKEY_Current_Config = &H80000005'''HKCC 
Const REG_SZ = 1'''設置注冊表鍵值類型，字符串型---------------------------② 
Const REG_EXPAND_SZ = 2'''擴展字符串型 
Const REG_BINARY = 3'''二進制型 
Const REG_DWORD = 4'''雙字節型 
Const REG_MULTI_SZ = 7'''多字符串型 
Const KEY_QUERY_VALUE = &H0001'''查詢注冊表權限，查詢數值-----------------③ 
Const KEY_SET_VALUE = &H0002'''設置數值 
Const KEY_CREATE_SUB_KEY = &H0004'''創建子項 
Const DELETE = &H00010000'''刪除項值 
'''-----------------配置環境(路徑)----------------------------------------00 
strComputer = "." 
Set WshShell = WScript.CreateObject("WScript.Shell") 
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!//" & strComputer & "/root/default:StdRegProv") 
strKeyRoot = HKEY_LOCAL_MACHINE 
Regpath = "HKEY_LOCAL_MACHINE" 
strKeyPath = "Software/Microsoft/Windows/CurrentVersion/Run" 
WshSHell.popup "設置路徑【HKLM/Software/Microsoft/Windows/CurrentVersion/Run】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建主鍵"REG_KEY_SZ"----------------------------------01 
strKeyPathNew = "Software/Microsoft/Windows/CurrentVersion/Run/User_baomaboy/"'''注意因為是新建主鍵，要多加個“/” 
oReg.CreateKey strKeyRoot, strKeyPathNew 
WshSHell.popup "創建主鍵【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/User_baomaboy/】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建字符串值"REG_SZ"----------------------------------02 
strValueName="1字符串名" 
strValue="字符串值" 
oReg.SetStringValue strKeyRoot, strKeyPath, strValueName, strValue 
WshSHell.popup "創建字符串【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/1字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建雙字節值"REG_DWORD"-------------------------------- 
strValueName="2雙字節名" 
strValue=1 
oReg.SetDWORDValue strKeyRoot, strKeyPath, strValueName, strValue 
WshSHell.popup "創建雙字節值【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/2雙字節名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建多字符串"REG_MULTI_SZ"----------------------------- 
strValueName="3多字符串名" 
arrStringValues = Array("QQ25926183", "userbaomaboy","LLKJ", "玲瓏科技") 
oReg.SetMultiStringValue strKeyRoot, strKeyPath, strValueName, arrStringValues 
WshSHell.popup "創建多字符串【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/3多字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建擴展字符串"REG_EXPAND_SZ"-------------------------- 
strValueName = "4擴展字符串名" 
strValue = "%PATHEXT%" 
oReg.SetExpandedStringValue strKeyRoot, strKeyPath, strValueName, strValue 
WshSHell.popup "創建擴展字符串【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/4擴展字符串名】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------創建二進制值"REG_BINVRY_SZ"---------------------------- 
RegPathEr=Regpath&"/Software/Microsoft/Windows/CurrentVersion/Run/5二進制值" 
WshSHell.RegWrite RegPathEr,1,"REG_BINARY" 
WshSHell.popup "創建二進制值【HKLM/Software/Microsoft/Windows/CurrentVersion/Run/5二進制值】成功"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 讀取字符串值"REG_VALUE"------------------------------- 
oReg.GetStringValue strKeyRoot, strKeyPath, "1字符串名", strRunCommand 
WshSHell.popup "讀取字符串值:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 讀取雙字節值"REG_DWORD"------------------------------- 
oReg.GetDWORDValue strKeyRoot, strKeyPath, "2雙字節名", strRunCommand 
WshSHell.popup "讀取雙字節值:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 讀取多字符串值"REG_MULTI_SZ"-------------------------- 
oReg.GetMultiStringValue strKeyRoot, strKeyPath, "3多字符串名", arrValues 
For Each strValue In arrValues 
DuoString=DuoString&vbcrlf&strValue 
Next 
WshSHell.popup "讀取多字符串值:"&vbcrlf&vbcrlf&DuoString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 讀取擴展字符串"REG_EXPAND_SZ"------------------------- 
oReg.GetExpandedStringValue strKeyRoot, strKeyPath, "4擴展字符串名", strValue 
WshSHell.popup "讀取擴展字符串值:"&vbcrlf&vbcrlf&strValue&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 讀取二進制值"REG_BINVRY_SZ"---------------------------- 
oReg.GetBinaryValue strKeyRoot, strKeyPath, "5二進制值", strValue 
For i = lBound(strValue) to uBound(strValue) 
ErString=ErString&strValue(i) 
Next 
WshSHell.popup "讀取二進制值:"&vbcrlf&vbcrlf&ErString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 枚舉主鍵"SUB_KEY"-------------------------------------- 
oReg.EnumKey strKeyRoot, strKeyPath, arrSubKeys 
For Each subkey In arrSubKeys 
ArrSubKeyStr=ArrSubKeyStr&vbcrlf&subkey 
Next 
WshSHell.popup "枚舉主鍵:"&vbcrlf&vbcrlf&ArrSubKeyStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 枚舉鍵值和鍵值類型"KEY_Value_Types"-------------------- 
oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 
For i=0 To UBound(arrValueNames) 
If Len(arrValueNames(i)) > 0 Then 
Select Case arrValueTypes(i) 
Case REG_SZ ValueType=" >>>是：字符串值" 
Case REG_EXPAND_SZ ValueType=" >>>是：擴展字符串值" 
Case REG_BINARY ValueType=" >>>是：二進制值" 
Case REG_DWORD ValueType=" >>>是：雙字節值" 
Case REG_MULTI_SZ ValueType=" >>>是：多字符串值" 
End Select 
arrValueStr=arrValueStr&vbcrlf&arrValueNames(i)&ValueType 
End If 
Next 
WshSHell.popup "枚舉鍵值和類型:"&vbcrlf&vbcrlf&arrValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 枚舉鍵值和鍵值內容一"KEY_Value_Contenct"---------------- 
oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 
For i=0 To UBound(arrValueNames) 
If Len(arrValueNames(i)) > 0 Then 
oReg.GetStringValue strKeyRoot,strKeyPath,arrValueNames(i),strValue'''適應于字符串型 
ValueStr=ValueStr&vbcrlf&arrValueNames(i)&vbcrlf&strValue 
end if 
Next 
WshSHell.popup "枚舉鍵值和內容一:"&vbcrlf&vbcrlf&ValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 枚舉鍵值和鍵值內容二"KEY_Value_Contenct"---------------- 
oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes 
i=0 
For Each strValue in arrValueNames 
If Len(strValue) > 0 Then 
i=i+1 
oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand'''適應于字符串型 
intLength = Len(strRunCommand) 
if intLength > 35 then'''美化回顯，(可再加代碼判路徑是否包含斷漢字) 
strRunCommand = Left(strRunCommand, 20)&"……"&Right(strRunCommand, 13) 
end if 
StrRoot= i&".【"&strValue&"】"&vbCRLF&" "&strRunCommand 
ARoot=ARoot&vbCRLF&StrRoot 
End If 
Next 
WshSHell.popup "枚舉鍵值和內容二:"&vbcrlf&vbcrlf&ARoot&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 刪除鍵值"REG_VALUE"------------------------------------- 
oReg.DeleteValue strKeyRoot, strKeyPath, "5二進制值" 
WshSHell.popup "刪除鍵值:"&vbcrlf&vbcrlf&Regpath&"/"&strKeyPath&"/5二進制值"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''----------------- 刪除主鍵"SUB_KEY"--------------------------------------- 
oReg.DeleteKey strKeyRoot, strKeyPathNew 
WshSHell.popup "刪除主鍵:"&vbcrlf&vbcrlf&Regpath&"/"&strKeyPathNew&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''-----------------判斷鍵值是否存在----------------------------------------- 
strValue="""病毒""" 
oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand 
If IsNull(strRunCommand) Then 
WshSHell.popup strValue&"此注冊表鍵值不存在."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
Else 
WshSHell.popup strValue&"注冊表中存在此鍵值."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
End If 
'''----------------- 檢查注冊表訪問權限"Check Up Extent Of Power"------------ 
oReg.CheckAccess strKeyRoot, strKeyPath, KEY_QUERY_VALUE, bHasAccessRight 
If bHasAccessRight = True Then 
aaa="可以查詢數值" 
Else 
aaa="不可查詢數值" 
End If 
oReg.CheckAccess strKeyRoot, strKeyPath, KEY_SET_VALUE, bHasAccessRight 
If bHasAccessRight = True Then 
bbb="可以設置數值" 
Else 
bbb="不可設置數值" 
End If 
oReg.CheckAccess strKeyRoot, strKeyPath, KEY_CREATE_SUB_KEY, bHasAccessRight 
If bHasAccessRight = True Then 
ccc="可以創建主鍵" 
Else 
ccc="不可創建主鍵" 
End If 
oReg.CheckAccess strKeyRoot, strKeyPath, DELETE, bHasAccessRight 
If bHasAccessRight = True Then 
ddd="可以刪除鍵值" 
Else 
ddd="不可刪除鍵值" 
End If 
WshSHell.popup "注冊表訪問權限:"&vbcrlf&vbcrlf&Regpath&"/"&strKeyPath&vbcrlf&vbcrlf&aaa&vbcrlf&bbb&vbcrlf&ccc&vbcrlf&ddd&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"5 秒鐘后本窗口將自動關閉!", 5, "QQ:25926183", 0 + 64 
'''－－－－－恢復注冊表原樣-------- 
oReg.DeleteValue strKeyRoot, strKeyPath, "4擴展字符串名" 
oReg.DeleteValue strKeyRoot, strKeyPath, "3多字符串名" 
oReg.DeleteValue strKeyRoot, strKeyPath, "2雙字節名" 
oReg.DeleteValue strKeyRoot, strKeyPath, "1字符串名" 
'''-----------------監視注冊表鍵值"REG_KEY_SZ"------------------------------- 
'''用以對注冊表中HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/1字符串名"分支下的所有更改內容進行監視。 
'Set wmiServices = GetObject("winmgmts:root/default") 
'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 
'wmiServices.ExecNotificationQueryAsync wmiSink, _ 
'"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ 
'"KeyPath='SOFTWARE//Microsoft//Windows//CurrentVersion//Run' AND ValueName='1字符串名'" 
'WScript.Echo "開始監視注冊表HKLM_Run主鍵鍵值的值的變化......" & vbCrLf 
'While(1) 
'WScript.Sleep 1000 
'Wend 
'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 
'WScript.Echo ".........注冊表改變......" & vbCrLf & _ 
'"----------監視注冊表鍵值的值變化-----------" & vbCrLf & _ 
'wmiObject.GetObjectText_() 
'WScript.Quit(0)'''用作發現修改則提示后退出 
'End Sub 
'''-----------------監視注冊表主鍵"REG_SubKey_SZ"----------------------------- 
'''監視注冊表，以發現對 HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run 的任何更改。 
'Set wmiServices = GetObject("winmgmts:root/default") 
'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 
'wmiServices.ExecNotificationQueryAsync wmiSink, _ 
'"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ 
'"KeyPath='SOFTWARE//Microsoft//Windows//CurrentVersion//Run'" 
'WScript.Echo "開始監視注冊表HKLM_Run主鍵的鍵值變化......" & vbCrLf 
'While(1) 
'WScript.Sleep 1000 
'Wend 
'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 
'WScript.Echo ".........注冊表改變......" & vbCrLf & _ 
'"----------監視注冊表主鍵鍵值變化-----------" & vbCrLf & _ 
'wmiObject.GetObjectText_() 
'WScript.Quit(0)'''用作發現修改則提示后退出 
'End Sub 
'''-----------------監視注冊表根鍵"REG_RootKey_SZ"---------------------------- 
'''監視注冊表，以發現對 HKLM 的任何更改。 
Set wmiServices = GetObject("winmgmts:root/default") 
Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 
wmiServices.ExecNotificationQueryAsync wmiSink, _ 
"SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath=''" 
WScript.Echo "開始監視注冊表HKLM根鍵的所有變化......" & vbCrLf 
While(1) 
WScript.Sleep 1000 
Wend 
Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 
WScript.Echo ".........注冊表改變......" & vbCrLf & _ 
"----------監視注冊表根鍵所有變化-----------" & vbCrLf & _ 
wmiObject.GetObjectText_() 
WScript.Quit(0)'''用作發現修改則提示后退出 
End Sub