标题: 用VBS监视进程创建和删除
作者: Demon
链接: https://demon.tw/programming/vbs-monitoring-process-creation-and-deletion.html
版权: 本博客的所有文章,都遵守“署名-非商业性使用-相同方式共享 2.5 中国大陆”协议条款。
微软脚本中心里的例子,用到了WMI事件,抄下来备查。
监视进程的创建,在每次创建新的进程时,临时事件消费程序都发出警报。
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colMonitoredProcesses = objWMIService. _ ExecNotificationQuery("select * from __instancecreationevent " _ & " within 1 where TargetInstance isa 'Win32_Process'") i = 0 Do While i = 0 Set objLatestProcess = colMonitoredProcesses.NextEvent Wscript.Echo objLatestProcess.TargetInstance.Name Loop
监视进程的删除,在每次进程终止时,临时事件消费程序都发出警报。
strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colMonitoredProcesses = objWMIService. _ ExecNotificationQuery("select * from __instancedeletionevent " _ & "within 1 where TargetInstance isa 'Win32_Process'") i = 0 Do While i = 0 Set objLatestProcess = colMonitoredProcesses.NextEvent Wscript.Echo objLatestProcess.TargetInstance.Name Loop
参考链接:
赞赏微信赞赏支付宝赞赏
随机文章:
老兄,你那个解压的帖子,调用复制错啦,麻烦改下哦
微软链接失效。creat delet 不仔细看还真看不出来。坦白说我是用 UltraCompare 文本比较才发现。