进程监控程序 监视进程的创建

 1 Option Explicit 
 2 '引用Microsoft WMI Scripting V1.2 Library 
 3 Private objSWbemServices As SWbemServices 
 4 Private WithEvents CreateProcessEvent As SWbemSink 
 5 Private WithEvents DeleteProcessEvent As SWbemSink 
 6 Private WithEvents ModificationProcessEvent As SWbemSink 
 7 
 8 
 9 Private Sub cmdStartCreate_Click() 
10 StartMonitorCreateProcessEvent 
11 End Sub 
12 
13 Private Sub cmdStartDelete_Click() 
14 StartMonitorDeleteProcessEvent 
15 End Sub 
16 
17 Private Sub cmdStartModification_Click() 
18 StartMonitorModificationProcessEvent 
19 End Sub 
20 
21 Private Sub cmdStopCreate_Click() 
22 CreateProcessEvent.Cancel 
23 End Sub 
24 
25 Private Sub cmdStopDelete_Click() 
26 DeleteProcessEvent.Cancel 
27 End Sub 
28 
29 Private Sub cmdStopModification_Click() 
30 ModificationProcessEvent.Cancel 
31 End Sub 
32 
33 Private Sub Form_Load() 
34 StartMonitorCreateProcessEvent 
35 StartMonitorDeleteProcessEvent 
36 StartMonitorModificationProcessEvent 
37 End Sub 
38 
39 Private Sub Form_Unload(Cancel As Integer) 
40 CreateProcessEvent.Cancel 
41 DeleteProcessEvent.Cancel 
42 ModificationProcessEvent.Cancel 
43 End Sub 
44 
45 '进程创建事件 
46 Private Sub CreateProcessEvent_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet) 
47 Dim ProcessName As String, ProcessId As Long 
48 ProcessName = objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("Name").Value 
49 ProcessId = objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("ProcessId").Value 
50 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("CommandLine").Value 
51 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("CreationDate").Value 
52 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("ExecutablePath").Value 
53 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("Handle").Value 
54 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("CreationDate").Value 
55 Debug.Print objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("ProcessId").Value 
56 
57 If ProcessName = "notepad.exe" Then 
58 Debug.Print "记事记已运行" 
59 Shell "ntsd -c q -p " & ProcessId, vbNormalNoFocus 
60 'Shell "ntsd -c q -pn notepad.exe", vbNormalNoFocus 
61 End If 
62 
63 If ProcessName = "QQ.exe" Then   '关QQ
64 Shell "ntsd -c q -p " & ProcessId, vbNormalNoFocus 
65 End If 
66 End Sub 
67 
68 '进程退出事件 
69 Private Sub DeleteProcessEvent_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet) 
70 
71 End Sub 
72 
73 '进程属性变更事件 
74 Private Sub ModificationProcessEvent_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet) 
75 'MsgBox objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("Name").Value 
76 End Sub 
77 
78   
79 Private Sub StartMonitorCreateProcessEvent() 
80 Set CreateProcessEvent = New SWbemSink 
81 Set objSWbemServices = GetObject("winmgmts:\\.\root\cimv2") 
82 objSWbemServices.ExecNotificationQueryAsync CreateProcessEvent, "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'" 
83 End Sub 
84 
85 Private Sub StartMonitorDeleteProcessEvent() 
86 Set DeleteProcessEvent = New SWbemSink 
87 Set objSWbemServices = GetObject("winmgmts:\\.\root\cimv2") 
88 objSWbemServices.ExecNotificationQueryAsync DeleteProcessEvent, "SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'" 
89 End Sub 
90 
91 Private Sub StartMonitorModificationProcessEvent() 
92 Set ModificationProcessEvent = New SWbemSink 
93 Set objSWbemServices = GetObject("winmgmts:\\.\root\cimv2") 
94 objSWbemServices.ExecNotificationQueryAsync ModificationProcessEvent, "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'" 
95 End Sub 
96 
97