实战Registry和RegistryKey类，一个简单的可疑文件扫描程序

    RegistryKey scan &＃61; Registry.LocalMachine.OpenSubKey("SOFTWARE\\Honeydogchen\\.Dog\\Scan",true);

    string strdir &＃61; scan.GetValue("FolderSelect").ToString();

    if(this.checkBox2.Checked&＃61;&＃61;true)
    {
     RegistryKey microsoft &＃61; Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft",true);      
     RegistryKey currentversion1 &＃61; microsoft.OpenSubKey("Windows NT\\CurrentVersion",true);
     RegistryKey currentversion2 &＃61; microsoft.OpenSubKey("Windows\\CurrentVersion",true);

     try
     {
      string system32dir &＃61; currentversion1.GetValue("SystemRoot").ToString();
      GetSystemFiles(system32dir&＃43;"\\SYSTEM32");
     }
     catch(Exception)
     {
     }
     try
     {
      string systemdir &＃61; currentversion2.GetValue("SystemRoot").ToString();
      GetSystemFiles(systemdir&＃43;"\\SYSTEM");
     }
     catch(Exception)
     {
     }
     
    }
    
    GetCommonFiles(strdir);

    this.textBox1.Text &＃61; strdir;
     
    this.label1.Enabled &＃61; true;
    this.label4.Enabled &＃61; true;
    this.Cursor &＃61; System.Windows.Forms.Cursors.Default;

    if(a&＃61;&＃61;0)
    {
     this.listBox1.Items.Add(" 恭喜恭喜,没有发现可疑文件");
    }
    else
    {
     this.listBox1.Items.Add(" 共发现"&＃43;a&＃43;"个可疑文件,请用专业反病毒软件查杀");
    }

    this.listBox1.Items.Add("");
    this.listBox1.Items.Add("扫描结束,"&＃43;"共扫描了"&＃43;d&＃43;"个进程,"&＃43;b&＃43;"个文件");
    this.listBox1.Items.Add("");
    this.listBox1.Items.Add("反病毒技术支持");
    this.listBox1.Items.Add(" Email:honeydogchen&＃64;163.com");

   }
   catch(Exception)
   {
   }

  }
  
  private void GetCommonFiles(string strDir)
  { 
   string path &＃61; Application.StartupPath;
   Share.Ini ini &＃61; new Share.Ini(path&＃43;"\\Virus.dat");

   DirectoryInfo dir &＃61; new DirectoryInfo(strDir);

   int number &＃61; Convert.ToInt16(ini.IniReadValue("VirusList","Number"));
 
   FileInfo[] exefiles &＃61; dir.GetFiles("*.exe");

   foreach(FileInfo f in exefiles)
   { 
    this.textBox1.Text &＃61; f.FullName.ToString();
    this.textBox1.Refresh();

    for(int i&＃61;0;i    {
     string name &＃61; Convert.ToString(ini.IniReadValue("VirusList","Name"&＃43;i));
     if(f.Name.ToLower().EndsWith(name))
     {
      this.listBox1.Items.Add(" 名称:"&＃43;f.Name.ToString());
      this.listBox1.Items.Add(" 路径:"&＃43;strDir&＃43;"\\"&＃43;f.Name.ToString());
      a&＃43;&＃43;;
     }
    }
    b&＃43;&＃43;;
   }

   if(this.checkBox3.Checked&＃61;&＃61;true)
   {
    DirectoryInfo[] dir1List &＃61; dir.GetDirectories();
    for(int i &＃61; 0;i    {
     GetCommonFiles(strDir&＃43;"\\"&＃43;dir1List[i].Name);
    }
   }

  }

  private void GetSystemFiles(string strDir)
  { 
   string path &＃61; Application.StartupPath;
   Share.Ini ini &＃61; new Share.Ini(path&＃43;"\\Virus.dat");

   DirectoryInfo dir &＃61; new DirectoryInfo(strDir);

   int number &＃61; Convert.ToInt16(ini.IniReadValue("VirusList","Number"));
 
   FileInfo[] exefiles &＃61; dir.GetFiles("*.exe");

   foreach(FileInfo f in exefiles)
   { 
    this.textBox1.Text &＃61; f.FullName.ToString();
    this.textBox1.Refresh();

    for(int i&＃61;0;i    {
     string name &＃61; Convert.ToString(ini.IniReadValue("VirusList","Name"&＃43;i));
     if(f.Name.ToLower().EndsWith(name))
     {
      this.listBox1.Items.Add(" 名称:"&＃43;f.Name.ToString());
      this.listBox1.Items.Add(" 路径:"&＃43;strDir&＃43;"\\"&＃43;f.Name.ToString());
      a&＃43;&＃43;;
     }
    }
    b&＃43;&＃43;;
   }

  }

  private void CheckRegistry()
  {
   int h &＃61; 0;
   int i &＃61; 0;
   int j &＃61; 0;
   int k &＃61; 0;
   int l &＃61; 0;
   int n &＃61; 0;

   this.listBox1.Visible &＃61; true;

   try
   {
    this.listBox1.Items.Clear();
    this.listBox1.Items.Add("扫描注册表的启动项");
    RegistryKey hklm &＃61; Registry.LocalMachine;
    RegistryKey hkcu &＃61; Registry.CurrentUser;
    RegistryKey hkcr &＃61; Registry.ClassesRoot;

    RegistryKey run1 &＃61; hklm.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");     
    foreach(string sValName1 in run1.GetValueNames())
    {
     this.listBox1.Items.Add(" "&＃43;sValName1&＃43;":"&＃43;run1.GetValue(sValName1));
    }
    RegistryKey run2 &＃61; hkcu.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
    foreach(string sValName2 in run2.GetValueNames())
    {
     this.listBox1.Items.Add("  "&＃43;sValName2&＃43;":"&＃43;run2.GetValue(sValName2));
    }

    this.listBox1.Items.Add("");
    this.listBox1.Items.Add("扫描文件的关联状况");
    RegistryKey currentversion1 &＃61; hklm.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",true);
    RegistryKey winlogon &＃61; currentversion1.OpenSubKey("Winlogon",true);
    RegistryKey windowstoo &＃61; currentversion1.OpenSubKey("Windows",true);

    try
    {
     RegistryKey currentversion2 &＃61; hklm.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion",true);
     string systemdir &＃61; currentversion2.GetValue("SystemRoot").ToString();
     if(systemdir!&＃61;"")
     {
      Share.Ini ini &＃61; new Share.Ini(systemdir&＃43;"\\System.ini");

      string explorer &＃61; Convert.ToString(ini.IniReadValue("boot","shell"));
      if(explorer!&＃61;"explorer.exe"&&explorer!&＃61;"Explorer.exe")
      {
       n&＃43;&＃43;;
       this.listBox1.Items.Add(" Shell&＃61;"&＃43;explorer&＃43;" 异常");
      }

      ini &＃61; new Share.Ini(systemdir&＃43;"\\Win.ini");
      string run &＃61; Convert.ToString(ini.IniReadValue("windows","run"));
      if(run!&＃61;"")
      {
       n&＃43;&＃43;;
       this.listBox1.Items.Add(" run&＃61;"&＃43;run&＃43;" 异常");
      }
      string load &＃61; Convert.ToString(ini.IniReadValue("windows","load"));
      if(load!&＃61;"")
      {
       n&＃43;&＃43;;
       this.listBox1.Items.Add(" load&＃61;"&＃43;load&＃43;" 异常");
      }
    
     }
    }
    catch(Exception)
    {
    }

    try
    {
     string explorer &＃61; winlogon.GetValue("Shell").ToString();
     if(explorer!&＃61;"explorer.exe"&&explorer!&＃61;"Explorer.exe")
     {
      n&＃43;&＃43;;
      this.listBox1.Items.Add(" Shell&＃61;"&＃43;explorer&＃43;" 异常");
     }
  
     string runtoo &＃61; windowstoo.GetValue("run").ToString();
     if(runtoo!&＃61;"")
     {
      n&＃43;&＃43;;
      this.listBox1.Items.Add(" run&＃61;"&＃43;runtoo&＃43;" 异常");
     }
     string loadtoo &＃61; windowstoo.GetValue("load").ToString();
     if(loadtoo!&＃61;"")
     {
      n&＃43;&＃43;;
      this.listBox1.Items.Add(" load&＃61;"&＃43;loadtoo&＃43;" 异常");
     }
    }
    catch(Exception)
    {
    }
   
    RegistryKey command1 &＃61; hkcr.OpenSubKey("txtfile\\shell\\open\\command",true);
    foreach(string txt in command1.GetValueNames())
    {
     string txt1 &＃61; command1.GetValue(txt).ToString();
     if(txt1!&＃61;"NOTEPAD.EXE %1"&&txt1!&＃61;"notepad.exe %1")
     {
      h&＃43;&＃43;; 
      this.listBox1.Items.Add(" txt文件关联:"&＃43;txt1.ToString()&＃43;" 异常");
     }
    }
  
    RegistryKey command2 &＃61; hkcr.OpenSubKey("exefile\\shell\\open\\command",true);
    foreach(string exe in command2.GetValueNames())
    {
     string exe1 &＃61; command2.GetValue(exe).ToString();
     string exe10 &＃61; "\""&＃43;"%1"&＃43;"\""&＃43;" %*";
     if(exe1!&＃61;exe10)
     {
      i&＃43;&＃43;;
      this.listBox1.Items.Add(" exe文件关联:"&＃43;exe1&＃43;" 异常");
     }
    }
  
    RegistryKey command3 &＃61; hkcr.OpenSubKey("regfile\\shell\\open\\command",true);
    foreach(string reg in command3.GetValueNames())
    {
     string reg1 &＃61; command3.GetValue(reg).ToString();
     string reg10 &＃61; "regedit.exe "&＃43;"\""&＃43;"%1"&＃43;"\"";
     if(reg1!&＃61;reg10)
     {
      j&＃43;&＃43;;
      this.listBox1.Items.Add(" reg文件关联:"&＃43;reg1&＃43;" 异常");
     }
    }
  
    RegistryKey command4 &＃61; hkcr.OpenSubKey("comfile\\shell\\open\\command",true);
    foreach(string com in command4.GetValueNames())
    {
     string com1 &＃61; command4.GetValue(com).ToString();
     string com10 &＃61; "\""&＃43;"%1"&＃43;"\""&＃43;" %*";
     if(com1!&＃61;com10)
     {
      k&＃43;&＃43;;
      this.listBox1.Items.Add(" com文件关联:"&＃43;com1&＃43;" 异常");
     }
    }
  
    RegistryKey command5 &＃61; hkcr.OpenSubKey("batfile\\shell\\open\\command",true);
    foreach(string bat in command5.GetValueNames())
    {
     string bat1 &＃61; command5.GetValue(bat).ToString();
     string bat10 &＃61; "\""&＃43;"%1"&＃43;"\""&＃43;" %*";
     if(bat1!&＃61;bat10)
     {
      l&＃43;&＃43;;
      this.listBox1.Items.Add(" bat文件关联:"&＃43;bat1&＃43;" 异常");
     }
    }

   }
   catch(Exception)
   {
   }

   if(n&＃61;&＃61;0)
    this.listBox1.Items.Add(" Explorer.exe、Win.ini、System.ini正常");
   if(h&＃61;&＃61;0)
    this.listBox1.Items.Add(" txt文件关联正常"); 
   if(i&＃61;&＃61;0)
    this.listBox1.Items.Add(" exe文件关联正常");
   if(j&＃61;&＃61;0)
    this.listBox1.Items.Add(" reg文件关联正常"); 
   if(k&＃61;&＃61;0)
    this.listBox1.Items.Add(" com文件关联正常");  
   if(l&＃61;&＃61;0)
    this.listBox1.Items.Add(" bat文件关联正常");
  }
  
  private void CheckProcess()
  {
   try
   {
    this.listBox1.Items.Add("");
    this.listBox1.Items.Add("扫描当前的系统进程");
    Process[] procList &＃61; new System.Diagnostics.Process[50];
    procList &＃61; Process.GetProcesses();
    d &＃61; procList.GetLength(0);

    string path &＃61; Application.StartupPath;
    Share.Ini ini &＃61; new Share.Ini(path&＃43;"\\Virus.dat");

    int number &＃61; Convert.ToInt16(ini.IniReadValue("VirusList","Number"));
    
    for(int i &＃61; 0; i    {        
     string strProcName &＃61; procList[i].ProcessName&＃43;".exe";
     this.textBox1.Text &＃61; "ProcName:"&＃43;strProcName;
     this.textBox1.Refresh();
     Thread.Sleep(50);
     Activate();
     for(int j&＃61;0;j     {
      string name &＃61; Convert.ToString(ini.IniReadValue("VirusList","Name"&＃43;j));
      if(strProcName.ToLower()&＃61;&＃61;name)
      {
       this.listBox1.Items.Add(" 名称:"&＃43;strProcName);
       this.listBox1.Items.Add(" 路径:"&＃43;procList[i].MainModule.FileName);
       c&＃43;&＃43;;
      }
     
     }
     
    }
   
   }
   catch(Exception)
   {
   }

   if(c&＃61;&＃61;0)
   {
    this.listBox1.Items.Add(" 恭喜恭喜,没有发现可疑进程");
   }
   else
   {
    this.listBox1.Items.Add(" 共发现"&＃43;c&＃43;"个可疑进程,请用专业反病毒软件查杀");
   }

  }