是用WMI来监控进程的创建和退出
Ultra String Reference Plugin, 条目 17
Address=0040786A
Disassembly=push Process_.004030C0
Text String=Select * FROM __InstanceDeletionEvent WITHIN 1 Where TargetInstance ISA 'Win32_Process'
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancecreationevent " _
" within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
2.监视进程的删除
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancedeletionevent " _
"within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
3.监视进程使用处理器的情况
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_process")
For Each objProcess in colProcesses
sngProcessTime = ( CSng(objProcess.KernelModeTime) + _
CSng(objProcess.UserModeTime)) / 10000000
Wscript
