函数RegNotifyChangeKeyValue在XP下怎样用来实现？

VBeginner 2003-05-31 11:03:32

我使用以下代码在XP下，当注册表发生变化时，给应用程序发出通知
Const ERROR_SUCCESS = 0
Const HKEY_CLASSES_ROOT = &H80000000
Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
Const REG_NOTIFY_CHANGE_NAME = &H1
Const REG_NOTIFY_CHANGE_ATTRIBUTES = &H2
Const REG_NOTIFY_CHANGE_LAST_SET = &H4
Const REG_NOTIFY_CHANGE_SECURITY = &H8
Const REG_LEGAL_CHANGE_FILTER = (REG_NOTIFY_CHANGE_NAME Or REG_NOTIFY_CHANGE_ATTRIBUTES Or _
REG_NOTIFY_CHANGE_LAST_SET Or REG_NOTIFY_CHANGE_SECURITY)

Private Declare Function RegNotifyChangeKeyValue Lib "advapi32" (ByVal hKey As Long, _
ByVal bWatchSubtree As Boolean, ByVal dwNotifyFilter As Long, ByVal hEvent As Long, _
ByVal fAsynchronous As Boolean) As Long
Private Declare Function BroadcastSystemMessage Lib "user32" (ByVal dw As Long, pdw As Long, ByVal un As Long, _
ByVal wParam As Long, ByVal lParam As Long) As Long
Private Sub Form_Load()
Dim RetVal

RetVal = RegNotifyChangeKeyValue(HKEY_CURRENT_USER, True, REG_LEGAL_CHANGE_FILTER, _
AddressOfRegProc, False)

If RetVal = ERROR_SUCCESS Then
MsgBox "Registry changed"
End If
End Sub
可是有些问题，程序一运行，我只要一按显示桌面，就会出现"Registry changed"
可是，我主要是注意注册表被恶意修改，不知需要注意监视哪些地方？
还有就是怎样持续监视，直到注册表改变，如果改变没关系，程序仍可以继续执行监视；否则跳出。
谢谢！

...全文