『第
7 楼』:
5秒提示方式
On Error Resume Next
strComputer = "."
arrTargetProcs = Array("calc.exe")
set objShell = CreateObject ("Wscript.Shell")
Set SINK = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
objWMIService.ExecNotificationQueryAsync SINK, _
"SELECT * FROM __InstanceCreationEvent WITHIN 1 " & _
"WHERE TargetInstance ISA 'Win32_Process'"
Do
WScript.Sleep 1000
Loop
Sub SINK_OnObjectReady(objLatestEvent, objAsyncContext)
For Each strTargetProc In arrTargetProcs
If LCase(objLatestEvent.TargetInstance.Name) = LCase(strTargetProc) Then
ProcessName=objLatestEvent.TargetInstance.Name
objShell.Popup Now & " 发现进程: " & ProcessName, 5, "提示信息"
intReturn = objLatestEvent.TargetInstance.Terminate
If intReturn = 0 Then
objShell.Popup Now & " 终止进程: " & ProcessName & " 成功", 5, "提示信息"
Else
objShell.Popup Now & " 终止进程: " & ProcessName & " 失败", 5, "提示信息"
End If
End If
Next
End Sub 宁静日志方式(D:\kill.log)
On Error Resume Next
strComputer = "."
arrTargetProcs = Array("calc.exe")
set objShell = CreateObject ("Wscript.Shell")
set fso=Wscript.CreateObject("Scripting.FileSystemObject")
set file=fso.OpenTextFile("D:\kill.log",2,True)
Set SINK = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
objWMIService.ExecNotificationQueryAsync SINK, _
"SELECT * FROM __InstanceCreationEvent WITHIN 1 " & _
"WHERE TargetInstance ISA 'Win32_Process'"
Do
WScript.Sleep 1000
Loop
Sub SINK_OnObjectReady(objLatestEvent, objAsyncContext)
For Each strTargetProc In arrTargetProcs
If LCase(objLatestEvent.TargetInstance.Name) = LCase(strTargetProc) Then
ProcessName=objLatestEvent.TargetInstance.Name
file.Writeline Now & " 发现进程: " & ProcessName
intReturn = objLatestEvent.TargetInstance.Terminate
If intReturn = 0 Then
file.Writeline Now & " 终止进程: " & ProcessName & " 成功"
Else
file.Writeline Now & " 终止进程: " & ProcessName & " 失败"
End If
End If
Next
End Sub
| Quote: | | arrTargetProcs = Array("calc.exe")把calc.exe改为自己的程序名 |
|
|
