I am working on some VB code to monitor changes to my registry. The code works (it uses wmiServices.ExecNotificationQuery), but it works a little too well. Everytime I open Internet Explorer, it generates several events.
Basic (150 points total): I would like to change the program to ignore “trusted” applications and services. However, I really don’t know how to go about this. Does anybody know of a link to a list of Windows apps. and services that modify registry settings, or is there a process through which Microsoft routes trusted applications to modify the registry? I know that potentially any applications can modify the registry, but is there a relatively simple way to track modification by new programs?
Advanced (500 points total): if you can provide me with a link or VB or VB scripting code to modify the way that “wmiServices.ExecNotificationQuery” is called, if it either checks to assure the program is a Windows service, or if it checks to see if the agent attempting to modify the registry is on a “trusted” list of my creation. Here is the code that I started with, see semisynchronous call (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/registering_for_system_registry_events.asp).