rat

If WScript.Arguments.Count = 0 Then
	RunExe "cmd /k start /b " _
		& "cscript //nologo " & """" & WScript.ScriptFullName & """" & " MonitorCreation & " _
		& "cscript //nologo " & """" & WScript.ScriptFullName & """" & " MonitorDeletion"
	WScript.Quit
End If

Execute WScript.Arguments(0)



Sub RunExe(strPath)
	Dim objWSH
	Set objWSH = CreateObject("WScript.Shell")
	objWSH.Run strPath
	Set objWSH = Nothing
End Sub

Sub MonitorCreation()
	strComputer = "."
	Set objWMIService = GetObject("winmgmts:" _
	    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
	Set colMonitoredProcesses = objWMIService. _        
	    ExecNotificationQuery("select * from __instancecreationevent " _ 
	        & " within 1 where TargetInstance isa 'Win32_Process'")
	i = 0
	
	Do While i = 0
	    Set objLatestProcess = colMonitoredProcesses.NextEvent
	    Wscript.Echo Now() & "   Process Created: " & vbCrLf & objLatestProcess.TargetInstance.CommandLine & vbCrLf
	Loop
End Sub

Sub MonitorDeletion()
	strComputer = "."
	Set objWMIService = GetObject("winmgmts:" _
	    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
	Set colMonitoredProcesses = objWMIService. _
	    ExecNotificationQuery("select * from __instancedeletionevent " _ 
	            & "within 1 where TargetInstance isa 'Win32_Process'")
	i = 0
	
	Do While i = 0
	    Set objLatestProcess = colMonitoredProcesses.NextEvent
	    Wscript.Echo Now() & "   Process Deleted: " & vbCrLf & objLatestProcess.TargetInstance.CommandLine & vbCrLf
	Loop
End Sub
复制代码