WM_DEVICECHANGE

DBT_CONFIGCHANGECANCELED
0x0019 A request to change the current configuration (dock or undock) has been canceled.
DBT_CONFIGCHANGED
0x0018 The current configuration has changed, due to a dock or undock.
DBT_CUSTOMEVENT
0x8006 A custom event has occurred.
Windows NT 4.0 and Windows 95:  This value is not supported.
DBT_DEVICEARRIVAL
0x8000 A device or piece of media has been inserted and is now available.
DBT_DEVICEQUERYREMOVE
0x8001 Permission is requested to remove a device or piece of media. Any application can deny this request and cancel the removal.
DBT_DEVICEQUERYREMOVEFAILED
0x8002 A request to remove a device or piece of media has been canceled.
DBT_DEVICEREMOVECOMPLETE
0x8004 A device or piece of media has been removed.
DBT_DEVICEREMOVEPENDING
0x8003 A device or piece of media is about to be removed. Cannot be denied.
DBT_DEVICETYPESPECIFIC
0x8005 A device-specific event has occurred.
DBT_DEVNODES_CHANGED
0x0007 A device has been added to or removed from the system.
Windows NT 4.0 and Windows Me/98/95:  This value is not supported.
DBT_QUERYCHANGECONFIG
0x0017 Permission is requested to change the current configuration (dock or undock).
DBT_USERDEFINED
0xFFFF The meaning of this message is user-defined.

重启的问题可能是，你所注册的服务没有启动，建议你使用scm来管理服务。

谢谢 楼上的兄弟 十分感谢

WM_DEVICECHANGE的说明如下：
当Windows系统的硬件设置发生变化时,系统将会向所有应用程序发送一条WM_DEVICECHANGE消息.当有设备被禁止或激活时(比如我们插入光盘,从光驱中取出光盘,或者在系统设备中删除或禁止打印端口),该消息的wParam参数分别被指定为DBT_DEVICEARRIVAL(设备安装完毕)和DBT_DEVICEREMOVECOMPLETE(设备移除完毕),根据这两个参数可以判断闪存是否存在,lParam参数指向一DEV_BROADCAST_HDR结构,该结构中的dbch_devicetype成员是变化设备的类型,当该值为DBT_DEVTYP_VOLUME时,表明一个带有卷标名的驱动器发生了变化
（出处：http://sogoodm.com/soft/t5/16303-63858.html ）

这种东西最好用驱动做,可以逆一下USSEPro,不过那个够复杂,我只看了一点

尝试逆下USSEPro的2005版本的驱动，那个版本的驱动比较简单，只有13K，但是 所有的 功能呢 都有 ，大概逆了下她的驱动，正在看它使用usb的class LowerFilter怎么实现只读的 ，要实现禁用usb存储设备的话，比较简单，做成usb 的class的LowerFilter，然后再IRP_MJ_INTERNAL_DEVICE_CONTROL例程中、DeviceObject->AttachedDevice->DriverObject->DriverName.Buffer 判断是否是usbstor即可进行拦截