Implement monitoring process creation and deletion code with VBS _VBS

Monitors the creation of a process, alerting the temporary event consumer every time a new process is created.

1. Monitoring the creation of processes

Copy Code code as follows:

StrComputer = "."
Set objWMIService = GetObject ("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colmonitoredprocesses = objWMIService. _
ExecNotificationQuery ("SELECT * FROM __InstanceCreationEvent" _
& "Within 1 where TargetInstance Isa ' Win32_Process '")
i = 0
Do While i = 0
Set objlatestprocess = colmonitoredprocesses.nextevent
WScript.Echo ObjLatestProcess.TargetInstance.Name
Loop

2. Monitor the removal of the process, alerting the temporary event consumer every time the process terminates.

Copy Code code as follows:

StrComputer = "."
Set objWMIService = GetObject ("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colmonitoredprocesses = objWMIService. _
ExecNotificationQuery ("SELECT * FROM __InstanceDeletionEvent" _
& "Within 1 where TargetInstance Isa ' Win32_Process '")
i = 0
Do While i = 0
Set objlatestprocess = colmonitoredprocesses.nextevent
WScript.Echo ObjLatestProcess.TargetInstance.Name
Loop

3. Monitoring processes using the processor

Copy Code code as follows:

StrComputer = "."
Set objWMIService = GetObject ("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set Colprocesses = objWMIService.ExecQuery _
("SELECT * from Win32_Process")
For each objprocess in colprocesses
Sngprocesstime = (CSng (objprocess.kernelmodetime) + _
CSng (Objprocess.usermodetime))/10000000
Wscript

Reference Links:

1. monitoring the creation of processes
2. monitoring the removal of a process

Reference: Http://hi.baidu.com/%B1%F9%D0%C4%B3%D5/blog/item/5691a1c3146ded55b219a861.html http://demon.tw/programming/ Vbs-monitoring-process-creation-and-deletion.html