Sign in to follow this  
Followers 0
CyberMax

Monitor Process Creation and Deletion

7 posts in this topic

#1 ·  Posted (edited)

These are 2 vbscript that monitor process creation and process deletion, if anyone could help convert it into autoit, I would be very grateful. Thank you.

Monitor Process Creation

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!" & strComputer & "rootcimv2")
Set colMonitoredProcesses = objWMIService. _      
    ExecNotificationQuery("select * from __instancecreationevent " _
        & " within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
    Set objLatestProcess = colMonitoredProcesses.NextEvent
    Wscript.Echo objLatestProcess.TargetInstance.Name
Loop

Monitor Process Deletion

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!" & strComputer & "rootcimv2")
Set colMonitoredProcesses = objWMIService. _
    ExecNotificationQuery("select * from __instancedeletionevent " _
            & "within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
    Set objLatestProcess = colMonitoredProcesses.NextEvent
    Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
Edited by Melba23
Added cleaned code

Share this post


Link to post
Share on other sites



CyberMax,

Necroing a 6-year old thread as you originally did with this post is not what we encourage here - just start a new thread yourself next time. :oops:

M23

P.S. And you might want to edit your code above as no-one is going to wade through all those tags to see what it is all about. :bye:


Any of my own code posted anywhere on the forum is available for use by others without any restriction of any kind._______My UDFs:

Spoiler

ArrayMultiColSort ---- Sort arrays on multiple columns
ChooseFileFolder ---- Single and multiple selections from specified path treeview listing
Date_Time_Convert -- Easily convert date/time formats, including the language used
ExtMsgBox --------- A highly customisable replacement for MsgBox
GUIExtender -------- Extend and retract multiple sections within a GUI
GUIFrame ---------- Subdivide GUIs into many adjustable frames
GUIListViewEx ------- Insert, delete, move, drag, sort, edit and colour ListView items
GUITreeViewEx ------ Check/clear parent and child checkboxes in a TreeView
Marquee ----------- Scrolling tickertape GUIs
NoFocusLines ------- Remove the dotted focus lines from buttons, sliders, radios and checkboxes
Notify ------------- Small notifications on the edge of the display
Scrollbars ----------Automatically sized scrollbars with a single command
StringSize ---------- Automatically size controls to fit text
Toast -------------- Small GUIs which pop out of the notification area

 

Share this post


Link to post
Share on other sites

CyberMax,

I have moved the cleaned-up code from your new necro-post in the other thread here and deleted the other post. :oops:

DO NOT POST IN THAT THREAD ANY MORE!

M23


Any of my own code posted anywhere on the forum is available for use by others without any restriction of any kind._______My UDFs:

Spoiler

ArrayMultiColSort ---- Sort arrays on multiple columns
ChooseFileFolder ---- Single and multiple selections from specified path treeview listing
Date_Time_Convert -- Easily convert date/time formats, including the language used
ExtMsgBox --------- A highly customisable replacement for MsgBox
GUIExtender -------- Extend and retract multiple sections within a GUI
GUIFrame ---------- Subdivide GUIs into many adjustable frames
GUIListViewEx ------- Insert, delete, move, drag, sort, edit and colour ListView items
GUITreeViewEx ------ Check/clear parent and child checkboxes in a TreeView
Marquee ----------- Scrolling tickertape GUIs
NoFocusLines ------- Remove the dotted focus lines from buttons, sliders, radios and checkboxes
Notify ------------- Small notifications on the edge of the display
Scrollbars ----------Automatically sized scrollbars with a single command
StringSize ---------- Automatically size controls to fit text
Toast -------------- Small GUIs which pop out of the notification area

 

Share this post


Link to post
Share on other sites

CyberMax,

I have moved the cleaned-up code from your new necro-post in the other thread here and deleted the other post. :oops:

DO NOT POST IN THAT THREAD ANY MORE!

M23

Sorry :doh: , and I did clean the colour tags, it was by accident when I copy and paste these scripts from my computer. :bye:

Share this post


Link to post
Share on other sites

CyberMax,

No problem! :oops:

M23


Any of my own code posted anywhere on the forum is available for use by others without any restriction of any kind._______My UDFs:

Spoiler

ArrayMultiColSort ---- Sort arrays on multiple columns
ChooseFileFolder ---- Single and multiple selections from specified path treeview listing
Date_Time_Convert -- Easily convert date/time formats, including the language used
ExtMsgBox --------- A highly customisable replacement for MsgBox
GUIExtender -------- Extend and retract multiple sections within a GUI
GUIFrame ---------- Subdivide GUIs into many adjustable frames
GUIListViewEx ------- Insert, delete, move, drag, sort, edit and colour ListView items
GUITreeViewEx ------ Check/clear parent and child checkboxes in a TreeView
Marquee ----------- Scrolling tickertape GUIs
NoFocusLines ------- Remove the dotted focus lines from buttons, sliders, radios and checkboxes
Notify ------------- Small notifications on the edge of the display
Scrollbars ----------Automatically sized scrollbars with a single command
StringSize ---------- Automatically size controls to fit text
Toast -------------- Small GUIs which pop out of the notification area

 

Share this post


Link to post
Share on other sites

#6 ·  Posted (edited)

HotKeySet("{ESC}","ESC")
Global Const $hPSAPI = DllOpen("psapi.dll")
Global Const $hKERNEL32 = DllOpen("kernel32.dll")
ObjEvent("AutoIt.Error", "_DeBug"); capture any com errors just in case, this way the app wont crash.
Local $Obj = ObjGet("winmgmts:{impersonationLevel=impersonate}!" & @ComputerName & "rootcimv2")
Local $hObj = ObjCreate("WbemScripting.SWbemSink")
If IsObj($Obj) And IsObj($hObj) Then
    ObjEvent($hObj, "SINK_"); Set up a callback to populate the list view when a process dies or spawns every 500 miliseconds
    ;I didn't know I could monitor events this way instead of capturing other unwanted events... We'll use this now :)
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceCreationEvent WITHIN 0.5 WHERE TargetInstance ISA 'Win32_Process'")
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceDeletionEvent WITHIN 0.5 WHERE TargetInstance ISA 'Win32_Process'")
EndIf
Sleep(9999999999)
Func SINK_OnObjectReady($OB)
    Switch $OB.Path_.Class
        Case "__InstanceCreationEvent"
            ConsoleWrite("+~>" & _ProcessGetPath($OB.TargetInstance.ProcessID) & @CR)
        Case "__InstanceDeletionEvent"
            ConsoleWrite("!~>" & $OB.TargetInstance.ProcessID & @CR)
    EndSwitch
    Return 1
EndFunc   ;==>SINK_OnObjectReady
Func _Debug($oError)
    ConsoleWrite( _
            "!>##################### AUTOIT OBJECT ERROR ######################################" & @CRLF & _
            "->err.number is        : " & @TAB & $oError.number & @CRLF & _
            "err.scriptline is  : " & @TAB & $oError.scriptline & @CRLF & _
            ">err.retcode is        : " & @TAB & $oError.retcode & @CRLF & _
            "!>################################################################################" & @CRLF _
            )
    Return 0
EndFunc   ;==>_Debug
Func _ProcessGetPath($vProcess)
    Local $i_PID, $aProcessHandle, $tDLLStruct, $iError, $sProcessPath
    $i_PID = ProcessExists($vProcess)
    If Not $i_PID Then Return SetError(1, 0, "");process doesn't exist?
    $aProcessHandle = DllCall($hKERNEL32, "int", "OpenProcess", "int", 0x0400 + 0x0010, "int", 0, "int", $i_PID)
    If @error Or $aProcessHandle[0] = 0 Then
        Return SetError(2, $iError, "");openprocess failed
    EndIf
    $tDLLStruct = DllStructCreate("char[1000]")
    DllCall($hPSAPI, "long", "GetModuleFileNameEx", "int", $aProcessHandle[0], "int", 0, "ptr", DllStructGetPtr($tDLLStruct), "long", DllStructGetSize($tDLLStruct))
    If @error Then
        $tDLLStruct = 0
        DllCall($hKERNEL32, "int", "CloseHandle", "int", $aProcessHandle[0])
        Return SetError(4, $iError, "");getmodulefilenamex failed
    EndIf
    DllCall($hKERNEL32, "int", "CloseHandle", "int", $aProcessHandle[0])
    $sProcessPath = DllStructGetData($tDLLStruct, 1)
    $tDLLStruct = 0;format the output
    If StringLen($sProcessPath) < 2 Then Return SetError(5, 0, "");is empty or non readable
    If StringLeft($sProcessPath, 4) = "??" Then $sProcessPath = StringReplace($sProcessPath, "??", "")
    If StringLeft($sProcessPath, 20) = "SystemRootSystem32" Then $sProcessPath = StringReplace($sProcessPath, "SystemRootSystem32", @SystemDir)
    Return SetError(0, 0, $sProcessPath)
EndFunc   ;==>_ProcessGetPath
Func ESC()
    Exit(0)
EndFunc

Edited by ApudAngelorum

Things that I've done..

Icon Resource Editor: icon resource editor 

AutoIt Piano: a piano

AutoIt Unlocker: unlocks files when you want to delete them

Colorful tooltips: a wrapper for the tool tips UDF

Rouge GoogleBot: a full screen animation

ASciTE text editor: a text editor written in autoit

Warning: Posts by this user are subject to change or may disappear without notice.

Share this post


Link to post
Share on other sites

CyberMax,

Here's the first one ... you can do the second.

$strComputer = "."
$objLatestProcess = ""

$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate}!" & $strComputer & "rootcimv2")
$colMonitoredProcesses = $objWMIService.ExecNotificationQuery("select * from __instancecreationevent " _
         & " within 1 where TargetInstance isa 'Win32_Process'")

While 1
    $objLatestProcess = $colMonitoredProcesses.NextEvent
    MsgBox(0, '', $objLatestProcess.TargetInstance.Name)
WEnd

"The mediocre teacher tells. The Good teacher explains. The superior teacher demonstrates. The great teacher inspires." -William Arthur Ward

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0