' FileName:ProcessMagnifier.vbs ' function:capture information about the running processes in detail ' Code by somebody ' qq:240460440 ' lastmodified:2007-12-9 18:50 const HKEY_CURRENT_USER = &h80000001 Set oreg = GetObject ("winmgmts: {Impersonationlevel=impersonate}!\\.\root\default:stdregprov ") strKeyPath =" Console\%systemroot%_system32_ Cmd.exe "Oreg.createkey hkey_current_user,strkeypath strValueName1 =" CodePage "dwValue1 = 936 strValueName2 =" Screenbuf Fersize "dwValue2 = 98304200 StrValueName3 =" windowsize "dwValue3 = 2818173 strValueName4 =" Historynodup "dwValue4 = 0 S TrValueName5 = "Windowposition" dwValue5 = 131068 strValueName6 = "QuickEdit" DwValue6 = 2048 oreg.setdwordvalue Ent_user,strkeypath,strvaluename1,dwvalue1 Oreg.setdwordvalue Hkey_current_user,strkeypath,strvaluename2, DwValue2 oreg.setdwordvalue hkey_current_user,strkeypath,strvaluename3,dwvalue3 Oreg.setdwordvalue HKEY_CURRENT_ User,strkeypath,strvaluename4,dwvalue4 Oreg.setdwordvalue Hkey_currEnt_user,strkeypath,strvaluename5,dwvalue5 Oreg.setdwordvalue Hkey_current_user,strkeypath,strvaluename6, DwValue6 Dim objwsh, finalpath Set objwsh = WScript.CreateObject ("Wscript.Shell") If (Lcase (Right (wscript.fullname,11)) = "Wscript.exe") Then Finalpath = "'" & Wscript.scriptfullname & "" Objwsh.run ("cmd.exe/k cscript//nologo"
&replace (Finalpath, "'", "" ")) Wscript.Quit end If oreg.deletekey HKEY_CURRENT_USER, strKeyPath Set oreg = Nothing Wscript.Sleep 1000 mystr = Array (115,111,109,101,98,111,100,121) for i=0 to Ubound (mystr) author=author&chr (Mystr (i ) Next WScript.Echo Wscript.Sleep 3000 WScript.Echo "The current running Process summary Information list is as follows: WScript.Echo vbCrLf wscript.sleep \ Dim my Objprocessname Set objwmiprocess = GetObject ("winmgmts:\\.\root\cimv2"). ExecQuery ("SELECT * from Win32_Process") wscript.echo "Name:Priority:PID:Owner:" &vbtab&vbtab& ;" ExecutablePath: "WScript.Echo"---------------------------------------------------------------------------------------"For each objprocess in objwmiprocess myobjprocessname=objprocess.name& "" Colproperties = Objprocess.getowner (Strnameofuser,struserdomain) WScript.Echo Mid (MYOBJPROCESSN ame,1,20) &vbTab& objprocess.priority &vbTab& objprocess.processid &vbTab& strnameofuser &vbTab&vbTab& Objprocess.executablepath Next Wscript.Sleep 5000 wscript.echo vbCrLf WScript.Echo "Current The running process and its loaded module details tree structure is as follows: "WScript.Echo VbCrLf Wscript.Sleep 3000 WScript.Echo Vbtab&vbtab&vbtab&vbtab &vbtab&vbtab&vbtab&vbtab&vbtab&vbtab&vbtab&vbtab&vbtab&vbtab&vbtab &vbTab& vbtab& "Create time file Manufacturer" Set objWMIService = GetObject ("winmgmts:{impersonationlevel=impersonate}!\\. \root\cimv2 ") Set Objrefresher = CreateObject (" Wbemscripting.swbemrefresher ") Set colitems = Objrefresher.addenum ( objWMIService, "Win32_perfformatteddata_perfproc_fullimage_coStly "). Objectset Objrefresher.refresh for each objitem in colitems Dim originalpath, Modulepath, Wmipathmode, FileManufacturer, Lcasemodulepath Dim FileExtension, Mark, Mylcasemodulepath, Finalmodulepath originalpath = objItem.Name ModulePat h = Split (Originalpath, "/") Wmipathmode = Replace (Modulepath (1), "\", "\") Set Objwmi = GetObject ("Winmgmts:\\.\root\ci MV2 ") Set colmanufacturer = Objwmi. ExecQuery ("SELECT * from Cim_datafile Where name= '" & Wmipathmode & "") for each objmanufacturer in Colmanufact
Urer Filemanufacturer=trim (objmanufacturer.manufacturer) lcasemodulepath=lcase (Trim (objmanufacturer.name)) Fileextension=right (Lcasemodulepath, 3) Mylcasemodulepath=lcasemodulepath & " "Set FSO = CreateObject (" Scripting.FileSystemObject "). GetFile (Lcasemodulepath) If fileextension= "EXE" Then mark= "├-" Finalmodulepath=mi D (Mylcasemodulepath,1,118) WScript.Echo "│" Else mark= "│├─" finalmodulepath= Mid (mylcasemodulepath,1,116) End If wscript.echo Mark & Finalmodulepath & FSO. DateCreated &vbTab& filemanufacturer Next Next Myvbspath = "'" & Wscript.scriptfullname ; "'" Myclipboard = "cscript//nologo" & Replace (Myvbspath, "'", "" ") Set objIE = CreateObject (" Internetexplorer.app
Lication ") objie.navigate (" About:blank ") objIE.document.parentwindow.clipboardData.SetData" text ", Myclipboard