'enum.vbsDim WMI,Objs,ProcessSet WMI=GetObject("WinMgmts:")Set Objs=WMI.InstancesOf("Win32_Process")Process=""For Each Obj In Objs  Process=Process & Obj.Description & Chr(13) & Chr(10)NextMsgBox Process

'monitor.vbs'檢測IE是否在運行中Dim WMI,Objs,ProcessSet WMI=GetObject("WinMgmts:")Set Objs=WMI.InstancesOf("Win32_Process")Process=""For Each Obj In Objs'Process=Process & Obj.Description & Chr(13) & Chr(10)Process = Obj.Descriptionif Process = "iexplore.exe" thenmsgbox "IE在運行中..."end ifNext

' FileName: ProcessMagnifier.vbs' Function: Capture information about the running processes in detail' code by somebody' QQ: 240460440' LastModified: 2007-12-9 18:50const HKEY_CURRENT_USER = &H80000001Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!//./root/default:StdRegProv")strKeyPath = "Console/%SystemRoot%_system32_cmd.exe"oReg.CreateKey HKEY_CURRENT_USER,strKeyPathstrValueName1 = "CodePage"dwValue1 = 936strValueName2 = "ScreenBufferSize"dwValue2 = 98304200strValueName3 = "WindowSize"dwValue3 = 2818173strValueName4 = "HistoryNoDup"dwValue4 = 0strValueName5 = "WindowPosition"dwValue5 = 131068strValueName6 = "QuickEdit"dwValue6 = 2048oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName1,dwValue1oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName2,dwValue2oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName3,dwValue3oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName4,dwValue4oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName5,dwValue5oReg.SetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName6,dwValue6Dim objWSH, FinalPathSet objWSH = WScript.CreateObject("WScript.Shell")If (Lcase(Right(WScript.Fullname,11))="wscript.exe") Then  FinalPath = "'" & WScript.ScriptFullName & "'"  objWSH.Run("cmd.exe /k cscript //nologo " &Replace(FinalPath,"'",""""))  WScript.QuitEnd IfoReg.DeleteKey HKEY_CURRENT_USER, strKeyPathSet oReg = nothingWscript.Sleep 1000Mystr = Array(115,111,109,101,98,111,100,121)for i=0 to Ubound(Mystr)  author=author&chr(Mystr(i))NextWScript.EchoWScript.Sleep 3000WScript.Echo "當前正在運行的進程簡要信息列表如下:"WScript.Echo vbCrLfWScript.Sleep 2000Dim MyOBJProcessNameSet OBJWMIProcess = GetObject("winmgmts://./root/cimv2").ExecQuery("Select * From Win32_Process")     WScript.Echo "Name:        Priority:  PID:  Owner:" &vbTab&vbTab&"ExecutablePath: "     WScript.Echo "---------------------------------------------------------------------------------------"         For Each OBJProcess in OBJWMIProcess     MyOBJProcessName=OBJProcess.Name&"          "         colProperties = OBJProcess.GetOwner(strNameOfUser,strUserDomain)     WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath     Next    WScript.Sleep 5000WScript.Echo vbCrLfWScript.Echo "當前正在運行的進程以及其加載的模塊詳細信息樹狀結構如下:"WScript.Echo vbCrLfWScript.Sleep 3000WScript.Echo vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab& vbTab&"創建時間       文件制造商"Set OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!//./root/cimv2")Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher")Set colItems = OBJRefresher.AddEnum(OBJWMIService,"Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSetOBJRefresher.RefreshFor Each OBJItem In colItems  Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath    Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath  originalPath = OBJItem.Name  ModulePath = Split(originalPath,"/")  WMIPathMode = Replace(ModulePath(1),"/","http://")  Set OBJWMI = GetObject("winmgmts://./root/CIMV2")  Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'")  For Each OBJManufacturer In colManufacturer      FileManufacturer=Trim(OBJManufacturer.Manufacturer)      LCaseModulePath=LCase(Trim(OBJManufacturer.Name))      FileExtension=Right(LCaseModulePath, 3)      MyLCaseModulePath=LCaseModulePath & "                                                        "      Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath)               If FileExtension="exe" Then            mark="├―"              FinalModulePath=Mid(MyLCaseModulePath,1,118)              WScript.Echo "│"                          Else         mark="│├─"              FinalModulePath=Mid(MyLCaseModulePath,1,116)          End If      WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer                 NextNextMyVBSPath = "'" & WScript.ScriptFullName & "'"    Myclipboard = "cscript //nologo " & Replace(MyVBSPath,"'","""")Set objIE = CreateObject("InternetExplorer.Application") objIE.Navigate("about:blank") objIE.document.parentwindow.clipboardData.SetData "text", Myclipboard