File Change Monitoring

[Skitty]

1st of all, I know there are other ways of doing this via dll calls, but I was just wondering why you can't do this like this?

$Obj2 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S2 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj2) And IsObj($S2) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S1,"SINK2_")
$Obj2.ExecNotificationQueryAsync($S2, "Select * From __InstanceCreationEvent Within 5 Where " _
    & "Targetinstance Isa 'CIM_DataFile' and " _
    & "TargetInstance.Drive= 'Win32_Directory.Name=C:\\\\Documents and Settings\\\\TEST\\\\Desktop'")
While 1
Sleep(500)
Wend
Func SINK2_OnObjectReady($OB)
    Switch $OB.Path_.Class
        Case "__InstanceCreationEvent"
            MsgBox(0,"","A new file was just created: " & $OB.TargetInstance.PartComponent,1)
        Case "__InstanceDeletionEvent"
            MsgBox(0,"","A file was just deleted: " & $OB.
TargetInstance.PartComponent,1)
    EndSwitch
EndFunc

I get an error with $OB.TargetInstance.PartComponent but I don't If I use the VBS version, that doesn't quite operate through a notification like this autoit object version.

I just learned what objects are so give me some slack.

Although, I got these to work just fine-

$Obj0 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S0 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj0) And IsObj($S0) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S0,"SINK0_")
$Obj0.ExecNotificationQueryAsync($S0, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
$Obj1 = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
$S1 = ObjCreate("WbemScripting.SWbemSink")
If Not IsObj($Obj1) And IsObj($S1) Then Exit MsgBox(0,"","Could not aquire object handle.")
ObjEvent($S1,"SINK1_")
$Obj1.ExecNotificationQueryAsync($S1, "SELECT * FROM __InstanceOperationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_LogicalDisk'")
While 1
Sleep(500)
Wend
Func SINK0_OnObjectReady($OB)
Switch $OB.Path_.Class
  Case "__InstanceCreationEvent"
   ;$OB.TargetInstance.Terminate
   MsgBox(0,"Initiated",$OB.TargetInstance.Name,1)
  Case "__InstanceDeletionEvent"
   MsgBox(0,"Terminated",$OB.TargetInstance.Name,1)
EndSwitch
EndFunc
Func SINK1_OnObjectReady($OB)
If $OB.TargetInstance.DriveType = 2 Then
        Select
            Case $OB.Path_.Class()="__InstanceCreationEvent"
    MsgBox(0,"Inserted",$OB.TargetInstance.DeviceId&"\",1)
            Case $OB.Path_.Class()="__InstanceDeletionEvent"
    MsgBox(0,"Removed",$OB.TargetInstance.DeviceId&"\",1)
        EndSelect
    EndIf
EndFunc

Edit: What happened to the [AutoIt] tags?

Edited August 30, 2011 by THAT1ANONYMOUSEDUDE

[rcmaehl]

1. This has all the info you need about what happened to the forum.

2. Why not monitor the directory size and when it changes then compare the file sizes and names to their last known info?