- If WScript.Arguments.Count = 0 Then
- RunExe "cmd /k start /b " _
- & "cscript //nologo " & """" & WScript.ScriptFullName & """" & " MonitorCreation & " _
- & "cscript //nologo " & """" & WScript.ScriptFullName & """" & " MonitorDeletion"
- WScript.Quit
- End If
-
- Execute WScript.Arguments(0)
-
-
-
- Sub RunExe(strPath)
- Dim objWSH
- Set objWSH = CreateObject("WScript.Shell")
- objWSH.Run strPath
- Set objWSH = Nothing
- End Sub
-
- Sub MonitorCreation()
- strComputer = "."
- Set objWMIService = GetObject("winmgmts:" _
- & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
- Set colMonitoredProcesses = objWMIService. _
- ExecNotificationQuery("select * from __instancecreationevent " _
- & " within 1 where TargetInstance isa 'Win32_Process'")
- i = 0
-
- Do While i = 0
- Set objLatestProcess = colMonitoredProcesses.NextEvent
- Wscript.Echo Now() & " Process Created: " & vbCrLf & objLatestProcess.TargetInstance.CommandLine & vbCrLf
- Loop
- End Sub
-
- Sub MonitorDeletion()
- strComputer = "."
- Set objWMIService = GetObject("winmgmts:" _
- & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
- Set colMonitoredProcesses = objWMIService. _
- ExecNotificationQuery("select * from __instancedeletionevent " _
- & "within 1 where TargetInstance isa 'Win32_Process'")
- i = 0
-
- Do While i = 0
- Set objLatestProcess = colMonitoredProcesses.NextEvent
- Wscript.Echo Now() & " Process Deleted: " & vbCrLf & objLatestProcess.TargetInstance.CommandLine & vbCrLf
- Loop
- End Sub
复制代码
|