Set WshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2")
Set objEvents = objWMIService.ExecNotificationQuery("SELECT * FROM Win32_ProcessStartTrace")
Do
Set objReceivedEvent = objEvents.NextEvent
Set colItems = objWMIService.ExecQuery("Select * From Win32_Process where ProcessID=" & objReceivedEvent.ProcessID)
For Each objItem in colItems
wscript.echo objItem.name & " " & objItem.ProcessID & " " & objItem.CommandLine
Next
Loop
然后键入命令提示符
cscript //nologo C:\folder\MonitorProcessCreation.vbs
这将监视运行命令时启动的内容。