' FileName: ProcessMagnifier.vbs   
' Function: Capture information about the running processes in detail   
' code by somebody   
' QQ: 240460440   
' LastModified:2007-11-16 18:25   
' 仅供学习   

Const HKEY_CURRENT_USER = H80000001   
oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")   
strKeyPath = "Console\%SystemRoot%_system32_cmd.exe"  
oReg.CreateKey(HKEY_CURRENT_USER, strKeyPath)   
strValueName1 = "CodePage"  
dwValue1 = 936   
strValueName2 = "ScreenBufferSize"  
dwValue2 = 98304200   
strValueName3 = "WindowSize"  
dwValue3 = 2818173   
strValueName4 = "HistoryNoDup"  
dwValue4 = 0   
strValueName5 = "WindowPosition"  
dwValue5 = 131068   
strValueName6 = "QuickEdit"  
dwValue6 = 2048   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName1, dwValue1)   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName2, dwValue2)   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName3, dwValue3)   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName4, dwValue4)   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName5, dwValue5)   
oReg.SetDWORDValue(HKEY_CURRENT_USER, strKeyPath, strValueName6, dwValue6)   

  
Dim objWSH, FinalPath   
objWSH = WScript.CreateObject("WScript.Shell")   
If (LCase(Right(WScript.Fullname, 11)) = "wscript.exe") Then  
    FinalPath = "'"  WScript.ScriptFullName  "'"  
    objWSH.Run("cmd.exe /k cscript //nologo "  Replace(FinalPath, "'", """"))   
    WScript.Quit()   
End If  

oReg.DeleteKey(HKEY_CURRENT_USER, strKeyPath)   
oReg = Nothing  

WScript.Echo()   
WScript.Sleep(1000)   
WScript.Echo("当前正在运行的进程简要信息列表如下:")   
WScript.Echo(vbCrLf)   
WScript.Sleep(2000)   

Dim MyOBJProcessName   
OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process")   
 WScript.Echo "Name:               Priority:   PID:    Owner:" vbTabvbTab"ExecutablePath: "  
WScript.Echo("---------------------------------------------------------------------------------------")   
For Each OBJProcess In OBJWMIProcess   
 MyOBJProcessName=OBJProcess.Name"                    "  
    colProperties = OBJProcess.GetOwner(strNameOfUser, strUserDomain)   
 WScript.Echo Mid(MyOBJProcessName,1,20) vbTab OBJProcess.Priority vbTab OBJProcess.ProcessID vbTab strNameOfUser vbTabvbTab OBJProcess.ExecutablePath   
Next  

WScript.Sleep(5000)   
WScript.Echo(vbCrLf)   
WScript.Echo("当前正在运行的进程以及其加载的模块详细信息树状结构如下:")   
WScript.Echo(vbCrLf)   
WScript.Sleep(3000)   
WScript.Echo vbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTabvbTab vbTab"创建时间             文件制造商"  

OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")   
OBJRefresher = CreateObject("WbemScripting.SWbemRefresher")   
colItems = OBJRefresher.AddEnum(OBJWMIService, "Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSet   
OBJRefresher.Refresh()   
For Each OBJItem In colItems   
    Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath   
    Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath   
    originalPath = OBJItem.Name  
    ModulePath = Split(originalPath, "/")   
    WMIPathMode = Replace(ModulePath(1), "\", "\\")   
    OBJWMI = GetObject("winmgmts:\\.\root\CIMV2")   
    colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='"  WMIPathMode  "'")   
    For Each OBJManufacturer In colManufacturer   
        FileManufacturer = Trim(OBJManufacturer.Manufacturer)   
        LCaseModulePath = LCase(Trim(OBJManufacturer.Name))   
        FileExtension = Right(LCaseModulePath, 3)   
        MyLCaseModulePath = LCaseModulePath  "                                                                                                                "  
        FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath)   
        If FileExtension = "exe" Then  
            mark = "├—"  
            FinalModulePath = Mid(MyLCaseModulePath, 1, 118)   
            WScript.Echo("│")   
        Else  
            mark = "│├─"  
            FinalModulePath = Mid(MyLCaseModulePath, 1, 116)   
        End If  
    WScript.Echo mark  FinalModulePath  FSO.DateCreated vbTab FileManufacturer                            
    Next  
Next