China DOS Union

Determine whether there is an item with the value "Sysin" under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\" in the registry, the key value is "Wins" (string), the type is "REG_SZ", and the value is "mondy".

1. If it exists, continue to execute (jump to the next instruction), if not, create a new one --- (exact match, including case)
For example, the item value is "Sysin" and cannot be "sysin" or other, the key value is "Wins" and cannot be "wins" or other, the value is "mondy" and cannot be "Mondy" or other

2. If it exists, continue to execute (jump to the next instruction), if not, create a new one --- (case-insensitive)

Urgently need to be solved, thank you!

[ Last edited by Mekinery on 2007-12-24 at 09:36 PM ]

```batch
@echo off
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Sysin" ||call :No
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins" ||call :StillNo
reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "mondy" ||goto :NoMore

echo Continue here
pause

:No
reg add "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f /v "Wins" /t REG_SZ /d "mondy"
goto:eof

:StillNo
reg delete "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Sysin" /f /v "Wins" /t REG_SZ /d "mondy"
goto:eof

:NoMore
echo Go find Gates ◎＿◎
pause
```

fastslz is quite humorous. First of all, thank you again for fastslz, but it didn't achieve the result I wanted.
Maybe I didn't explain it clearly enough, then I'll simplify it a bit more:
Check if there is a string value named Wins with type REG_SZ and value mondy under the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin".
Once again, confirm that there is a string, the name is "Wins", not "wins, WIns, ..", and the type is definitely "REG_SZ", not "REG_DWORD, REG_MULTI_SZ, REG_BINARY, REG_EXPAND_SZ, ...", and the data value of the key "Wins" is "mondy", not "Mondy, moNdy, ..."
String Type REG_SZ
Binary value Type REG_BINARY
DWORD Type REG_DWORD
...
It should need to search and judge, right?
If any item doesn't match, it should exit. If all match, then jump to the command segment to be executed.
This should be easier to understand...

[ Last edited by Mekinery on 2007-12-24 at 07:08 PM ]

Complete Registry Operation Methods
This is a demonstration example of WMI operating the registry. After each dialog box pops up, you will find the operations of WMI on the registry by checking the corresponding location in the registry. After all operations are completed, the script will automatically restore all operations of this script on the registry.

① Create primary keys, create key values of various types.

② Read key values and analyze key value types.

③ Enumerate primary keys and key values.

④ Determine whether a key or key value exists.

⑤ Query the operation permissions of the registry key.

⑥ Monitor the registry root key, primary key, and key value, and prompt when changes are found.
'''Registry Query/Operation On Error Resume Next Const HKEY_CLASSES_ROOT = &H80000000'''Set the 5 major root keys of the registry, HKCR-----------① Const HKEY_CURRENT_USER = &H80000001'''HKCU Const HKEY_LOCAL_MACHINE = &H80000002'''HKLM Const HKEY_Users = &H80000003'''HKU Const HKEY_Current_Config = &H80000005'''HKCC Const REG_SZ = 1'''Set the registry key value type, string type---------------------------② Const REG_EXPAND_SZ = 2'''Expanded string type Const REG_BINARY = 3'''Binary type Const REG_DWORD = 4'''Double-byte type Const REG_MULTI_SZ = 7'''Multi-string type Const KEY_QUERY_VALUE = &H0001'''Registry permission query, query value-----------------③ Const KEY_SET_VALUE = &H0002'''Set value Const KEY_CREATE_SUB_KEY = &H0004'''Create sub-item Const DELETE = &H00010000'''Delete item value '''-----------------Configure environment (path)----------------------------------------00 strComputer = "." Set WshShell = WScript.CreateObject("WScript.Shell") Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv") strKeyRoot = HKEY_LOCAL_MACHINE Regpath = "HKEY_LOCAL_MACHINE" strKeyPath = "Software\Microsoft\Windows\CurrentVersion\Run" WshSHell.popup "Setting path successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create primary key "REG_KEY_SZ"----------------------------------01 strKeyPathNew = "Software\Microsoft\Windows\CurrentVersion\Run\User_baomaboy\"'''Note that because it is a new primary key, add an extra "\" oReg.CreateKey strKeyRoot, strKeyPathNew WshSHell.popup "Creating primary key successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create string value "REG_SZ"----------------------------------02 strValueName="1 String name" strValue="String value" oReg.SetStringValue strKeyRoot, strKeyPath, strValueName, strValue WshSHell.popup "Creating string successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create double-byte value "REG_DWORD"-------------------------------- strValueName="2 Double-byte name" strValue=1 oReg.SetDWORDValue strKeyRoot, strKeyPath, strValueName, strValue WshSHell.popup "Creating double-byte value successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create multi-string "REG_MULTI_SZ"----------------------------- strValueName="3 Multi-string name" arrStringValues = Array("QQ25926183", "userbaomaboy","LLKJ", "Linglong Technology") oReg.SetMultiStringValue strKeyRoot, strKeyPath, strValueName, arrStringValues WshSHell.popup "Creating multi-string successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create expanded string "REG_EXPAND_SZ"-------------------------- strValueName = "4 Expanded string name" strValue = "%PATHEXT%" oReg.SetExpandedStringValue strKeyRoot, strKeyPath, strValueName, strValue WshSHell.popup "Creating expanded string successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Create binary value "REG_BINVRY_SZ"---------------------------- RegPathEr=Regpath&"\Software\Microsoft\Windows\CurrentVersion\Run\5 Binary value" WshSHell.RegWrite RegPathEr,1,"REG_BINARY" WshSHell.popup "Creating binary value successfully"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Read string value "REG_VALUE"------------------------------- oReg.GetStringValue strKeyRoot, strKeyPath, "1 String name", strRunCommand WshSHell.popup "Reading string value:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Read double-byte value "REG_DWORD"------------------------------- oReg.GetDWORDValue strKeyRoot, strKeyPath, "2 Double-byte name", strRunCommand WshSHell.popup "Reading double-byte value:"&vbcrlf&vbcrlf&strRunCommand&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Read multi-string value "REG_MULTI_SZ"-------------------------- oReg.GetMultiStringValue strKeyRoot, strKeyPath, "3 Multi-string name", arrValues For Each strValue In arrValues DuoString=DuoString&vbcrlf&strValue Next WshSHell.popup "Reading multi-string value:"&vbcrlf&vbcrlf&DuoString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Read expanded string "REG_EXPAND_SZ"------------------------- oReg.GetExpandedStringValue strKeyRoot, strKeyPath, "4 Expanded string name", strValue WshSHell.popup "Reading expanded string value:"&vbcrlf&vbcrlf&strValue&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Read binary value "REG_BINVRY_SZ"---------------------------- oReg.GetBinaryValue strKeyRoot, strKeyPath, "5 Binary value", strValue For i = lBound(strValue) to uBound(strValue) ErString=ErString&strValue(i) Next WshSHell.popup "Reading binary value:"&vbcrlf&vbcrlf&ErString&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Enumerate primary key "SUB_KEY"-------------------------------------- oReg.EnumKey strKeyRoot, strKeyPath, arrSubKeys For Each subkey In arrSubKeys ArrSubKeyStr=ArrSubKeyStr&vbcrlf&subkey Next WshSHell.popup "Enumerating primary key:"&vbcrlf&vbcrlf&ArrSubKeyStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Enumerate key value and key value type "KEY_Value_Types"-------------------- oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes For i=0 To UBound(arrValueNames) If Len(arrValueNames(i)) > 0 Then Select Case arrValueTypes(i) Case REG_SZ ValueType=" >>>Is: String value" Case REG_EXPAND_SZ ValueType=" >>>Is: Expanded string value" Case REG_BINARY ValueType=" >>>Is: Binary value" Case REG_DWORD ValueType=" >>>Is: Double-byte value" Case REG_MULTI_SZ ValueType=" >>>Is: Multi-string value" End Select arrValueStr=arrValueStr&vbcrlf&arrValueNames(i)&ValueType End If Next WshSHell.popup "Enumerating key values and types:"&vbcrlf&vbcrlf&arrValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Enumerate key value and key value content one "KEY_Value_Contenct"---------------- oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes For i=0 To UBound(arrValueNames) If Len(arrValueNames(i)) > 0 Then oReg.GetStringValue strKeyRoot,strKeyPath,arrValueNames(i),strValue'''Suitable for string type ValueStr=ValueStr&vbcrlf&arrValueNames(i)&vbcrlf&strValue end if Next WshSHell.popup "Enumerating key values and content one:"&vbcrlf&vbcrlf&ValueStr&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Enumerate key value and key value content two "KEY_Value_Contenct"---------------- oReg.EnumValues strKeyRoot, strKeyPath, arrValueNames, arrValueTypes i=0 For Each strValue in arrValueNames If Len(strValue) > 0 Then i=i+1 oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand'''Suitable for string type intLength = Len(strRunCommand) if intLength > 35 then'''Aesthetic echo, (can add more code to judge whether the path contains broken Chinese characters) strRunCommand = Left(strRunCommand, 20)&"……"&Right(strRunCommand, 13) end if StrRoot= i&".【"&strValue&"】"&vbCRLF&" "&strRunCommand ARoot=ARoot&vbCRLF&StrRoot End If Next WshSHell.popup "Enumerating key values and content two:"&vbcrlf&vbcrlf&ARoot&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Delete key value "REG_VALUE"------------------------------------- oReg.DeleteValue strKeyRoot, strKeyPath, "5 Binary value" WshSHell.popup "Deleting key value:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&"\5 Binary value"&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''----------------- Delete primary key "SUB_KEY"--------------------------------------- oReg.DeleteKey strKeyRoot, strKeyPathNew WshSHell.popup "Deleting primary key:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPathNew&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''-----------------Judge whether the key value exists----------------------------------------- strValue="""Virus""" oReg.GetStringValue strKeyRoot,strKeyPath,strValue,strRunCommand If IsNull(strRunCommand) Then WshSHell.popup strValue&"This registry key value does not exist."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 Else WshSHell.popup strValue&"This key value exists in the registry."&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 End If '''----------------- Check registry access permission "Check Up Extent Of Power"------------ oReg.CheckAccess strKeyRoot, strKeyPath, KEY_QUERY_VALUE, bHasAccessRight If bHasAccessRight = True Then aaa="Can query value" Else aaa="Cannot query value" End If oReg.CheckAccess strKeyRoot, strKeyPath, KEY_SET_VALUE, bHasAccessRight If bHasAccessRight = True Then bbb="Can set value" Else bbb="Cannot set value" End If oReg.CheckAccess strKeyRoot, strKeyPath, KEY_CREATE_SUB_KEY, bHasAccessRight If bHasAccessRight = True Then ccc="Can create primary key" Else ccc="Cannot create primary key" End If oReg.CheckAccess strKeyRoot, strKeyPath, DELETE, bHasAccessRight If bHasAccessRight = True Then ddd="Can delete key value" Else ddd="Cannot delete key value" End If WshSHell.popup "Registry access permission:"&vbcrlf&vbcrlf&Regpath&"\"&strKeyPath&vbcrlf&vbcrlf&aaa&vbcrlf&bbb&vbcrlf&ccc&vbcrlf&ddd&vbcrlf&vbcrlf&vbcrlf&vbcrlf&vbcrlf&"The window will close automatically after 5 seconds!", 5, "QQ:25926183", 0 + 64 '''－－－－－Restore registry to original state-------- oReg.DeleteValue strKeyRoot, strKeyPath, "4 Expanded string name" oReg.DeleteValue strKeyRoot, strKeyPath, "3 Multi-string name" oReg.DeleteValue strKeyRoot, strKeyPath, "2 Double-byte name" oReg.DeleteValue strKeyRoot, strKeyPath, "1 String name" '''-----------------Monitor registry key value "REG_KEY_SZ"------------------------------- '''Used to monitor all changes in the "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 String name" branch in the registry. 'Set wmiServices = GetObject("winmgmts:root/default") 'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 'wmiServices.ExecNotificationQueryAsync wmiSink, _ '"SELECT * FROM RegistryValueChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ '"KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' AND ValueName='1 String name'" 'WScript.Echo "Start monitoring changes in the value of the HKLM_Run primary key value in the registry......" & vbCrLf 'While(1) 'WScript.Sleep 1000 'Wend 'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 'WScript.Echo ".........Registry changed......" & vbCrLf & _ '"----------Monitor changes in the value of the registry key value-----------" & vbCrLf & _ 'wmiObject.GetObjectText_() 'WScript.Quit(0)'''Used to exit after prompting if a change is found 'End Sub '''-----------------Monitor registry primary key "REG_SubKey_SZ"----------------------------- '''Monitor the registry to find any changes to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. 'Set wmiServices = GetObject("winmgmts:root/default") 'Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") 'wmiServices.ExecNotificationQueryAsync wmiSink, _ '"SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _ '"KeyPath='SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'" 'WScript.Echo "Start monitoring changes in the key value of the HKLM_Run primary key in the registry......" & vbCrLf 'While(1) 'WScript.Sleep 1000 'Wend 'Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) 'WScript.Echo ".........Registry changed......" & vbCrLf & _ '"----------Monitor changes in the primary key value of the registry-----------" & vbCrLf & _ 'wmiObject.GetObjectText_() 'WScript.Quit(0)'''Used to exit after prompting if a change is found 'End Sub '''-----------------Monitor registry root key "REG_RootKey_SZ"---------------------------- '''Monitor the registry to find any changes to HKLM. Set wmiServices = GetObject("winmgmts:root/default") Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_") wmiServices.ExecNotificationQueryAsync wmiSink, _ "SELECT * FROM RegistryTreeChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND RootPath=''" WScript.Echo "Start monitoring all changes in the HKLM root key in the registry......" & vbCrLf While(1) WScript.Sleep 1000 Wend Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext) WScript.Echo ".........Registry changed......" & vbCrLf & _ "----------Monitor all changes in the registry root key-----------" & vbCrLf & _ wmiObject.GetObjectText_() WScript.Quit(0)'''Used to exit after prompting if a change is found End Sub

Don't understand VBS. If the system disables VBS, then it's useless, right? Still, batch processing is better. It would be great if batch processing could be implemented. Still waiting~~~

@echo off
for /f "delims=" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows') do (if "%%i"=="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin" goto 1)
goto no
:1
for /f "tokens=1,2,*" %%i in ('reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Sysin') do (if "%%i%%j%%k"=="WinsREG_SZmondy" goto yes)
:no
echo no
goto end
:yes
echo yes
:end
pause

Indeed, the second floor is just for demonstration. Actually, it's very simple. As long as there's one mismatch, it exits.

@echo off reg query HKLM\SOFTWARE\Microsoft\Windows|find "Sysin"||echo No reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins"|find "REG_SZ"|find "mondy"||echo No pause

Or

@echo off reg query HKLM\SOFTWARE\Microsoft\Windows|find "Sysin"&&reg query HKLM\SOFTWARE\Microsoft\Windows\Sysin|find "Wins"|find "REG_SZ"|find "mondy"||echo No pause

Thanks everyone, learned new knowledge again, hehe~~