用VB实现对系统安装、卸载的实时监视，for win9x and NT(急，在线等）

[淘米淘米]

用VB实现对系统安装、卸载的实时监视，for win9x and NT(急，在线等）

TO斑竹：由于小弟上一次提问时同时有两个问题，闲人同学帮俺解决了一个，俺送了100分，本想再追加100分的，可无法追加，结果就结帖了，而本帖中的这个问题还没有解决，所以只好再开一新帖

[淘米淘米]

OK，那就这么用啦
还要请闲人同学再具体一点说一下好么？

回复人： jlum99(闲人) ( ) 信誉：102 2003-09-18 15:34:00
回复人： tommy_guo(淘米) ( ) 信誉：100 2003-09-18 15:44:00
回复人： jlum99(闲人) ( ) 信誉：102 2003-09-18 15:54:00

看一下上面这三个回复的时间。。。我晕倒。。。

[jlum99]

如果要具体的话就不太容易了，你可以查看关于API HOOK的方法和例子，不过不会是VB的例子，VB做不了。HOOK API也有很多方法，修改IDT ，做消息转发器，等等，一时也说不清楚，再个是水平有限，呵呵，见笑了。

[淘米淘米]

收到！俺这就去查资料，谢谢！

还有哪位同学可以提示俺一下么？呵呵

[pandengzhe]

监视安装卸载，只不过是监视文件写、和注册表，不用那末费事。

[淘米淘米]

pandengzhe(苦行僧(︶_︶)) 老大，那要如何监视“文件写”？系统级的监视所有的文件写入动作？累啊。。。
还有，监视注册表中的安装文件列表吗？要用到定时器吗？

[jlum99]

对，想起来个事，如果只是想监视用这个函数就可以了
http://www.csdn.net/develop/read_article.asp?id=3545 可以看看

[淘米淘米]

OK，文章看了，回头找了一下MSDN，发现了这个：

SHChangeNotify


Notifies the system of an event that an application has performed. An application should use this function if it performs an action that may affect the shell.

VOID SHChangeNotify(
LONG wEventId,
UINT uFlags,
LPCVOID dwItem1,
LPCVOID dwItem2
);

其中的wEventId里面就包括了很多事件，跟上文的DELPHI中提到的事件差不多，可这里面没有关于安装、卸载的专门事件啊
要不这样？监视注册表文件，如果有变化，就看一下已安装文件的列表？我晕倒。。。Windows每时每刻都在更改注册表啊，如果像上文说的那么做，那可能就不用干别的事了。。。

[jlum99]

哈哈 ：）总之是头疼脑热的是了

[淘米淘米]

唉，没办法，摊上这么个活儿，只能怪自己命苦哇。。。

[淘米淘米]

刚在MSDN里面找到一篇文章：
The VTrace Tool: Building a System Tracer for Windows NT and Windows 2000
Jacob R. Lorch and Alan Jay Smith

头一句就是： Writing a tracer for an operating system can be a nightmare.

FT.................

[jlum99]

相对的，API HOOK还是比较简单。

[淘米淘米]

在各位老大的帮助下，再加上GOOGLE和MSDN，终于弄出点模样来乐，帖出来与大家共享，还望各位老大多提意见，：）
watt(瓦特) 的例子在楼上，就不在此引用了
在MSDN里面找到了许多答案，主要参考的是下面这一段：
---- From MSDN Begin --------------------------------------------------------
位置：Platform SDK/Base Services/Registry/Registry Reference/Registry Functions/RegNotifyChangeKeyValue

The following program illustrates how to use RegNotifyChangeKeyValue.

#include <stdio.h>
#include <windows.h>

void main(int argc, char *argv[])
{
DWORD dwFilter = REG_NOTIFY_CHANGE_NAME |
REG_NOTIFY_CHANGE_ATTRIBUTES |
REG_NOTIFY_CHANGE_LAST_SET |
REG_NOTIFY_CHANGE_SECURITY;

HANDLE hEvent;
HKEY hMainKey;
HKEY hKey;
LONG lErrorCode;

// Display the usage error message.
if (argc != 3)
{
printf("Usage: notify [HKLM/HKU/HKCU/HKCR/HCC] [subkey]\n");
return;
}

// Convert parameters to appropriate handles.
if (strcmp("HKLM", argv[1]) == 0)
hMainKey = HKEY_LOCAL_MACHINE;
else if (strcmp("HKU", argv[1]) == 0)
hMainKey = HKEY_USERS;
else if (strcmp("HKCU", argv[1]) == 0)
hMainKey = HKEY_CURRENT_USER;
else if (strcmp("HKCR", argv[1]) == 0)
hMainKey = HKEY_CLASSES_ROOT;
else if (strcmp("HCC", argv[1]) == 0)
hMainKey = HKEY_CURRENT_CONFIG;
else
{
printf("Usage: notify [HKLM/HKU/HKCU/HKCR/HCC] [subkey]\n");
return;
}

// Open a key.
lErrorCode = RegOpenKeyEx(hMainKey, argv[2], 0, KEY_NOTIFY, &hKey);
if (lErrorCode != ERROR_SUCCESS)
printf("Error in RegOpenKeyEx.\n");

// Create an event.
hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
if (hEvent == NULL)
printf("Error in CreateEvent.\n");

// Watch the registry key for a change of value.
lErrorCode = RegNotifyChangeKeyValue(hKey,
TRUE,
dwFilter,
hEvent,
TRUE);
if (lErrorCode != ERROR_SUCCESS)
printf("Error in RegNotifyChangeKeyValue.\n");

// Wait for an event to occur.
if (WaitForSingleObject(hEvent, INFINITE) == WAIT_FAILED)
printf("Error in WaitForSingleObject.\n");

// Close the key.
lErrorCode = RegCloseKey(hKey);
if (lErrorCode != ERROR_SUCCESS)
printf("Error in RegCloseKey.\n");

// Close the handle.
if (!CloseHandle(hEvent))
printf("Error in CloseHandle.\n");
}
---- From MSDN End --------------------------------------------------------

[淘米淘米]

下面的这一段是在http://www.mvps.org/vbnet/index.html?code/reg/reguninstall.htm找到的，俺准备参考这段代码用来在程序中得到安装、卸载程序的详细信息

Visual Basic Registry Routines
Retrieving the Uninstall Application List

Posted: Sunday July 07, 2002
Updated: Sunday February 23, 2003

Applies to: VB4-32, VB5, VB6
Developed with: VB6, Windows XP
OS restrictions: None
Author: VBnet - Randy Birch

Related:
Retrieving the List of Registered File Associations

Prerequisites
None.

--------------------------------------------------------------------------------

This demo shows how to retrieve the listing of applications under the Uninstall key. In addition to the item names, the version (as stored in the registry with the file reference) as well as the actual uninstall string is returned. The item under the 'uninstallable' column is set True when an uninstall string is present; clicking such listview items will display the corresponding uninstall string in the textbox.

BAS Module Code
None.

--------------------------------------------------------------------------------



Form Code

Add a single command button (Command1), text box (Text1), and a listview (Listview1) to a form along with the following code:

--------------------------------------------------------------------------------

Option Explicit
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Copyright ©1996-2003 VBnet, Randy Birch, All Rights Reserved.
' Some pages may also contain other copyrights by the author.
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Distribution: You can freely use this code in your own
' applications, but you may not reproduce
' or publish this code on any web site,
' online service, or distribute as source
' on any media without express permission.
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
Private Const HKEY_LOCAL_MACHINE = &H80000002
Private Const REG_SZ As Long = 1
Private Const ERROR_MORE_DATA = 234
Private Const ERROR_SUCCESS As Long = 0
Private Const LB_SETTABSTOPS As Long = &H192

Private Const STANDARD_RIGHTS_READ As Long = &H20000
Private Const KEY_QUERY_VALUE As Long = &H1
Private Const KEY_ENUMERATE_SUB_KEYS As Long = &H8
Private Const KEY_NOTIFY As Long = &H10
Private Const SYNCHRONIZE As Long = &H100000
Private Const KEY_READ As Long = ((STANDARD_RIGHTS_READ Or _
KEY_QUERY_VALUE Or _
KEY_ENUMERATE_SUB_KEYS Or _
KEY_NOTIFY) And _
(Not SYNCHRONIZE))

Private Const LVM_FIRST As Long = &H1000
Private Const LVM_SETCOLUMNWIDTH As Long = (LVM_FIRST + 30)
Private Const LVSCW_AUTOSIZE_USEHEADER As Long = -2

Private Type REGISTRY_APPINFO
RegistryName As String
DisplayName As String
DisplayVersion As String
CanUninstall As Boolean
UninstallString As String
End Type

Private Type FILETIME 'ft
dwLowDateTime As Long
dwHighDateTime As Long
End Type

Private Declare Function RegOpenKeyEx Lib "advapi32.dll" _
Alias "RegOpenKeyExA" _
(ByVal hKey As Long, _
ByVal lpSubKey As String, _
ByVal ulOptions As Long, _
ByVal samDesired As Long, _
phkResult As Long) As Long

Private Declare Function RegEnumKeyEx Lib "advapi32.dll" _
Alias "RegEnumKeyExA" _
(ByVal hKey As Long, _
ByVal dwIndex As Long, _
ByVal lpName As String, _
lpcbName As Long, _
ByVal lpReserved As Long, _
ByVal lpClass As String, _
lpcbClass As Long, _
lpftLastWriteTime As FILETIME) As Long

Private Declare Function RegQueryValueEx Lib "advapi32.dll" _
Alias "RegQueryValueExA" _
(ByVal hKey As Long, _
ByVal lpValueName As String, _
ByVal lpReserved As Long, _
lpType As Long, _
lpData As Any, _
lpcbData As Long) As Long

Private Declare Function RegQueryInfoKey Lib "advapi32.dll" _
Alias "RegQueryInfoKeyA" _
(ByVal hKey As Long, _
ByVal lpClass As String, _
lpcbClass As Long, _
ByVal lpReserved As Long, _
lpcSubKeys As Long, _
lpcbMaxSubKeyLen As Long, _
lpcbMaxClassLen As Long, _
lpcValues As Long, _
lpcbMaxValueNameLen As Long, _
lpcbMaxValueLen As Long, _
lpcbSecurityDescriptor As Long, _
lpftLastWriteTime As FILETIME) As Long

Private Declare Function RegCloseKey Lib "advapi32.dll" _
(ByVal hKey As Long) As Long

Private Declare Function SendMessage Lib "user32" _
Alias "SendMessageA" _
(ByVal hwnd As Long, _
ByVal wMsg As Long, _
ByVal wParam As Long, _
lParam As Any) As Long

Private Declare Function lstrlenW Lib "kernel32" _
(ByVal lpString As Long) As Long



Private Sub Form_Load()

With ListView1
.ColumnHeaders.Add , , "Registry Entry"
.ColumnHeaders.Add , , "DisplayName"
.ColumnHeaders.Add , , "DisplayVersion"
.ColumnHeaders.Add , , "Uninstallable"

.View = lvwReport
.FullRowSelect = True
.AllowColumnReorder = True
.LabelEdit = lvwManual
End With

Command1.Caption = "Get Uninstall Info"
Text1.Text = ""

End Sub


Private Sub lvAutosizeControl(lv As ListView)

Dim col2adjust As Long

'Size each column based on the maximum of
'wither the ColumnHeader text width, or,
'if the items below it are wider, the
'widest list item in the column
lv.Visible = False

For col2adjust = 0 To lv.ColumnHeaders.Count - 1

Call SendMessage(lv.hwnd, _
LVM_SETCOLUMNWIDTH, _
col2adjust, _
ByVal LVSCW_AUTOSIZE_USEHEADER)

Next

lv.Visible = True

End Sub


(to be continued...)

[淘米淘米]

Private Sub ListView1_ColumnClick(ByVal ColumnHeader As MSComctlLib.ColumnHeader)

ListView1.SortKey = ColumnHeader.Index - 1
ListView1.SortOrder = Abs(Not ListView1.SortOrder = 1)
ListView1.Sorted = True

End Sub


Private Sub ListView1_ItemClick(ByVal Item As MSComctlLib.ListItem)

Text1.Text = Item.Tag

End Sub


Private Sub Command1_Click()

Dim hKey As Long
Dim sKey As String
Dim dwIndex As Long
Dim dwSubKeys As Long
Dim dwMaxSubKeyLen As Long
Dim ft As FILETIME
Dim success As Long
Dim sName As String
Dim cbName As Long
Dim itmx As ListItem
Dim rapp As REGISTRY_APPINFO

'obtain a handle to the uninstall key
sKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
hKey = OpenRegKey(HKEY_LOCAL_MACHINE, sKey)

'if valid
If hKey <> 0 Then

'query registry for the number of
'entries under that key
If RegQueryInfoKey(hKey, _
0&, _
0&, _
0, _
dwSubKeys, _
dwMaxSubKeyLen&, _
0&, _
0&, _
0&, _
0&, _
0&, _
ft) = ERROR_SUCCESS Then


'enumerate each item
For dwIndex = 0 To dwSubKeys - 1

sName = Space$(dwMaxSubKeyLen + 1)
cbName = Len(sName)

success = RegEnumKeyEx(hKey, _
dwIndex, _
sName, _
cbName, _
0, _
0, _
0, _
ft)

If success = ERROR_SUCCESS Or _
success = ERROR_MORE_DATA Then

rapp = GetRegistryItemData(sKey, TrimNull(sName))

Set itmx = ListView1.ListItems.Add(, , rapp.RegistryName)
itmx.SubItems(1) = rapp.DisplayName
itmx.SubItems(2) = rapp.DisplayVersion
itmx.SubItems(3) = rapp.CanUninstall
itmx.Tag = rapp.UninstallString

End If

Next 'For dwIndex

End If 'If RegQueryInfoKey

Call RegCloseKey(hKey)

End If 'If hKey <> 0

Call lvAutosizeControl(ListView1)

End Sub


Private Function TrimNull(startstr As String) As String

TrimNull = Left$(startstr, lstrlenW(StrPtr(startstr)))

End Function


Private Function GetRegistryItemData(ByVal sKey As String, _
ByVal lpValueName As String) As REGISTRY_APPINFO

'handle to the open subkey
Dim hSubKey As Long

hSubKey = OpenRegKey(HKEY_LOCAL_MACHINE, sKey & "\" & lpValueName)

If hSubKey <> 0 Then

With GetRegistryItemData
.RegistryName = lpValueName
.DisplayName = GetRegValue(hSubKey, "DisplayName")
.DisplayVersion = GetRegValue(hSubKey, "DisplayVersion")
.UninstallString = GetRegValue(hSubKey, "UninstallString")
.CanUninstall = Len(.UninstallString) > 0
End With

Call RegCloseKey(hSubKey)

End If

End Function


Private Function OpenRegKey(ByVal hKey As Long, _
ByVal lpSubKey As String) As Long

Dim hSubKey As Long

If RegOpenKeyEx(hKey, _
lpSubKey, _
0, _
KEY_READ, _
hSubKey) = ERROR_SUCCESS Then

OpenRegKey = hSubKey

End If

End Function


Private Function GetRegValue(hSubKey As Long, sValueName As String) As String

Dim lpValue As String 'name of the value to retrieve
Dim lpcbData As Long 'length of the retrieved value
Dim result As Long

'if valid
If hSubKey <> 0 Then

lpValue = Space$(260)
lpcbData = Len(lpValue)

'find the passed value if present
result = RegQueryValueEx(hSubKey, _
sValueName, _
0&, _
0&, _
ByVal lpValue, _
lpcbData)

If result = 0 Then
GetRegValue = TrimNull(lpValue)
End If

End If

End Function

[jlum99]

不错，能整理出来。

[淘米淘米]

OK，下面就是俺实现的CODE，刚写完主体，四处漏风，见笑，：P

---- Form ----------------------------------------------------------
Option Explicit

'"Hide" Button
Private Sub Command1_Click()
Me.Hide
Call UninstallChangeMonitor
Me.Show
End Sub

'"Exit" Button
Private Sub Command2_Click()
Unload Me
End Sub

Private Sub Form_Load()
Call UninstallChangeMonitor
End Sub

Private Sub UninstallChangeMonitor()
Dim lErrorCode As Long
Dim hMainKey As Long
Dim strSubKey As String
Dim hKey As Long
Dim lIsNull As Long
Dim hEvent As Long

hMainKey = HKEY_LOCAL_MACHINE
strSubKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
lErrorCode = RegOpenKeyEx(hMainKey, strSubKey, 0, KEY_ALL_ACCESS, hKey)

If (lErrorCode <> ERROR_SUCCESS) Then
MsgBox "Error in RegOpenKeyEx."
Unload Me
End If

'Create an event.
lIsNull = 0
hEvent = CreateEvent(lIsNull, True, False, vbNullString)
If hEvent = Null Then
MsgBox "Error in CreateEvent."
Unload Me
End If

'Watch the registry key for a change of value.
lErrorCode = RegNotifyChangeKeyValue(hKey, _
True, _
REG_NOTIFY_ALL, _
hEvent, _
True)
If lErrorCode <> ERROR_SUCCESS Then
MsgBox "Error in RegNotifyChangeKeyValue."
End If

'Wait for an event to occur.
If WaitForSingleObject(hEvent, INFINITE) = WAIT_FAILED Then
MsgBox "Error in WaitForSingleObject."
GoTo goto_end
End If

'此处用来进行事件处理：去取得安装、卸载程序的详细信息、写日志文件等
'本例中显示一个msgbox
MsgBox "Register changed!"

goto_end:
'Close the key.
lErrorCode = RegCloseKey(hKey)
If lErrorCode <> ERROR_SUCCESS Then
MsgBox "Error in RegCloseKey."
End If

'Close the handle.
CloseHandle hEvent
End Sub

---- Form ----------------------------------------------------------

[淘米淘米]

下面是public.bas里面的内容

---- public --------------------------------------------------------------

Option Explicit

Public Const ERROR_SUCCESS = 0&
Public Const HKEY_CLASSES_ROOT = &H80000000
Public Const HKEY_LOCAL_MACHINE = &H80000002
Public Const HKEY_CURRENT_USER = &H80000001
Public Const REG_OPTION_BACKUP_RESTORE = 4 ' open for backup or restore
Public Const REG_OPTION_VOLATILE = 1 ' Key is not preserved when system is rebooted
Public Const REG_OPTION_NON_VOLATILE = 0 ' Key is preserved when system is rebooted
Public Const STANDARD_RIGHTS_ALL = &H1F0000
Public Const SYNCHRONIZE = &H100000
Public Const READ_CONTROL = &H20000
Public Const STANDARD_RIGHTS_READ = (READ_CONTROL)
Public Const STANDARD_RIGHTS_WRITE = (READ_CONTROL)
Public Const KEY_CREATE_LINK = &H20
Public Const KEY_CREATE_SUB_KEY = &H4
Public Const KEY_ENUMERATE_SUB_KEYS = &H8
Public Const KEY_NOTIFY = &H10
Public Const KEY_QUERY_VALUE = &H1
Public Const KEY_SET_VALUE = &H2
Public Const KEY_READ = ((STANDARD_RIGHTS_READ Or KEY_QUERY_VALUE Or KEY_ENUMERATE_SUB_KEYS Or KEY_NOTIFY) And (Not SYNCHRONIZE))
Public Const KEY_WRITE = ((STANDARD_RIGHTS_WRITE Or KEY_SET_VALUE Or KEY_CREATE_SUB_KEY) And (Not SYNCHRONIZE))
Public Const KEY_EXECUTE = (KEY_READ)
Public Const KEY_ALL_ACCESS = ((STANDARD_RIGHTS_ALL Or KEY_QUERY_VALUE Or KEY_SET_VALUE Or KEY_CREATE_SUB_KEY Or KEY_ENUMERATE_SUB_KEYS Or KEY_NOTIFY Or KEY_CREATE_LINK) And (Not SYNCHRONIZE))

Public Const REG_NOTIFY_CHANGE_NAME = &H1 ' Create or delete (child)
Public Const REG_NOTIFY_CHANGE_ATTRIBUTES = &H2
Public Const REG_NOTIFY_CHANGE_LAST_SET = &H4 ' time stamp
Public Const REG_NOTIFY_CHANGE_SECURITY = &H8
Public Const REG_NOTIFY_ALL = (REG_NOTIFY_CHANGE_NAME Or REG_NOTIFY_CHANGE_ATTRIBUTES Or REG_NOTIFY_CHANGE_LAST_SET Or REG_NOTIFY_CHANGE_SECURITY)

Public Const INFINITE = &HFFFF
Public Const WAIT_FAILED = -1&

Public Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Public Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal Reserved As Long, ByVal samDesired As Long, phkResult As Long) As Long

Public Declare Function RegNotifyChangeKeyValue Lib "advapi32" (ByVal hKey As Long, ByVal bWatchSubtree As Boolean, ByVal dwNotifyFilter As Long, ByVal hEvent As Long, ByVal fAsynchronous As Boolean) As Long

'这里要注意一下，MSDN里面说lpEventAttributes这个参数Must be NULL，所以俺把声明改为：ByVal IsNull As Long
'Public Declare Function CreateEvent Lib "kernel32" Alias "CreateEventA" (lpEventAttributes As SECURITY_ATTRIBUTES, ByVal bManualReset As Long, ByVal bInitialState As Long, ByVal lpName As String) As Long
Public Declare Function CreateEvent Lib "kernel32" Alias "CreateEventA" (ByVal IsNull As Long, ByVal bManualReset As Long, ByVal bInitialState As Long, ByVal lpName As String) As Long

Public Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long

Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

---- public --------------------------------------------------------------

[淘米淘米]

上述代码在 VB6.0(SP5) + Win2000下编译通过，生成EXE后，运行
安装、卸载程序时，均会出现Message Box :Register changed!
未经大量测试 :P

下一步就是取得改变的详细信息
目前的想法是：程序运行后，读出当前所有的已安装程序，前文说过，参考在http://www.mvps.org/vbnet/index.html?code/reg/reguninstall.htm找到的代码，然后在以后每一次得知改变时，用当前的已安装程序列表跟上一次的已安装程序列表进行比对，从而确定是安装还是卸载，并进而得到目标的详细信息
这个方法看起来有点暴力，呵呵，如果哪位老大有更文明点儿的做法，还请告诉小弟，谢谢先

几个问题：
1.目前WaitForSingleObject(hEvent, INFINITE)这里用的是INFINITE，死等Chenge事件的发生，这样做的好处是比较可靠，但不好的地方是一根筋，“打死我也不出来”，呵呵，没办法，看来只能给他单独开个线程来跑，要知道俺的任务可不止是注册表这一块，还要监视进程捏，还要监视目录捏
如果不做成“死等”，而是定时退出，再根据返回值决定是“继续进入”、“出错退出”还是“等到了耶”，这样看起来还算合理

[淘米淘米]

简单顶一下，哪位老大再指点俺一下成么。。。

do while 搞定
message "谢谢！"
loop

[watt]

这有一个监控注册表的例子，你自已改一改吧。
'This program shows you how to use the RegNotifyChangeKeyValue-function
'As its name predicts, RegNotifyChangeKeyValue will notify our program
'when the registry changes.
'Follow these steps to test this program:
'1. Start this program
'2. Start Regedit.exe (located in your Windows-directory)
'3. Go to HKEY_CURRENT_USER
'4. Change the value of HKEY_CURRENT_USER
'5. You will see that our program returns from the RegNotifyChangeKeyValue

'WARNING: Playing with the registry can have serious consequences !
' If you don't know what you're doing, I advise you not to delete anything

Const HKEY_CLASSES_ROOT = &H80000000
Const HKEY_CURRENT_USER = &H80000001
Const HKEY_LOCAL_MACHINE = &H80000002
Const REG_NOTIFY_CHANGE_NAME = &H1 ' Create or delete (child)
Const REG_NOTIFY_CHANGE_ATTRIBUTES = &H2
Const REG_NOTIFY_CHANGE_LAST_SET = &H4 ' time stamp
Const REG_NOTIFY_CHANGE_SECURITY = &H8
Const REG_NOTIFY_ALL = (REG_NOTIFY_CHANGE_NAME Or REG_NOTIFY_CHANGE_ATTRIBUTES Or REG_NOTIFY_CHANGE_LAST_SET Or REG_NOTIFY_CHANGE_SECURITY)
Private Declare Function RegNotifyChangeKeyValue Lib "advapi32" (ByVal hKey As Long, ByVal bWatchSubtree As Boolean, ByVal dwNotifyFilter As Long, ByVal hEvent As Long, ByVal fAsynchronous As Boolean) As Long
Private Sub Form_Load()
'KPD-Team 1999
'URL: http://www.allapi.net/
'E-Mail: [e-mail]

'Create a temporary registry key
SaveSetting "Registry Notification", "Hello", "Testing", "123"
'Call the function .. This will notify us when something changes at HKEY_CURRENT_USER
RegNotifyChangeKeyValue HKEY_CURRENT_USER, True, REG_NOTIFY_ALL, ByVal 0&, False
MsgBox "Registry changed"
Unload Me
End Sub