10 replies to this topic

[logmein]

Hi there,
I am going to build a program to manage my startup programs. It work well on WinXP but when I upgrade my OS to Win 7, everything goes hell!
This is my sample code :

Plain Text        expandcollapse  popup

#include <ButtonConstants.au3>
#include <EditConstants.au3>
#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>
#include <Constants.au3>
#include <ListViewConstants.au3>
#include <GuiListView.au3>
#include <String.au3>
Global $startup_key_1 = 'HKCU64\Software\Microsoft\Windows\CurrentVersion\Run';x64 os
Global $startup_key_2 = 'HKLM64\Software\Microsoft\Windows\CurrentVersion\Run';x64 os
Global $startup_key_3 = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'
Global $startup_key_4 = 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'
#Region ### START Koda GUI section ### Form=D:\Total USB Security 4\startup_form.kxf
$formStartup = GUICreate("Startup Manager", 618, 326, 192, 125, BitOR($WS_CAPTION,$WS_POPUP,$WS_BORDER,$WS_CLIPSIBLINGS), BitOR($WS_EX_TOOLWINDOW,$WS_EX_WINDOWEDGE))
GUISetFont(10, 400, 0, "Arial")
$listStartup = GUICtrlCreateListView("Program|Key|File", 8, 8, 602, 286)
$hdlListStartup = GUICtrlGetHandle (-1)
GUICtrlSendMsg(-1, $LVM_SETCOLUMNWIDTH, 0, 150)
GUICtrlSendMsg(-1, $LVM_SETCOLUMNWIDTH, 1, 70)
GUICtrlSendMsg(-1, $LVM_SETCOLUMNWIDTH, 2, 375)
$btnRemoveStartup = GUICtrlCreateButton("&Remove", 424, 296, 91, 25, $WS_GROUP)
$btnCloseStartupForm = GUICtrlCreateButton("&Close", 520, 296, 91, 25, $WS_GROUP)
GUISetState(@SW_SHOW)
#EndRegion ### END Koda GUI section ###
_GetStartupItem ()
while 1
$nMsg = GUIGetMsg ()
Switch $nMsg
Case $btnCloseStartupForm
Exit
Case $btnRemoveStartup
_RemoveStartupItem ()
EndSwitch
WEnd
Func _RemoveStartupItem()
$select = _GUICtrlListView_GetSelectedIndices($hdlListStartup, True);get first item index
If $select[0] <> 0 Then
$key = _GUICtrlListView_GetItem($hdlListStartup, $select[1], 1)
$program = _GUICtrlListView_GetItem($hdlListStartup, $select[1], 0);program[3] means program name
RegDelete($key[3] & '\Software\Microsoft\Windows\CurrentVersion\Run', $program[3])
;ConsoleWrite ($key[3] & '\Software\Microsoft\Windows\CurrentVersion\Run' & '[' & $program[3] & ']' & @CRLF)
If Not @error Then
_GUICtrlListView_DeleteItem($hdlListStartup, $select[1])
Else
MsgBox(32, 'Startup Manager', 'Can''t remove the registry key. Please try again!', '', $formStartup)
Return
EndIf
EndIf
EndFunc
Func _GetStartupItem()
For $i = 1 To 100
$enum_key = RegEnumVal($startup_key_1, $i)
If @error then ExitLoop
$strRegRead = RegRead($startup_key_1, $enum_key)
$strRegReplace = _StringBetween ($strRegRead,'"','"')
If Not @error Then
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKCU64', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegReplace[0] , 2)
Else
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKCU64', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegRead , 2)
EndIf
Next
For $i = 1 To 100
$enum_key = RegEnumVal($startup_key_2, $i)
If @error then ExitLoop
$strRegRead = RegRead($startup_key_2, $enum_key)
$strRegReplace = _StringBetween ($strRegRead,'"','"')
If Not @error Then
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM64', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegReplace[0], 2)
Else
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM64', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegRead , 2)
EndIf
Next
For $i = 1 To 100
$enum_key = RegEnumVal($startup_key_3, $i)
If @error then ExitLoop
$strRegRead = RegRead($startup_key_3, $enum_key)
$strRegReplace = _StringBetween ($strRegRead,'"','"')
If Not @error Then
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegReplace[0], 2)
Else
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegRead , 2)
EndIf
Next
For $i = 1 To 100
$enum_key = RegEnumVal($startup_key_4, $i)
If @error then ExitLoop
$strRegRead = RegRead($startup_key_4, $enum_key)
$strRegReplace = _StringBetween ($strRegRead,'"','"')
If Not @error Then
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegReplace[0], 2)
Else
$add = _GUICtrlListView_AddItem($hdlListStartup, $enum_key)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, 'HKLM', 1)
_GUICtrlListView_AddSubItem($hdlListStartup, $add, $strRegRead , 2)
EndIf
Next
Return
EndFunc ;==>_GetStartupItem
#endregion---------------------------------------------------------

My program can still detect x86 startup programs but when I try to remove x86 programs, there was error. Then I use CCleaner to check up, I choose a x86 program (iTunesHelper), then right-click and choose "Open in Regedit..." and I get the address of registry key : Computer\HLMC\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Remember that!





Afterthat, I choose a x64 program in CCleaner(Persistence), continue to view it in Regedit and I got this :





Still Computer\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run??!

Plz help me!

[logmein]

I need you help! As soon as possible, thanks!

[guinness]

Congratulations on trying not to get help. Don't bump less than 24hours and use that time to find the answer yourself.

[logmein]

Oh, sorry...

[AdmiralAlkex]

Look in Task Manager, you are most likely running the x86 RegEdit on your first screenshot.

[logmein]

But they are alike. I don't understand. But how to delete or write a registry key in x86 Regedit?

[Danyfirex]

hi you are using bad keys.
if you use 'HKCU64' and 'HKCU' on your program will be appear your key two times. so you would be trying to delete a key who doesn't exist.
else in 86x you repeat two time your key HKLM64 and HKLM. but in 86x does'nt exist 64x keys.

You should Use this.
I think this is the best way.

Select
Case @OSArch="X64"

;case OS x64 read this key
"HKLM64SoftwareMicrosoftWindowsCurrentVersionRun"
"HKLMSoftwareMicrosoftWindowsCurrentVersionRun"
"HKCUSoftwareMicrosoftWindowsCurrentVersionRun"



Case @OSArch="X86"
;case OS x86 read this key
"HKLMSoftwareMicrosoftWindowsCurrentVersionRun"
"HKCUSoftwareMicrosoftWindowsCurrentVersionRun"


EndSelect

EndFunc

Edited by Danyfirex, 17 August 2012 - 02:01 PM.

[logmein]

Still don't work:((

[logmein]

Oh, I solved the problem, firstly, I changed the keys like yours and then add #RequireAdmin at the top of the script:)
Thanks Danyfirex:)

[Danyfirex]

Oh, I solved the problem, firstly, I changed the keys like yours and then add #RequireAdmin at the top of the script:)
Thanks Danyfirex:)

Glad to help you.
regards

[AdmiralAlkex]

But they are alike. I don't understand. But how to delete or write a registry key in x86 Regedit?

That's because WOW redirect x86 apps to another place.

You should read up on the Registry Redirector. There are lots of other interesting things to know about x64 Windows if you follow the links around in that Programming Guide.

Redirected keys are mapped to physical locations under Wow6432Node. For example, HKEY_LOCAL_MACHINESoftware is redirected to HKEY_LOCAL_MACHINESoftwareWow6432Node.