从Win XP到Win 7/8/10,OS(Operating System)有些安全特性改变了,所以不能向以前Win XP那样直接可以删除Windows Registry中的HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB下面的子项。
我们可以通过以下方法。
以下详细介绍这两点。
我们生成exe时,需要exe运行在Administrator控制下。
右击项目名,点击“属性”项,进入“安全性”选项页,选择“启用ClickOnce安全设置”。
这样会自动生成app.manifest,并把其中“requestedExecutionLevel”改成“requiredAdministrator”。
再次取消“启用ClickOnce安全设置”的勾选
示例有三个exe文件
DeleteUsbRegKey.exe: 实现删除注册表
DeleteUsbRegKeyWrapper.exe: 调用PsExec.exe来运行DeleteUsbRegKey.exe
PsExec.exe
直接上代码
namespace DeleteUsbRegKey { public class UsbRegistryOperator : IUsbRegistryOperator { private const string UsbRootKeyPath = @"SYSTEM\CurrentControlSet\Enum\USB"; public bool Exists(string usbKeyName) { using (var localMachineKey = Registry.LocalMachine) { using (var usbRootKey = localMachineKey.OpenSubKey(UsbRootKeyPath)) { return usbRootKey .GetSubKeyNames() .Any(name => name.ToUpper() == usbKeyName.ToUpper()); } } } public void DeleteSubKeys(string usbKeyName) { if (!Exists(usbKeyName)) return; using (var localMachineKey = Registry.LocalMachine) { var usbKeyPath = UsbRootKeyPath + @"\" + usbKeyName; using (var usbKey = localMachineKey.OpenSubKey(usbKeyPath, RegistryKeyPermissionCheck.ReadWriteSubTree)) { foreach (var name in usbKey.GetSubKeyNames()) { usbKey.DeleteSubKeyTree(name); } } } } } }
namespace DeleteUsbRegKey { class Program { static void Main(string[] args) { try { if (!args.Any()) throw new ArgumentException("Should have 1 argument at least"); var deleter = BuildUsbKeyDeleter(); var usbKeyName = args[0]; deleter.DeleteSubKeys(usbKeyName); } catch (Exception exception) { Console.WriteLine("Message:\n" + exception.Message); Console.WriteLine(); Console.WriteLine("StackTrace:\n" + exception.StackTrace); } } private static IUsbKeyDeleter BuildUsbKeyDeleter() { var usbRegistryOperator = new UsbRegistryOperator(); return new UsbKeyDeleter(usbRegistryOperator); } } }
namespace DeleteUsbRegKeyWrapper { public class PathsProvider : IPathsProvider { public string GetDirectory() { return AppDomain.CurrentDomain.BaseDirectory; } public string GetDeleteUsbRegKeyPath() { const string fileName = "DeleteUsbRegKey.exe"; return Path.Combine(GetDirectory(), fileName); } public string GetPsExecPath() { const string fileName = "PsExec.exe"; return Path.Combine(GetDirectory(), fileName); } } }
namespace DeleteUsbRegKeyWrapper { public class PsExecStarter : IPsExecStarter { private readonly IPathsProvider _pathsProvider; public PsExecStarter(IPathsProvider pathsProvider) { _pathsProvider = pathsProvider; } public void Run(string usbKeyName) { var psi = new ProcessStartInfo { FileName = _pathsProvider.GetPsExecPath(), Arguments = BuildArguments(usbKeyName), WorkingDirectory = _pathsProvider.GetDirectory() }; var process = Process.Start(psi); process.WaitForExit(); } private string BuildArguments(string usbKeyName) { return string.Format("-i -s \"{0}\" \"{1}\"", _pathsProvider.GetDeleteUsbRegKeyPath(), usbKeyName); } } }
namespace DeleteUsbRegKeyWrapper { class Program { static void Main(string[] args) { try { if (!args.Any()) throw new ArgumentException("Should have 1 argument at least"); var starter = BuildPsExecStarter(); var usbKeyName = args[0]; starter.Run(usbKeyName); } catch (Exception exception) { Console.WriteLine("Message:\n" + exception.Message); Console.WriteLine(); Console.WriteLine("StackTrace:\n" + exception.StackTrace); } } private static IPsExecStarter BuildPsExecStarter() { var pathsProvider = new PathsProvider(); return new PsExecStarter(pathsProvider); } } }
这样即使“Everyone”没有“Full Control”也是可以删除HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB下面的子项的。