用VBS實現(xiàn)監(jiān)視進程創(chuàng)建與刪除的代碼
更新時間：2011年02月26日 21:22:50 作者：
微軟腳本中心里的例子，用到了WMI事件，抄下來備查。
監(jiān)視進程的創(chuàng)建，在每次創(chuàng)建新的進程時，臨時事件消費程序都發(fā)出警報。
1.監(jiān)視進程的創(chuàng)建
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancecreationevent " _
& " within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
2.監(jiān)視進程的刪除，在每次進程終止時，臨時事件消費程序都發(fā)出警報。
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancedeletionevent " _
& "within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
3.監(jiān)視進程使用處理器的情況
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_process")
For Each objProcess in colProcesses
sngProcessTime = ( CSng(objProcess.KernelModeTime) + _
CSng(objProcess.UserModeTime)) / 10000000
Wscript
1.監(jiān)視進程的創(chuàng)建
復制代碼 代碼如下:
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancecreationevent " _
& " within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
2.監(jiān)視進程的刪除，在每次進程終止時，臨時事件消費程序都發(fā)出警報。
復制代碼 代碼如下:
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancedeletionevent " _
& "within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
3.監(jiān)視進程使用處理器的情況
復制代碼 代碼如下:
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_process")
For Each objProcess in colProcesses
sngProcessTime = ( CSng(objProcess.KernelModeTime) + _
CSng(objProcess.UserModeTime)) / 10000000
Wscript
參考鏈接：
參考: http://hi.baidu.com/%B1%F9%D0%C4%B3%D5/blog/item/5691a1c3146ded55b219a861.html http://demon.tw/programming/vbs-monitoring-process-creation-and-deletion.html相關文章
這是我在菊花論壇腳本版塊看到的,真的很不錯,一共有四個部份,把代碼復制到記事本另存為GetOwner.VBS文件,2009-07-07
用vbscript合并多個文本文件的代碼...2007-04-04
用vbs實現(xiàn)顯示系統(tǒng)調色板的代碼...2007-10-10
昨天晚上朋友的電腦需要定時關機，于是打開記事本，敲了幾行代碼（不要問我為什么不用at命令）2011-10-10
使用 Iisext.vbs 刪除應用程序依存關系的實現(xiàn)方法
這篇文章主要介紹了使用 Iisext.vbs 刪除應用程序依存關系的實現(xiàn)方法,需要的朋友可以參考下2014-07-07
用vbs控制iis創(chuàng)建虛擬目錄的代碼...2007-03-03
這篇文章主要介紹了vbs判斷磁盤類型和檢測硬盤剩余空間的實現(xiàn)代碼,需要的朋友可以參考下2016-10-10
讓VBS腳本也有GUI圖形界面,主要是利用了vbs中的internetexplorer.application組件，實現(xiàn)打開一個ie頁面。2011-01-01
對于版本有點老，所以建議學習使用，不要隨便直接運行。2009-08-08
下面的代碼比較經典，瞬間關閉所有的ie的腳本2008-06-06