用VBS实现监视进程创建与删除的代码

监视进程的创建，在每次创建新的进程时，临时事件消费程序都发出警报。

1.监视进程的创建

strcomputer = "."
set objwmiservice = getobject("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strcomputer & "\root\cimv2")
set colmonitoredprocesses = objwmiservice. _
execnotificationquery("select * from __instancecreationevent " _
& " within 1 where targetinstance isa 'win32_process'")
i = 0
do while i = 0
set objlatestprocess = colmonitoredprocesses.nextevent
wscript.echo objlatestprocess.targetinstance.name
loop

2.监视进程的删除，在每次进程终止时，临时事件消费程序都发出警报。

strcomputer = "."
set objwmiservice = getobject("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strcomputer & "\root\cimv2")
set colmonitoredprocesses = objwmiservice. _
execnotificationquery("select * from __instancedeletionevent " _
& "within 1 where targetinstance isa 'win32_process'")
i = 0
do while i = 0
set objlatestprocess = colmonitoredprocesses.nextevent
wscript.echo objlatestprocess.targetinstance.name
loop

3.监视进程使用处理器的情况

strcomputer = "."
set objwmiservice = getobject("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" & strcomputer & "\root\cimv2")
set colprocesses = objwmiservice.execquery _
("select * from win32_process")
for each objprocess in colprocesses
sngprocesstime = ( csng(objprocess.kernelmodetime) + _
csng(objprocess.usermodetime)) / 10000000
wscript

参考链接：

参考: http://hi.baidu.com/%b1%f9%d0%c4%b3%d5/blog/item/5691a1c3146ded55b219a861.html http://demon.tw/programming/vbs-monitoring-process-creation-and-deletion.html