public RegistryWatchers()
{
WqlEventQuery bootQuery = new WqlEventQuery(bootSql);
WqlEventQuery serviceQuery = new WqlEventQuery(serviceSql);
WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
WqlEventQuery userQuery = new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent WHERE " +
"Hive = 'HKEY_USERS' " +
@"AND RootPath = '" + currentUser.User.Value + @"\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'");
userWatch.Query = userQuery;
bootWatch.Query = bootQuery;
serviceWatch.Query = serviceQuery;
userWatch.EventArrived += new EventArrivedEventHandler(currentUserEvent);
userWatch.Start();
bootWatch.EventArrived += new EventArrivedEventHandler(localMachineEvent);
bootWatch.Start();
serviceWatch.EventArrived += new EventArrivedEventHandler(serviceEvent);
serviceWatch.Start();
initialize();
w = Writer.getInstance();
}