对注册表和系统服务项的一些问题

[就是那个党伟]

如何获取 注册表中自动启动项和系统服务项发生变化时的信息呢？
求大牛！
给个思路即可，或者调用哪些API更好，不胜感激！

[赵4老师]

RegNotifyChangeKeyValue The RegNotifyChangeKeyValue function notifies the caller about changes to the attributes or contents of a specified registry key. Note that the function does not notify the caller if the specified key is deleted. LONG RegNotifyChangeKeyValue( HKEY hKey, // handle to key to watch BOOL bWatchSubtree, // flag for subkey notification DWORD dwNotifyFilter, // changes to be reported HANDLE hEvent, // handle to signaled event BOOL fAsynchronous // flag for asynchronous reporting ); Parameters hKey Handle to a currently open key or any of the following predefined reserved handle values: HKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS bWatchSubtree Specifies a flag that indicates whether to report changes in the specified key and all of its subkeys or only in the specified key. If this parameter is TRUE, the function reports changes in the key and its subkeys. If the parameter is FALSE, the function reports changes only in the key. dwNotifyFilter Specifies a set of flags that control which changes should be reported. This parameter can be a combination of the following values: Value Meaning REG_NOTIFY_CHANGE_NAME Notify the caller if a subkey is added or deleted. REG_NOTIFY_CHANGE_ATTRIBUTES Notify the caller of changes to the attributes of the key, such as the security descriptor information. REG_NOTIFY_CHANGE_LAST_SET Notify the caller of changes to a value of the key. This can include adding or deleting a value, or changing an existing value. REG_NOTIFY_CHANGE_SECURITY Notify the caller of changes to the security descriptor of the key. hEvent Handle to an event. If the fAsynchronous parameter is TRUE, the function returns immediately and changes are reported by signaling this event. If fAsynchronous is FALSE, hEvent is ignored. fAsynchronous Specifies a flag that indicates how the function reports changes. If this parameter is TRUE, the function returns immediately and reports changes by signaling the specified event. When this parameter is FALSE, the function does not return until a change has occurred. If hEvent does not specify a valid event, the fAsynchronous parameter cannot be TRUE. Return Values If the function succeeds, the return value is ERROR_SUCCESS. If the function fails, the return value is a nonzero error code defined in WINERROR.H. You can use the FormatMessage function with the FORMAT_MESSAGE_FROM_SYSTEM flag to get a generic description of the error. Remarks If the key identified by the hKey parameter is closed, the event is signaled. This means that an application should not depend on the key being open after returning from a wait operation on the event. RegNotifyChangeKeyValue does not work with remote handles. If RegNotifyChangeKeyValue is called with an hKey value that is a remote handle, it returns ERROR_INVALID_HANDLE. QuickInfo Windows NT: Requires version 3.1 or later. Windows: Requires Windows 98 or later. Windows CE: Unsupported. Header: Declared in winreg.h. Import Library: Use advapi32.lib. See Also Registry Overview, Registry Functions, RegDeleteKey, RegEnumKey, RegEnumKeyEx, RegEnumValue, RegQueryInfoKey, RegQueryValue, RegQueryValueEx