一 代码
from win32api import * from win32con import * def GetValues(fullname): name =str.split(fullname,'\\',1) try: if name[0] == 'HKEY_LOCAL_MACHINE': key = RegOpenKey(HKEY_LOCAL_MACHINE,name[1],0,KEY_READ) elif name[0] == 'HKEY_CURRENT_USER': key = RegOpenKey(HKEY_CURRENT_USER,name[1],0,KEY_READ) elif name[0] == 'HKEY_CLASSES_ROOT': key = RegOpenKey(HKEY_CLASSES_ROOT,name[1],0,KEY_READ) elif name[0] == 'HKEY_CURRENT_CONFIG': key = RegOpenKey(HKEY_CURRENT_CONFIG,name[1],0,KEY_READ) elif name[0] == 'HKEY_USERS': key = RegOpenKey(HKEY_CURRENT_CONFIG,name[1],0,KEY_READ) else: print("err,no key named %s" % name[0]) info = RegQueryInfoKey(key) for i in range(0,info[1]): ValueName = RegEnumValue(key,i) print(str.ljust(ValueName[0],30),ValueName[1]) RegCloseKey(key) except: pass if __name__ == '__main__': keyNames =['HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Run',\ 'HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnce',\ 'HKEY_LOCAL_MACHINE\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnceEx',\ 'HKEY_CURRENT_USER\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\RunOnce',\ 'HKEY_CURRENT_USER\\SOFTWARE\\\Microsoft\\\Windows\\\CurrentVersion\\\Run'] for keyName in keyNames: print('\n') print(keyName) GetValues(keyName)
二 运行结果
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
RtHDVCpl C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
RtHDVBg_Dolby "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
RtHDVBg_LENOVO_MICPKEY "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /LENOVO_MICPKEY
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
ucdrv_repair "C:\Program Files (x86)\UCBrowser\Security\uclauncher.exe" --repair
HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
HKEY_CURRENT_USER\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
Wechat D:\Program Files (x86)\Tencent\WeChat\WeChat.exe -autorun
ctfmon C:\WINDOWS\system32\ctfmon.exe
sesvc "D:\Program Files\360se6\Application\components\sesvc\sesvc.exe" /b:1 /c:1
NewsClientStratRun C:\Users\lenovo\AppData\Roaming\2144GameBox\NewsClient.exe /runhide
HCDNClient "C:\Program Files (x86)\IQIYI Video\LStyle\5.5.33.3550\QyKernel.exe" -shell_start