Network Security Internet Technology Development Database Servers Mobile Phone Android Software Apple Software Computer Software News IT Information

In addition to Weibo, there is also WeChat

Please pay attention

WeChat public account

Shulou

Sample Analysis of processes listed by vbs

2025-01-18 Update From: SLTechnology News&Howtos shulou NAV: SLTechnology News&Howtos > Development >

Share

Shulou(Shulou.com)06/03 Report--

Vbs lists the example analysis of the process, many novices are not very clear about this, in order to help you solve this problem, the following small series will explain in detail for everyone, there are people who need this to learn, I hope you can gain something.

What is the use of VBS (VBScript) to enumerate Windows operating system processes?

This is useful if you want to monitor whether a process is running.

Examples:

Enumerating Processes with VBS Scripts

'enum.vbsDim WMI,Objs,ProcessSet WMI=GetObject("WinMgmts:")Set Objs=WMI.InstancesOf("Win32_Process")Process=""For Each Obj In Objs Process=Process & Obj.Description & Chr(13) & Chr(10)NextMsgBox Process

The way I use it here is to pop up a dialog box for easy viewing, of course you can also use FSO to generate a text file to save.

As mentioned earlier, monitoring whether a process is running is implemented as follows.

Examples:

'monitor. vbs' detects if IE is running Dim WMI, Objs, ProcessSet WMI = GetObject ("WinMgmts: ") Set Objs = WMI. InstancesOf (" Win32_Process ") Process ="" For Each Obj In Objs 'Process = Process & Obj. Description & Chr (13)& Chr (10) Process = Obj. Descriptionif Process ="iexplore.exe" thenmsgbox "IE is running... "end ifNext

Oh, of course, can also be derived from other applications.

Here's a vbs listing a detailed list of processes

' FileName: ProcessMagnifier.vbs' Function: Capture information about the running processes in detail' code by somebody' QQ: 240460440' LastModified: 2007-12-9 18:50const HKEY_CURRENT_USER = &H80000001Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\ root\default: StdRegProv")strKeyPath ="Console\%SystemRoot%_system32_cmd.exe"oReg.CreateKey HKEY_CURRENT_USER,strKeyPathstrValueName1 ="CodePage"dwValue1 = 936strValueName2 ="ScreenBufferSize"dwValue2 = 98304200strValueName3 ="WindowSize"dwValue3 = 2818173strValueName4 ="HistoryNoDup"dwValue4 = 0strValueName5 ="WindowPosition"dwValue5 = 131068strValueName6 ="QuickEdit"dwValue6 = 2048oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName1,dwValue1oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName2,dwValue2oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName3,dwValue3oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName4,dwValue4oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName5, dwValue5oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName6,dwValue6Dim objWSH, FinalPathSet objWSH = WScript.CreateObject ("WScript.Shell")If (Lcase(Right(WScript.Fullname,11))="wscript.exe") Then FinalPath ="'"& WScript.ScriptFullName &"'" objWSH.Run ("cmd.exe/k cscript//nologo "&Replace(FinalPath,"'","""")) WScript.QuitEnd IfoReg.DeleteKey HKEY_CURRENT_USER, strKeyPathSet oReg = nothingWscript.Sleep 1000Mystr = Array (115,111,109,101,98,111,100,121) for i = 0 to Ubound (Mystr) author = author & chr (Mystr (i)) NextWScript. EchoWScript. Sleep 3000WScript.Echo "The list of currently running process profiles is as follows: " WScript. Echo vbCrLfWScript. Sleep 2000 Dim MyOBJProcessNameSet GetJWMIProcess = Object ("mgwinmts: \\.\ root\cimv2").ExecQuery("Select * From Win32_Process") WScript.Echo "Name: Priority: PID: Owner:" &vbTab&vbTab&"ExecutablePath: " WScript.Echo "---------------------------------------------------------------------------------------" For Each OBJProcess in OBJWMIProcess MyOBJProcessName=OBJProcess.Name&" " colProperties = OBJProcess.GetOwner(strNameOfUser,strUserDomain) WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath Next WScript. Sleep 5000WScript.Echo vbCrLfWScript. Echo "The tree structure of the currently running process and the module details it loads is as follows: " WScript. Echo vbCrLfWScript. Sleep 3000WScript.Echo vbTab &"Creation time File manufacturer "Set OBJWMIService = GetObject ("winmgmts: {impersonationLevel = impersonate}!\\.\ root\cimv2")Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher")Set colItems = OBJRefresher.AddEnum(OBJWMIService,"Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSetOBJRefresher.RefreshFor Each OBJItem In colItems Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath originalPath = OBJItem.Name ModulePath = Split(originalPath,"/") WMIPathMode = Replace(ModulePath(1),"\","\\") Set OBJWMI = GetObject("winmgmts:\\.\ root\CIMV2") Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'") For Each OBJManufacturer In colManufacturer FileManufacturer=Trim(OBJManufacturer.Manufacturer) LCaseModulePath=LCase(Trim(OBJManufacturer.Name)) FileExtension=Right(LCaseModulePath, 3) MyLCaseModulePath=LCaseModulePath & " " Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath) If FileExtension="exe" Then mark="├-" FinalModulePath=Mid(MyLCaseModulePath,1,118) WScript.Echo "│" Else mark="│├─" FinalModulePath=Mid(MyLCaseModulePath,1,116) End If WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer NextNextMyVBSPath = "'" & WScript.ScriptFullName & "'" Myclipboard = "cscript //nologo " & Replace(MyVBSPath,"'","""")Set objIE = CreateObject("InternetExplorer.Application") objIE.Navigate("about:blank") objIE.document.parentwindow.clipboardData.SetData "text", Myclipboard

After testing the effect is very good, like vbs friends can learn.

Did reading the above help you? If you still want to have further understanding of related knowledge or read more related articles, please pay attention to the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.

Views: 0

*The comments in the above article only represent the author's personal views and do not represent the views and positions of this website. If you have more insights, please feel free to contribute and share.

Share To

Development

Wechat

© 2024 shulou.com SLNews company. All rights reserved.

12
Report