strComputer = "."
arrTargetProcs = Array("calc.exe", "notepad.exe")
'数组里为要监视的进程名
Set SINK = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
objWMIService.ExecNotificationQueryAsync SINK, _
"SELECT * FROM __InstanceCreationEvent WITHIN 1 " & _
"WHERE TargetInstance ISA 'Win32_Process'"
Wscript.Echo "Are monitoring processes ..."
Do
WScript.Sleep 1000
Loop
'***************************************************************************
Sub SINK_OnObjectReady(objLatestEvent, objAsyncContext)
'Trap asynchronous events.
For Each strTargetProc In arrTargetProcs
If LCase(objLatestEvent.TargetInstance.Name) = LCase(strTargetProc) Then
intReturn = objLatestEvent.TargetInstance.Terminate
If intReturn = 0 Then
Wscript.Echo "Time: " & Now & ", Succeed!" & chr(9) & _
"Name: " & objLatestEvent.TargetInstance.Name
Else
Wscript.Echo "Time: " & Now & ", Failed!" & chr(9) & _
"Name: " & objLatestEvent.TargetInstance.Name
End If
End If
Next
End Sub
结束,运行任务管理器,结束wscript
搜索MP3
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colFiles = objWMIService. _
ExecQuery("Select * from CIM_DataFile where Extension = 'mp3'")
For Each objFile in colFiles
Wscript.Echo objFile.Name
Next